When Was This Photo Taken? Reading a Photo's Real Timestamp
A photo records the moment it was taken, but the file carries three different dates and they often disagree. Here's how to find the real one, and why it can be wrong.
The file date is not the photo date. That’s the first thing to know, and it’s why so many people conclude a photo was taken on the day they copied it to a new drive.
The real answer is inside the file.
Three dates, not one
EXIF stores several timestamps, and knowing which is which resolves most confusion:
| Field | What it means |
|---|---|
| DateTimeOriginal | When the shutter fired. This is the one you want. |
| CreateDate / DateTimeDigitized | When the image was digitised. Identical to the above for a digital camera, different for a scan |
| ModifyDate | When the file was last written by software |
Separately, your operating system keeps its own “date created” and “date modified”, and those describe the file, not the photograph. Copy a photo to a new computer and the OS date becomes today. The EXIF date doesn’t move.
Almost every “why are my photos all dated today?” problem is this distinction.
How to read it
Windows: right-click → Properties → Details → Date taken. That field is reading EXIF, not the filesystem.
macOS: Preview → Tools → Show Inspector (⌘I) → EXIF tab.
iPhone / Android: open the photo, swipe up or tap ⓘ. The date shown is the EXIF one.
exiftool: exiftool -time:all -a photo.jpg shows every date field at once, which is
the fastest way to spot a disagreement.
Why the timestamp is often wrong
Even when you find DateTimeOriginal, treat it with some care:
The camera clock was wrong. Standalone cameras don’t set themselves. A body that never had its clock adjusted after a battery change can be years out. This is routine, not exotic.
Nobody recorded the timezone. Classic EXIF has no timezone field, just a local
wall-clock reading with no indication of which wall. A photo taken at 14:00 in Tokyo and
one taken at 14:00 in Berlin are indistinguishable in the file. Newer cameras write an
OffsetTime field; most older images have nothing.
Daylight saving. Phones handle it; cameras generally don’t.
An editor rewrote it. Some software helpfully “corrects” dates on export.
So a photo timestamp is a good approximation and a poor certainty.
The bigger caveat
Like everything else in EXIF, the timestamp is editable. Changing a photo’s recorded date takes seconds with free software. There’s nothing cryptographic about it, no signature, nothing that would reveal the change.
That means an EXIF date is not evidence. It’s a record, and a useful one, but for anything where the date genuinely matters (insurance, legal, disputes), the metadata is a starting point for an investigation, not the end of one. Real forensic work looks at error-level analysis, the embedded thumbnail, sensor noise patterns, compression history: the things that are hard to fake without leaving traces.
Anyone treating a timestamp as proof is trusting a field anyone could have typed.
If there’s no date at all
Same reasons the location goes missing: the platform stripped the metadata, an editor dropped it on export, or it’s a screenshot. If a photo came off social media, its timestamp is almost certainly gone along with everything else.
At that point you’re guessing from context, which is a different discipline from reading a file.
Fixing a wrong date
If you know a camera’s clock was three hours out for a whole trip, you can shift the
timestamps back. exiftool -AllDates-=3 does an entire folder in one command. Any decent
photo manager can do the same through a UI.
Worth doing before you match photos to a GPS track, since that matching runs entirely on timestamps, and an out-by-three-hours clock puts every photo in the wrong place.
Related
- Where was this photo taken?: the location half of the same question
- Photo metadata explained: every field, what it means
- Geotag a photo: add a location, free, in your browser
FAQ
Can I tell when a photo was taken if EXIF was stripped? Not from the file. Only from context: where it was posted, what’s in frame.
Why does Windows show a different date than my phone did? Windows Explorer’s “Date modified” is the filesystem. “Date taken” is the EXIF. Compare like with like.
Do screenshots have a date taken?
They get a file creation date, but usually no DateTimeOriginal. There was no shutter.
Can a photo’s date be faked? Yes, trivially. That’s the point of the caveat above.