Cheat Sheets Forensics

EXIF Tags Cheat Sheet

EXIF tag IDs in hex with name, data type and meaning: camera, date and time, exposure, GPS and orientation values, as used in photo forensics.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

EXIF stores metadata as numbered tags inside a TIFF-style structure: the main directory (IFD0), an Exif sub-directory for camera settings and a GPS sub-directory. The tag IDs below are the ones you meet most often in Image Forensics; names follow the EXIF 2.3 specification. Strip all of them before sharing with the EXIF Metadata Remover.

Data types

Code Type Size Notes
1 BYTE 1 byte Unsigned 8-bit
2 ASCII 1 byte per character NUL-terminated text
3 SHORT 2 bytes Unsigned 16-bit
4 LONG 4 bytes Unsigned 32-bit
5 RATIONAL 8 bytes Two LONGs: numerator / denominator
7 UNDEFINED 1 byte Raw bytes, meaning depends on the tag
9 SLONG 4 bytes Signed 32-bit
10 SRATIONAL 8 bytes Two SLONGs

The byte order is set by the header: II (49 49) for little-endian, MM (4D 4D) for big-endian.

Image and camera (IFD0)

Tag Name Type Meaning
0x010E ImageDescription ASCII Caption
0x010F Make ASCII Camera or phone manufacturer
0x0110 Model ASCII Camera or phone model
0x0112 Orientation SHORT How to rotate the pixels for display (values below)
0x011A XResolution RATIONAL Pixels per unit, horizontally
0x011B YResolution RATIONAL Pixels per unit, vertically
0x0128 ResolutionUnit SHORT 2 inches, 3 centimetres
0x0131 Software ASCII Firmware or the last program that saved the file
0x0132 DateTime ASCII Last modification, YYYY:MM:DD HH:MM:SS
0x013B Artist ASCII Photographer
0x8298 Copyright ASCII Copyright notice
0x8769 ExifIFDPointer LONG Offset of the Exif sub-directory
0x8825 GPSIFDPointer LONG Offset of the GPS sub-directory
0x0201 JPEGInterchangeFormat LONG Offset of the embedded thumbnail (IFD1)
0x0202 JPEGInterchangeFormatLength LONG Thumbnail length in bytes

Date, time and identity (Exif IFD)

Tag Name Type Meaning
0x9000 ExifVersion UNDEFINED Four ASCII digits, e.g. 0232
0x9003 DateTimeOriginal ASCII When the photo was taken
0x9004 DateTimeDigitized ASCII When it was stored digitally
0x9010 OffsetTime ASCII UTC offset of DateTime, e.g. +02:00
0x9011 OffsetTimeOriginal ASCII UTC offset of DateTimeOriginal
0x9012 OffsetTimeDigitized ASCII UTC offset of DateTimeDigitized
0x9290 SubSecTime ASCII Fractions of a second for DateTime
0x9291 SubSecTimeOriginal ASCII Fractions of a second for DateTimeOriginal
0x927C MakerNote UNDEFINED Manufacturer's private block (often serials, shutter count)
0x9286 UserComment UNDEFINED Comment with an 8-byte character-code prefix
0xA420 ImageUniqueID ASCII 32 hex characters identifying the image
0xA430 CameraOwnerName ASCII Owner name set in the camera
0xA431 BodySerialNumber ASCII Camera body serial number
0xA433 LensMake ASCII Lens manufacturer
0xA434 LensModel ASCII Lens model
0xA435 LensSerialNumber ASCII Lens serial number

Exposure and capture (Exif IFD)

Tag Name Type Meaning
0x829A ExposureTime RATIONAL Shutter time in seconds, e.g. 1/250
0x829D FNumber RATIONAL Aperture, e.g. 2.8
0x8822 ExposureProgram SHORT 1 manual, 2 normal, 3 aperture priority, 4 shutter priority
0x8827 PhotographicSensitivity (ISO) SHORT ISO speed
0x9201 ShutterSpeedValue SRATIONAL Shutter speed in APEX units
0x9202 ApertureValue RATIONAL Aperture in APEX units
0x9204 ExposureBiasValue SRATIONAL Exposure compensation in EV
0x9207 MeteringMode SHORT 2 centre-weighted, 3 spot, 5 pattern
0x9209 Flash SHORT Bit field; bit 0 set means the flash fired
0x920A FocalLength RATIONAL Real focal length in mm
0xA001 ColorSpace SHORT 1 sRGB, 0xFFFF uncalibrated
0xA002 PixelXDimension SHORT or LONG Width of the main image
0xA003 PixelYDimension SHORT or LONG Height of the main image
0xA402 ExposureMode SHORT 0 auto, 1 manual, 2 auto bracket
0xA403 WhiteBalance SHORT 0 auto, 1 manual
0xA404 DigitalZoomRatio RATIONAL 0 or 1 means no digital zoom
0xA405 FocalLengthIn35mmFilm SHORT Equivalent focal length in mm
0xA406 SceneCaptureType SHORT 0 standard, 1 landscape, 2 portrait, 3 night

GPS (GPS IFD)

Tag Name Type Meaning
0x0000 GPSVersionID BYTE × 4 Usually 2 2 0 0 or 2 3 0 0
0x0001 GPSLatitudeRef ASCII N or S
0x0002 GPSLatitude RATIONAL × 3 Degrees, minutes, seconds
0x0003 GPSLongitudeRef ASCII E or W
0x0004 GPSLongitude RATIONAL × 3 Degrees, minutes, seconds
0x0005 GPSAltitudeRef BYTE 0 above sea level, 1 below
0x0006 GPSAltitude RATIONAL Metres
0x0007 GPSTimeStamp RATIONAL × 3 Hour, minute, second in UTC
0x0008 GPSSatellites ASCII Satellites used
0x000B GPSDOP RATIONAL Dilution of precision
0x000D GPSSpeed RATIONAL Speed, unit in 0x000C GPSSpeedRef (K, M, N)
0x0011 GPSImgDirection RATIONAL Direction the camera faced, 0 to 359.99 degrees
0x0012 GPSMapDatum ASCII Usually WGS-84
0x001B GPSProcessingMethod UNDEFINED GPS, CELLID, WLAN or MANUAL
0x001D GPSDateStamp ASCII UTC date, YYYY:MM:DD
0x001F GPSHPositioningError RATIONAL Horizontal error in metres

To decimal degrees: degrees + minutes / 60 + seconds / 3600, negative for S or W. 48° 51' 29.6" N is 48 + 51/60 + 29.6/3600 = 48.858222.

Orientation values (0x0112)

Value Stored pixels are To display correctly
1 Upright Nothing
2 Mirrored left to right Flip horizontally
3 Upside down Rotate 180°
4 Mirrored top to bottom Flip vertically
5 Mirrored and rotated Transpose (flip across the top-left to bottom-right diagonal)
6 Rotated 90° counter-clockwise Rotate 90° clockwise
7 Mirrored and rotated Transverse (flip across the other diagonal)
8 Rotated 90° clockwise Rotate 90° counter-clockwise

Forensic reading tips

  • Dates disagree? DateTime later than DateTimeOriginal and a Software value naming an editor means the file was re-saved; GPSDateStamp + GPSTimeStamp are in UTC and give the local offset when compared with DateTimeOriginal.
  • Thumbnail mismatch. The IFD1 thumbnail is often left untouched by editors, so a thumbnail that differs from the main image shows what was changed.
  • Missing EXIF is not proof. Messaging apps and social networks strip most tags on upload; absence says more about the route than about the camera.

Try these tools

Image Forensics

Analyze photos for tampering with ELA, noise analysis, clone detection and EXIF metadata extraction.

EXIF Metadata Remover

Remove EXIF, GPS location, camera serial number, XMP, IPTC and comments from JPEG, PNG and WebP photos in your browser.

See also

  • Guide How EXIF Photo Metadata Works
    What EXIF stores inside a photo, where it sits in a JPEG, how to turn GPS degrees into decimal coordinates.
  • Glossary EXIF
    EXIF (Exchangeable Image File Format) is metadata stored inside photos that records the camera, settings, date and often the GPS location.
  • Glossary Geotag
    A geotag is geographic location data, such as latitude and longitude, attached to a photo, video or post.
  • Glossary Metadata
    Metadata is data about data: the hidden or secondary information a file carries about itself, such as its author, creation date.

Frequently Asked Questions

DateTimeOriginal (0x9003). DateTime (0x0132) is the last time the file was changed, so an editor usually rewrites it. Neither carries a time zone unless OffsetTimeOriginal is present.

Back to the cheat sheets
AdSense Placeholder
Slot: footer_leaderboard