How to tell when a photo was taken
A photo's capture time is stored inside the file, in an EXIF field called DateTimeOriginal (tag 0x9003). Read it with your device's photo details, a free EXIF viewer, or the ChronoVerify verifier, and look for that field by name rather than the file's date. Because the field is plain text that can be edited or stripped, treat it as a strong lead, not proof.
Have a specific photo in mind? Upload it or try a sample, and ChronoVerify reads the capture time, the device, and the corroborating signals in seconds. Free, no account.
Check a photo's capture timeWhat is the difference between date taken, date modified, and date created?
Date taken is the only one of the three that records when the picture was actually shot. It lives inside the image as the EXIF field DateTimeOriginal, written by the camera or phone at the moment of capture. EXIF is the standard metadata block, maintained jointly by JEITA and CIPA, that cameras embed in a photo to carry capture details, device make and model, and sometimes GPS coordinates.
Date modified and date created are filesystem timestamps that your operating system, not the camera, controls. They change whenever the file is copied, downloaded, edited, or re-saved, so a photo from 2019 can show a "created" date of yesterday simply because you saved a copy. The table below maps each one to where it lives and what changes it.
| Field | Where it lives | What it means | What changes it |
|---|---|---|---|
| Date taken | Inside the photo, EXIF DateTimeOriginal (tag 0x9003) in the EXIF sub-IFD | The moment the original image was captured | Editing EXIF directly (e.g. ExifTool, Lightroom); otherwise stays fixed |
| Date modified | The filesystem, set by the operating system | When the file was last saved or changed on disk | Any save, edit, or re-export of the file |
| Date created | The filesystem, set by the operating system | When this copy of the file appeared on this device | Copying, downloading, or moving the file |
There is a fourth value worth naming. EXIF DateTime (tag 0x0132), stored separately in the main IFD0, records when the file was last saved by an editor, not when it was captured. Do not confuse it with DateTimeOriginal. A photo edited and re-saved will show an updated DateTime while DateTimeOriginal stays tied to the original shot.
Why does Windows date taken differ from the file date?
They differ because they read two different sources. Windows "Date taken" (the property System.Photo.DateTaken) maps directly to EXIF DateTimeOriginal: Microsoft documents it with propID 36867, which is the decimal form of tag 0x9003. The separate "Date" column in File Explorer reflects a filesystem timestamp instead, so copying or editing the file updates one value while leaving the embedded capture time unchanged.
Each platform exposes the capture date through its own path, and each can read or write it slightly differently. The model here is simple: the embedded EXIF field is the source of truth, and every operating system surfaces a friendlier label on top of it.
- Windows. Right-click the file, choose Properties, then the Details tab; Date taken comes from EXIF DateTimeOriginal.
- macOS. Open the image in Photos and choose Get Info to see and edit the capture date and time.
- iPhone. Open the photo in Photos and tap the info button, or use Adjust Date and Time. Note that date edits made in Apple Photos are stored in the Photos library database, not written back into the original file, so a cabled export of originals keeps the unmodified EXIF.
- Android. The gallery reads MediaStore DATE_TAKEN, an indexed value derived from DateTimeOriginal and expressed in epoch milliseconds. From Android 10 onward it is left blank when that metadata is absent rather than guessed.
Why does my photo have no date taken at all?
A missing capture date is common and is not evidence that an image is fake. The field was almost certainly removed somewhere between the camera and your screen. The usual causes:
- Social platforms strip the public copy. Facebook, Instagram, and X remove most EXIF, including GPS, from the image they serve publicly. They ingest the full original first (X began removing photo GPS in 2015), but the version you download is stripped. Absence of metadata in a downloaded copy never means the platform "never had" it.
- Messaging apps strip too. WhatsApp removes EXIF from images sent as a compressed Photo but preserves full EXIF, including exact GPS, when the same image is sent as a Document. Signal strips all EXIF before sending and does not retain originals server-side.
- Screenshots never had one. Nothing photographed a screenshot, so there is no DateTimeOriginal to begin with.
- Re-exporting or editing can drop or rewrite the field.
The takeaway for triage: do not read a missing date as a red flag. Legitimate photos lose their metadata constantly. If you want to see the difference between a stripped image and a signed one, read our guide on what Content Credentials and C2PA are.
How accurate is photo EXIF date data as evidence?
An EXIF timestamp is a claim made by the file, not a guarantee, and it sits at the bottom of a reliability ladder. DateTimeOriginal is plain text; exiftool -DateTimeOriginal=... rewrites it in one command. It also inherits whatever the camera's clock said, including an unset or wrong time zone. That makes a raw EXIF date useful as a lead and weak as proof.
Two further pitfalls catch people out. First, base EXIF date tags carry no time zone: a value like 15:30 is ambiguous unless OffsetTimeOriginal (added in EXIF 2.31, 2016) is present. Second, DateTimeDigitized usually equals DateTimeOriginal for a phone or camera shot, but the two diverge for scanned film, where DateTimeDigitized records when the scanner created the digital file. Stronger confidence comes from corroboration, roughly in this order:
- GPS time and position. GPSDateStamp and GPSTimeStamp come from satellites in UTC, which is harder to fake than a hand-set clock, though it can still be stripped or absent.
- Content Credentials. The C2PA standard produces a cryptographically signed, tamper-evident manifest. Combined with a trusted (RFC 3161-style) timestamp, it confirms the content was signed while the certificate was valid, a stronger anchor than raw EXIF. It is only present when the capture device or editor signed the image, which is still uncommon in the wild.
- Outside evidence. Sun position and shadow geometry, computed for a place and date with a tool such as SunCalc, can constrain a plausible time window. Treat it as corroboration, not a precise clock.
How to find when a photo was taken
Work from the friendly label down to the raw field, then corroborate. Each step matches a layer of confidence.
- Open the photo's details. On Windows, right-click the file, choose Properties, then the Details tab, and read Date taken. On Mac, open the photo in Photos and choose Get Info.
- Check the date on your phone. On iPhone, open the photo in Photos and tap the info button or Adjust Date and Time. On Android, the gallery info panel shows a date drawn from MediaStore DATE_TAKEN, which is blank when the metadata is missing.
- Read the raw EXIF. Open the image in a free EXIF viewer and look specifically for DateTimeOriginal rather than the file date. Note whether an OffsetTimeOriginal tag is present, since without it the time has no zone. ChronoVerify's free EXIF and XMP viewer works in the browser with no install.
- Check the photo on ChronoVerify. Upload or paste the photo into the free ChronoVerify verifier. It returns the capture time, the device, whether the metadata is internally consistent, and whether any signed Content Credentials are present.
- Corroborate before you trust it. Treat the date as a lead. Confirm it against GPS time, Content Credentials, or independent evidence such as sun position or a known event before relying on it.
How ChronoVerify checks a capture time
ChronoVerify runs a deterministic pipeline rather than trusting any single editable field. It reads the EXIF dates and device data, checks whether any C2PA Content Credentials are present and valid, and runs pixel forensics, then reports whether the signals agree and flags contradictions. It does not declare an embedded time true; it tells you how far the file corroborates its own claim. The full pipeline and its limits are documented on the method page, and the verifier itself is free at chronoverify.com. Developers who need this at scale can get an API key on the pricing page, which uses flat per-image pricing with no operation multipliers.
Honest limits
Read every signal as triage, not courtroom proof. An EXIF date can be edited, depends on the camera clock, and often lacks a time zone. Pixel forensics is probabilistic and becomes unreliable on recompressed, stripped, or screenshot images. Error Level Analysis in particular produces false positives and is not accepted forensic proof. Most importantly, a missing signal is not evidence of fakery: platforms strip metadata from legitimate photos every day. The honest answer is a confidence level with reasons, not a verdict of true or false. ChronoVerify counters this by requiring two corroborating signals before it flags anything: on its measured real-photo corpus, no authentic capture was wrongly flagged. The benchmark has the details.
Want a photo's capture time and whether its data holds together?
Check a photo nowCommon questions
What is the difference between date taken, date modified, and date created?
Date taken is the capture time stored inside the photo as EXIF DateTimeOriginal. Date modified and date created are filesystem timestamps set by your operating system, and they change when the file is copied, downloaded, or re-saved. Only date taken is meant to track the original moment of capture.
Why does Windows date taken differ from the file date?
Windows date taken reads the EXIF DateTimeOriginal tag, while the separate Date column in File Explorer reflects a filesystem timestamp. They disagree because copying or editing the file updates the filesystem date but leaves the embedded EXIF capture time untouched.
Can a photo's date be faked or edited?
Yes. EXIF DateTimeOriginal is plain text that free tools such as ExifTool can rewrite in seconds, and it also depends on the camera clock being set correctly. Treat an EXIF date as a lead, not proof, and corroborate it with signed Content Credentials, GPS time, or outside evidence.
Why does my photo have no date taken at all?
The capture field was most likely stripped. Facebook, Instagram, and X remove most EXIF from the public copy on upload, screenshots never had a capture date, and re-exporting can drop the field. A missing date is common and is not evidence of fakery.
Do EXIF timestamps include a time zone?
Not by default. Base EXIF date tags record local time with no zone, so a value like 15:30 is ambiguous. Time-zone offset tags (OffsetTimeOriginal) were only added in EXIF version 2.31 in 2016, so older photos often lack them.
How can I verify when a photo was actually taken?
Cross-check the EXIF date against stronger signals. GPS time comes from satellites in UTC and is harder to fake. C2PA Content Credentials with a trusted timestamp are the strongest anchor when present. Sun position and known events can corroborate or contradict a claimed time.
Is ChronoVerify C2PA conformant?
Yes. ChronoVerify is a C2PA Conformant Validator on the C2PA Conforming Products List, record 019f8a20-6452-7a43-b11b-59d0b0e4a84a, covering validation of JPEG, PNG, WebP and AVIF under C2PA specification 2.2. The list is public, so you can check the record yourself. It covers validation rather than generation: ChronoVerify reads and validates Content Credentials, it does not sign them.
Sources and further reading: EXIF tag tables and IFD structure (Wikipedia); Microsoft Learn: System.Photo.DateTaken; Android MediaStore DateTaken; C2PA Technical Specification 2.3; EXIFData.org: do social media sites strip EXIF data.