Digital Forensics
Photo Metadata Forensics and CCTV Video Recovery
Extract images and EXIF data from cameras, cards and phones, map location artifacts, recover CCTV and DVR footage, and get findings that say what the metadata can and cannot prove.
When you need photo metadata forensics
Photo metadata forensics answers a simple question with real consequences: when, where and on what device was this picture or video made? Honeybadger Solutions extracts images and EXIF data from cameras, memory cards and phones, maps location artifacts, recovers CCTV and DVR footage, and lines it all up on a single timeline. It is part of our digital forensics services, so originals are preserved with chain of custody and every conclusion states its limits.
Typical matters include:
- A custody, divorce or protective-order case where the date or place of a photo is disputed.
- An insurance or property claim that relies on photos of damage taken “right after” the event.
- A workplace incident, slip-and-fall or theft captured on a business CCTV or DVR system.
- A personal injury or vehicle case with dashcam, doorbell, trail camera or drone footage.
- A photo or video in discovery that one side says was edited, staged or generated.
Metadata helps, but it is not proof on its own. The Scientific Working Group on Digital Evidence (SWGDE) says metadata “can be limited, absent, or altered.” A screenshot or a file saved from a text thread or social platform often has lost the original data. The native file from the device that made it is the best place to start.
What we deliver
We build each engagement from the pieces your question needs, and we tell you up front which questions call for a separate opinion.
Camera and memory card extraction
One camera or card, quoted per device: every image and video exported with hash values and an EXIF inventory listing capture time, camera make and model, serial number where recorded, settings, GPS tags and software tags. Attribution, enhancement and authenticity opinions are separate.
File, picture and geolocation analysis
Metadata and any location artifacts available from photos, phone media databases and cloud exports, plotted and checked for gaps and conflicts. Outside corroboration, such as weather, sun position, street imagery or business records, may be needed to confirm a place or time.
CCTV, DVR and special sources
Footage recovery from DVR and NVR recorders, dashcams, doorbells, trail cameras, IoT devices, legacy tapes and unusual systems, in native format with the player software and the documented clock offset. Hardware and specialist costs are quoted.
Timeline and cross-device correlation
We normalize time zones and clock offsets, then correlate photos, video, phone location records, messages and other named sources into one timeline that shows where they agree and where they do not.
Authenticity screening (separate scope)
When a file is in dispute, we review its structure, metadata consistency, compression history and any Content Credentials it carries. An authenticity or enhancement opinion is scoped and quoted on its own.
Findings report and testimony
A plain-language report with hash values, methods, tool versions and stated limits. Declarations and testimony are arranged through our expert witness service.
What can photo metadata prove, and what can it not?
| Artifact | What it may show | Limits |
|---|---|---|
| EXIF capture date and time | The camera clock reading when the shot was taken | The clock may be wrong or unset, older files may lack a time zone, and the field can be edited |
| GPS tags | Latitude, longitude and sometimes altitude and direction | Only present if location was on; may be removed when a file is shared, exported or uploaded |
| Make, model and serial | The type of device, sometimes the specific unit | Many devices share a model; the fields can be changed |
| Software tag | An app that processed or saved the file | A missing tag does not mean the file was never edited |
| Phone media database | When an item was added, edited, hidden, deleted or synced | Depends on the OS version and the level of extraction |
| DVR clock and logs | Recorder time compared with real time, exports and system events | Needs a documented offset against a known time reference |
| Content Credentials (C2PA) | Signed provenance from tools that support the standard | Most files carry none, and their absence proves nothing |
Exif is a published standard. The current version, Exif 3.0 (CIPA DC-008-Translation-2023), was released in June 2023. The C2PA Content Credentials specification is at version 2.3 as of October 2026.
CCTV and DVR footage: act before it overwrites
Most recorders loop. When the disk fills, the oldest video is overwritten, so footage is perishable. SWGDE’s best practices for DVR acquisition (17-V-002, 2018) call for documenting whether overwrite is enabled and acquiring video as soon as possible. They also say the recorder’s proprietary format “is most likely to provide the best video evidence,” that the offset between the DVR clock and a known time reference should be calculated, and that you should not change the time and date on the DVR.
That is exactly how we work. We export in native format, capture the player or codec, photograph the clock against a reference, hash every export and log each step. If the recorder cannot export cleanly, we image its drive.
How an engagement runs
- Request online. Pick photo, video or CCTV forensics on the request form and tell us the question you need answered.
- Scope. We confirm the sources, who owns them, any deadlines and whether the work may go to court.
- Preserve originals. Cameras and cards are imaged write-protected; phones are extracted with Oxygen Forensic Detective, Cellebrite UFED or Magnet AXIOM; recorders are exported in native format. Everything is hashed and logged. Remote collection kits are available nationwide.
- Inventory and analyze. We build the EXIF and location inventory, flag conflicts and test the timeline against other records.
- Correlate. Clock offsets and time zones are normalized so every source lines up.
- Report. You receive findings, methods and limits in plain language, ready for counsel to review.
Authority, consent and legal limits
We work only with media and devices that you own, control or have been lawfully given, such as your own phone or camera, a business’s own CCTV system, or material produced in discovery or under court order. We do not sign in to someone else’s cloud account, pull footage from a recorder without the owner’s consent or a court order, or bypass authentication we are not authorized to bypass.
In federal court, Federal Rule of Evidence 901(a) requires evidence “sufficient to support a finding that the item is what the proponent claims it is.” Rule 901(b)(4) lets a party rely on distinctive characteristics such as internal patterns, and 901(b)(9) on evidence that a process or system produces an accurate result. Since 2017, Rule 902(14) has allowed data copied from a device to be self-authenticated by a process of digital identification, such as a hash, with a qualified person’s certification. Our acquisition notes are written with those rules in mind.
SWGDE’s image authentication guidance (18-I-001, version 2.0, March 2025) notes that “it is impossible to prove a negative.” A careful examination can show that manipulation is unlikely, and we say so plainly when that is the limit of the evidence.
This is general information, not legal advice. Your attorney decides how the evidence is offered.
How it is priced
In a photo metadata forensics engagement, camera and memory card extraction is quoted per device, up to a stated capacity, and includes the export and the EXIF inventory. File, picture and geolocation analysis and timeline correlation are hourly against an initial allowance we agree on after scoping; we ask for written approval before going past it. CCTV, DVR, legacy and special sources are hourly with a minimum block, and hardware or specialist costs are quoted in advance.
What moves the quote: the number of devices and files, recorder type and condition, how many sources must be correlated, travel for onsite DVR work, and whether you need an authenticity opinion or testimony.
| Included | Quoted separately |
|---|---|
| Evidence intake, chain of custody, hashes | Authenticity and enhancement opinions |
| File export and EXIF inventory | Attribution of a file to a specific device |
| Acquisition notes and stated limits | Recorder hardware, specialist tools and travel |
| Plain-language findings | Declarations, depositions and trial testimony |
Mistakes to avoid before you send us a photo or video
- Do not rely on a screenshot or forwarded copy. Keep the original device, card or account so the native file can be collected.
- Do not open and re-save originals in an editor. Saving can rewrite metadata and recompress the image.
- Do not change the DVR clock or settings. Note the time shown and the real time instead.
- Do not wait on CCTV. Ask the owner to stop overwrite or preserve the clip, then request collection.
- Do not reuse the memory card. New shots can overwrite deleted ones that may still be recoverable.
- Do write down who handled the media. Names, dates and transfers help us document custody.
Who this is for
- Law firms
- Insurers and claims adjusters
- Businesses and property managers with CCTV
- HR and corporate investigators
- Journalists and researchers
- Individuals in family and civil cases
Frequently asked questions
Can photo metadata prove when a picture was taken?
It can show what the camera clock recorded, which is strong evidence when the clock is verified and the file is original. Because metadata can be wrong or edited, photo metadata forensics tests it against the phone’s media database, other files and outside records before drawing a conclusion.
Can you tell if a photo was edited?
We can look for signs of editing, such as software tags, recompression and inconsistent metadata, and report what we find. A full authenticity opinion is a separate scope. As SWGDE notes, no one can prove a negative, but an examination can show manipulation is unlikely.
Do photos sent by text or posted online keep their metadata?
Often not. Sharing, exporting or uploading can remove location and other fields or recompress the file. That is why we collect the original from the device, card or account whenever possible.
How quickly do we need to pull CCTV or DVR footage?
As soon as possible. Many recorders overwrite the oldest video once the disk is full, and SWGDE treats DVR evidence as perishable. Ask the owner to preserve the clip, avoid changing settings and request collection right away.
Can you find where a photo was taken if it has no GPS data?
Sometimes. Phone location records, Wi-Fi and cloud artifacts may help, and visual clues can be researched through open-source methods. Our OSINT team handles visual geolocation as separate work.
Can you enhance blurry video?
Enhancement is a separate scope from recovery and metadata work. We first preserve the native footage and player, because enhancement done on a low-quality export is limited. We then tell you what is realistic before any enhancement work is quoted.
Related guides
- Metadata analysis: what files and photos reveal
- CCTV and DVR video forensics: recovering footage
- Video authentication: is the footage real?
- Deepfake forensics: detecting synthetic media
- Geolocation OSINT: where a photo was taken
- Drone forensics: flight and camera data
- Mobile and tablet forensics service
- Forensic deleted data recovery service
- OSINT investigations service
Sources: SWGDE 18-I-001 v2.0 Image Authentication; SWGDE 17-V-002 DVR Acquisition; FRE 901; FRE 902; Exif 3.0 release; C2PA. Checked as of October 2026.
We work only with media and devices the client owns, controls or has lawfully obtained, and authenticity opinions are given only within a separately agreed scope.
Preserve the original before it changes
Request photo metadata forensics online and choose the photo, video or CCTV option on the form. It routes straight to our cyber and forensics lead, so there is no phone tag while footage keeps overwriting. If a recorder is about to loop or a device may be lost, use our urgent intake form.