Craig Ball puts his pants on one leg at a time.  But, when he does, he produces excellent eDiscovery best practice blog posts!  😉  I was speaking with a colleague last week who said he would love to see more best practices and forensic stuff on this blog, and the same day, I saw a post from Craig Ball on his excellent Ball in Your Court blog about pictures and metadata.  If I cover it, that counts, right?  😉

Regardless, Craig’s post The Metadata Vanishes illustrates the challenge of getting key picture metadata from point A to point B.  He introduces the challenge as coming “from a legal assistant caught between a rock and a hard place, actually between the plaintiff and defense counsel.  The defense objected that photos produced in discovery lacked metadata, while the plaintiff insisted the photos he had furnished contained the ‘missing’ metadata.”

“How could they both be right?”, Craig asks (in bold italics, no less).  He notes that “[t]he mystified legal assistant had simply saved the photos from the transmitting message and sent them on to the other side.  She hadn’t removed any metadata.  Or had she?” Dah-duh-DAHHH!

Craig then discusses the EXIF (Exchangeable Image File Format) application metadata that’s associated with photos (including the make and model of the camera or phone, time and date information, geolocation coordinates and more) and the system metadata, which is “typically in the system’s file table that serves as a directory of electronically stored information.”

A brief evolution of picture formats and EXIF metadata follows, with Craig discussing how “Apple started phasing out JPEG images in 2017.  The replacement was a format called High Efficiency Image File Format which, as implemented by Apple, photos are stored as High-Efficiency Image Containers with the file extension .HEIC.”  But, since “most of the world still expects a picture to be a JPEG and the Windows and Cloud realms need time to catch up”, “Apple converts HEIC images to JPEGs for sharing via e-mail.”

Is that where the loss of metadata occurred?  I won’t spoil the answer, you can check out Craig’s blog here, where he also discusses encoding in Base64, how the loss of metadata apparently occurred and the workaround to actually get it back.

I routinely email pictures from my iPhone to my email address and the EXIF data that is captured can be telling as noted above.  Time, date and GPS data, among other things.  If you get a picture from somebody that was taken at their home and it contains EXIF data, you could use the longitude and latitude to determine where they live.  Scary, huh?  As this recent notable example illustrates, it could even be used to show the timeframe that certain pictures were taken in relation to each other.  But I digress… 😉

Regardless, the picture above is my way of noting how much blog traffic increases when I cover a Craig Ball story.  This blog has “gotta fevah” and the only prescription is “more Craig Ball”!

So, what do you think?  Are you surprised just how much metadata is associated with picture formats?  Please share any comments you might have or if you’d like to know more about a particular topic.

Image Copyright © National Broadcasting Company (mostly)

Disclaimer: The views represented herein are exclusively the views of the authors and speakers themselves, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.