How to Tell If a Photo's Timestamp Was Changed

A Photo Has More Than One Date

When people ask whether a photo's timestamp was changed, they usually imagine a single date stamped on the file. In reality a digital photo stores several dates in its EXIF metadata, and the trick to spotting tampering is knowing which one means what — and whether they still agree with each other.

The three that matter most:

• DateTimeOriginal — written by the camera the instant the shutter fires. This is the closest thing to the "true" moment of capture.
• CreateDate (sometimes DateTimeDigitized) — when the file was first created. On a camera-original photo it matches DateTimeOriginal almost exactly.
• ModifyDate — the last time the file was saved. Every time an editor writes the file, this date updates.

Separate from all three are the filesystem dates your operating system keeps — "date created" and "date modified" in the file properties. These live outside the image and are rewritten whenever the file is copied, downloaded, or moved, so they are the least reliable of the lot. The embedded EXIF dates travel inside the photo and are what forensic checks actually read.

Why Timestamps Get Changed

Not every altered date is sinister. Most timestamp changes are a harmless side effect of ordinary processing:

• Opening and re-saving a photo in an editor bumps ModifyDate, even for a crop or a colour tweak.
• Exporting from Lightroom, Photos, or a phone gallery writes a fresh CreateDate.
• Screenshots and social-media re-uploads discard the original EXIF entirely and stamp a new "capture" time — the moment of the screenshot, not the original scene.

The deceptive cases are rarer but they are the reason people search for this: backdating a photo to fake an alibi, forward-dating one to match a claim, or rewriting the date so an old image looks recent. In those cases someone deliberately overwrites DateTimeOriginal with a tool — and that usually leaves fingerprints.

How to Check If a Timestamp Was Changed

You do not need forensic software. Upload the photo to the EXIF Checker to read the raw fields, or the Authenticity Checker for an automated Timestamps result, then work through these checks.

1. Compare the three EXIF dates

Line up DateTimeOriginal, CreateDate, and ModifyDate. On an untouched camera file they match or sit within a second or two of each other. A ModifyDate that lands hours, days, or years after DateTimeOriginal means the file was saved again after capture. That alone is normal for an edited photo — but if the person claims the image is straight off the camera, the gap contradicts them.

2. Look for an editing-software tag

Check the Software field next to the dates. "Adobe Photoshop", "Lightroom", "GIMP", or a phone editor sitting alongside the timestamps tells you the file passed through software — the same software that would have rewritten ModifyDate. A photo whose dates were touched but that carries no software tag at all is more suspicious, not less: a specialised metadata tool can rewrite dates without leaving the usual editor signature.

3. Watch for suspiciously clean times

Cameras record time to the second, and often to sub-second precision. A DateTimeOriginal of 12:00:00 exactly, or a date with no time at all, is a common sign that the value was typed by a human rather than recorded by a sensor. Genuine capture times are almost never round numbers.

4. Cross-check independent time sources

Some photos carry a second clock the editor may forget: GPS timestamps. If the file has location data, its GPS time is set by satellite and is hard to fake convincingly. When the GPS time and DateTimeOriginal disagree, one of them was altered. The sub-second and timezone-offset fields are similarly easy to overlook and can betray an edit.

Signs a Timestamp Was Altered

Taken together, these are the red flags to weigh:

• ModifyDate later than DateTimeOriginal, with no innocent explanation offered.
• DateTimeOriginal missing while other dates are present (classic re-save signature).
• A round or zeroed time value that no camera would produce.
• GPS time that conflicts with the embedded capture date.
• Dates present but the whole EXIF block otherwise stripped — someone kept what they wanted and discarded the rest.

No single flag is proof. Confidence comes from several of them pointing the same way, which is exactly how the Authenticity Checker combines its signals into one verdict rather than a yes-or-no answer.

When You Can't Tell

Timestamp forensics has hard limits. If the EXIF data was stripped — as every major social platform does on upload — there are no embedded dates left to compare, and the filesystem dates only tell you when you received the file. A skilled forger using a tool like ExifTool can rewrite all three EXIF dates to agree with each other, erasing the gap that would normally give the edit away. And a screenshot of an edited photo discards the original metadata completely, leaving only visual clues to work with.

In those cases, pivot from the date to the pixels: run the full edited-photo detection workflow and the photo authenticity guide, which lean on compression, noise, and error-level analysis that survive metadata loss.

Common Questions

How can I tell if a photo's date was changed? Compare DateTimeOriginal, CreateDate, and ModifyDate. On a camera-original they agree; a later ModifyDate, a rounded time, or an editing-software tag alongside the dates points to an edit after capture.

Which EXIF field holds the real date a photo was taken? DateTimeOriginal — the camera writes it at the moment of capture. CreateDate usually mirrors it; ModifyDate records the last save.

Can a changed timestamp be detected if the EXIF was stripped? Not from EXIF — the embedded dates are gone. You can only fall back to filesystem dates or a date visible in the image, both far weaker. The missing metadata is itself a signal.

Does editing a photo always change its timestamp? Almost always. Saving in an editor updates ModifyDate and often adds a Software tag, even for a harmless crop. So a changed timestamp proves a re-save, not deception.

Read the Dates Before You Trust Them

A photo's timestamp is only as trustworthy as the fields behind it. Checking whether a date was changed takes under a minute: read the three EXIF dates, look for a software tag, and flag any time that looks typed rather than measured. Start with the EXIF Checker to see the raw values, then run the Authenticity Checker to fold the timestamp result into a full verdict.