A photo's metadata is a witness, not a verdict

In July 2012, someone posted a photo of a fast-food worker standing in tubs of lettuce to an anonymous imageboard. Within about fifteen minutes, other users had worked out which restaurant it was. They did not recognise the building or the uniform. They used the photo’s embedded location data, along with a barcode on a box in the shot.

That story gets retold as “metadata catches a culprit”, and it is a good story. It is also a story with a gap in it, and the gap is where good investigators earn their keep. The embedded location data pointed to a place, a restaurant in Mayfield Heights, Ohio. It did not name a person. The rest played out through phone calls to the restaurant, local news coverage and the company’s own response, and three employees were fired. The metadata was a witness who saw where the photo was taken. It was never a verdict on who did what.

This post is about holding both ideas at once: metadata is some of the most useful evidence you will ever pull from a file, and it is evidence that needs checking like any other.

What metadata actually is

Every file carries information about itself. For a phone photo, that usually means a block called EXIF: the device make and model, the capture time, sometimes the exact coordinates. Editing tools add their own traces. Video files can list the clips and software that produced them.

Think of three layers:

1. What the device wrote at capture. Time, device, sometimes location.
2. What software wrote afterwards. Editor name, save times, sometimes the source files.
3. What a platform did to the copy you can see. Many sites re-encode uploads, and that often removes some or all of the first two layers.

Most mistakes in metadata work come from mixing these layers up.

Case one: a place, not a person

Back to the lettuce photo. Accounts of the incident say users used the photo’s Exif data, along with a barcode on a box, to identify the store. Notice what that gave them: a location. The step from “this store” to “these employees” was taken through phone calls, news coverage and the company’s own response.

Takeaway: metadata narrows the search. It rarely closes it.

Case two: processed is not the same as tampered

In 2025, WIRED worked with independent video forensics experts to examine a file the US Department of Justice had described as full, raw surveillance footage. The metadata referenced Adobe Premiere project files and two separate source clips, which suggested the file had been assembled and exported rather than copied straight from a recorder.

The careful part of that reporting is the part people skip. The experts cautioned that the metadata did not show what had changed, and that it did not prove deceptive manipulation. A file can be stitched together simply to prepare it for release. What the metadata did establish was narrower and still important: the “raw” label did not match the file’s own history.

Takeaway: metadata can contradict a description. It cannot tell you why the contradiction exists.

Case three: one photo is a clue, a million is a map

In 2014, researcher Owen Mundy built “I Know Where Your Cat Lives”, a data experiment that placed about a million public cat photos on a world map using the coordinates found in their metadata. The photos came from public APIs. It was a deliberate privacy demonstration, not a hunting tool, and owners could have their photos removed by changing their privacy settings.

The lesson for investigators is the aggregate one. A single geotagged photo tells you about one moment. A collection tells you about habits, routes and homes. That is why this work comes with responsibilities, and why this site only uses fictional scenarios for practice.

Do not trust claims about which platforms strip metadata

You will read confident statements online about which apps remove location data and which do not. When I compared guides on this, they disagreed with each other, and some disagreed about the same app. Behaviour also depends on how a file is sent: as a compressed photo or as a document, from a phone app or a desktop browser, and it changes when platforms update.

So treat every such claim as a hypothesis, and test it yourself with a photo you took:

exiftool -GPSLatitude -GPSLongitude -DateTimeOriginal -Make -Model -Software photo.jpg

Upload your own test photo through the route you care about, download it back, and run the same command on the downloaded copy. Whatever tags survive are the answer for that route, today.

If you are protecting yourself rather than investigating, strip the tags before the file leaves your device (exiftool -all= photo.jpg; ExifTool keeps a backup copy with _original on the end of the name). Do not rely on the platform to do it for you.

A habit that keeps you honest

Whenever a tag gives you an answer, ask three questions before you write it down:

• What does the tag literally say? Not what you hoped it said.
• Who or what could have written it? A camera, an editor, a script, a person.
• What would I expect to see if it were wrong? Then go and look for that.

Metadata can be edited, forged or stripped. Device clocks can be set wrong. A tag that agrees with your theory is still one source. Find a second, independent one: a map, a weather record, an archived page, another file.

Sources

• Burger King foot lettuce incident: the Wikipedia entry on the incident, and PetaPixel’s July 2012 report on how the location was found.
• WIRED’s 2025 analysis of the DOJ video metadata, summarised by UC Berkeley’s School of Information (Hany Farid reviewed the metadata) and by PetaPixel.
• Owen Mundy’s “I Know Where Your Cat Lives”: coverage from Geography Realm and Laughing Squid, and the IDFA 2014 festival listing.