Fun with EXIF thumbnails

Anyone that has ever surfed the internet probably has seen censored, cropped or “Photoshopped” pictures and wondered how the original picture may have looked like (Fig1). In this short article I will demonstrate how you can get a glimpse onto the original picture (under certain circumstances). Requirement for this “recovery” is the existence of an embedded EXIF thumbnail. For those of you who have never heard of EXIF I will give a short introduction in the following paragraph.

Fig 1: A censored picture. You may wonder what’s behind that mysterious black area. Stay tuned – the secret will be uncovered later in this article.

What is EXIF?

EXIF (Exchangeable image file format) is a specification for the image file format used by most modern digital cameras and even some stateof-the-art camera phones. The specification uses existing file formats like JPEG or TIFF and extends them by adding a multitude of specific metadata tags covering a broad spectrum.

Here is a small assortment of existing tags:

• Camera Manufacturer and Model Information
• Date and Time Information
• Camera Settings (Shutter speed, Focal length, Aperture, Orientation, …)
• Copyright Information

The latest EXIF specification written by the JEITA (Japan Electronics and Information Technology Industries Association) dated April 2002 can be downloaded from www.exif.org.

Fun with EXIF thumbnails

Another nice feature of EXIF is that it allows placing thumbnails in its header. This allows thumbs to be displayed faster because the computer doesn’t have to build them from the original version each time they are requested. Unfortunately, if you edit an image and forget to edit the thumbnail inside its EXIF header, everybody with a little know-how can still obtain the original version of the picture before the editing took place.

Let’s collect some facts about EXIF thumbnails and see what we can get out of it:

• Fact is that most modern digital cameras store thumbnails in the EXIF header.
• Fact is that most expensive post 2003 image manipulation programs create and store EXIF thumbnails.
• And last but not least fact is that some cheap or old image manipulation software keeps EXIF thumbnails of the original pictures because it forgets to update them after an image was edited (Microsoft Paint provided with Windows XP is one of them).

To show you what can happen if you don’t care about the thumbnails stored in the EXIF header of your images I made two photographs with my digital camera and edited them with an image manipulation program that “forgets” to update the enclosed thumbnails. Then I opened the two manipulated photos with a program called Exifer (http://www.friedemann-schmidt.com/software/exifer/) which allows viewing and editing of EXIF data, including the embedded thumbnails. Now guess what, I was able to get a glimpse of the original unedited photos – even after the editing took place. :-) (Fig 2, Fig 3)


Fig 2: You wondered what’s behind the black area in Fig 1? Then have a look at the EXIF thumbnail.

Fig 3: That can happen when you use a stupid program like Microsoft Paint for cropping your images …You can see where the picture was
taken.

If you want to see another (nasty) example about what can happen when you never heard of EXIF thumbnails you should definitely have a look at the following web page:
http://wizbangblog.com/archives/000491.php

So what have you learned today? Never forget to remove or update the EXIF thumbnails trapped in your images! Otherwise folks will have fun with them. ;-)

Btw: This would work great for those Hacked Xbox 360 and PSP photos. Hopefully they didn’t read this.

- Unic0der

Tip: For those of you who want to check their EXIF data without downloading a program like Exifer, here's a great online EXIF Viewer: Jeffrey's EXIF Viewer

This article was released in Blacklisted!411.NET (Issue 2) in November 2005. Blacklisted411.NET is the free online Edition of the hacker magazine Blacklisted!411. Make sure you also check out the other great articles in the Blacklisted!411.NET issues.