Why Metadata Is Not Proof of a Date
By BlockchainSignPublished
Most people's first answer to "how do you know when this was made" is metadata: the EXIF in a photo, the created date on a file, the properties panel in a document.
It is a reasonable instinct and a weak position. Metadata is not evidence of a date — it is a claim your own computer made, that anyone can alter.
What metadata actually is
EXIF in a photograph is written by the camera from its internal clock. That clock is set by the user, is often wrong, and rarely survives a timezone change intact. The fields are stored in the file and editable with free tools; exiftool will rewrite any of them in one command.
File system dates — created, modified, accessed — come from the operating system's clock at the time of writing. Change the system clock and create a file and it is dated accordingly. There are also standard utilities whose entire purpose is setting these values.
Document properties in office and PDF formats are fields inside the file. Same story.
Camera or phone model, GPS coordinates, software used — all equally editable.
None of this is a flaw in the formats. Metadata was designed to be descriptive, not evidentiary.
The specific failure
The problem is not that metadata is usually wrong. It is usually right. The problem is that it is under the control of the person relying on it.
That is the property that matters in a dispute. Evidence whose value depends on the honesty of the party producing it does very little work. The other side does not have to prove you altered anything — they only have to point out that you could have.
What survives, and what does not
| Evidence | Who controls the date | Survives a motivated challenge |
|---|---|---|
| EXIF | You | No |
| File system dates | You | No |
| Document properties | You | No |
| Git commit dates | You | No |
| Email to yourself | Your provider | Weak |
| Cloud storage upload date | The provider | Moderate, while the account exists |
| Published post with a date | The platform | Moderate |
| Sealed envelope postmark | The post office | Weak — the envelope trick is well known |
| Blockchain record | Nobody | Yes |
| RFC 3161 token | A timestamping authority | Yes, while its cert chain holds |
The bottom two are the only rows where the date is fixed by something outside your control and checkable by an outsider.
What to do instead
Anchor the date externally. Either an RFC 3161 token from a timestamping authority, or a hash written to a public blockchain. Both take the date out of your hands, which is the entire point. See RFC 3161 vs blockchain timestamping for how the two compare.
Keep the metadata anyway. It is not worthless — it is corroborating. Consistent EXIF across a whole shoot, matching camera bodies, sequential file numbers and a coherent story is meaningful in combination. It is the sole reliance on it that fails.
Keep the originals. For photographers, the RAW file is strong evidence because only you have it. Its date is weak; its existence is not. Combine possession of the original with an external timestamp and the position is solid.
Timestamp before publication. Once an image or a document is public it can be lifted within hours, and the copy will carry whatever metadata the copier chooses. The record needs to predate that moment.
The one thing metadata does prove
Internal consistency. A set of files whose metadata tells a coherent story — same device, sequential numbering, plausible intervals — is harder to fabricate wholesale than a single file's date field.
That is a real contribution, and it is a supporting one. The anchor still has to come from somewhere you do not control.