When a photo is taken, different kinds of metadata are automatically added by the camera. Most of these kinds of metadata are well understood. The location of the photo is stored in the GPS metadata. Camera information is in the EXIF metadata. However, no one seems to know what is in the “Maker Apple” metadata inside iPhone and iPad photos.
Here’s a picture showing typical metadata attached to a photo taken by an iPhone. Oftentimes “GPS” appears here also.
If you’d like to see what I’m talking about, you can see all the metadata in a photo by using the Photo Investigator app. To see the full listing and not just an overview of the metadata, in the main app hit “Metadata” -> “View All,” or in the extension hit “View All Metadata.”
Below is an example of some of the “Maker Apple” metadata.
Other companies like Nikon and Canon add their own “Maker” metadata, but those keys are well understood. For example, Maker Canon metadata includes the following keys: Owner Name, Camera Serial Number, Image Serial Number, Flash Exposure Comp, Continuous Drive, Lens Model, Firmware, and Aspect Ratio Info. Maker Nikon metadata has many similar keys and some additional keys about camera settings.
I’ll make some guesses as to what the “Maker Apple” keys mean, and run tests to check those guesses. Finding a “Serial Number” key in this metadata would be incredibly useful to trace photos to a given phone. Still, even if there isn’t a serial number in the Maker Apple metadata, many have been perplexed by its meaning.
Is Key 8 the <x, y, z> Direction of the Earth from the Camera?
Key 8 seems to be three values which are between -1 and 1. From my work on writing a free-fall timing app using the phone’s sensors, this reminds me of the vectors for acceleration and orientation. A 3 element vector, like this metadata element, commonly represents a <X, Y, Z> value in 3 dimensional space. To test this, I took some pictures while holding my phone in different orientations. I’ll round the numbers to either 0, 1, or -1, assuming they are within 0.1 of the rounded number.
Here’s the values given when holding the phone (facing down means the back camera is pointed down):
top up, portrait: < 0, -1, 0 >
bottom up, portrait: < 0, 1, 0 >
right side up, landscape: < -1, 0, 0 >
left side up, landscape: < 1, 0, 0 >
flat, facing up: < 0, 0, 1 >
flat, facing down: < 0, 0, -1 >
After this test, it seems that my guess was correct. Yes these 3 numbers represent either an acceleration vector, or the direction of the earth (which is the same as the direction of acceleration when the phone is at rest). At this point, I’m feeling like a genius for guessing what those three numbers meant. Although I’ll probably strike out on the rest of these XD
Is Key 14 Orientation Information?
From taking the last set of images, I analyzed the rest of the Maker Apple values to see if there was some other relation between when the phone took a portrait and landscape photo. It seems that when Key 14 has the value of “4”, the photo is a portrait photo, and when key 14 has a value of “0”, the photo is landscape. Yes, Key 14 does have to do with the orientation of the image.
Is Key 3 a Timestamp?
Key 3 holds 4 items: epoch, flags, timescale, and value. Obviously “timescale” points to this being a date or a time. This seems true as for the images I took, the value only increased. I took two images, 1 hour apart which gave the following:
value: 66189707406333
value: 62694509446666
The difference is 66,189,707,406,333 – 62,694,509,446,666 ~= 3,495,198,000,000
One hour in seconds is 60 * 60 = 3600 which is somewhat close to 3500
Since I didn’t time my experiment exactly, I’m going to say that this is close enough and that Yes this key is a timestamp in nanoseconds.
Is Key 2 a binary encoded string?
Key 2 is the one of the most interesting because it is a large, encoded chunk of data.
Trying to decode this value as a string from hexidecimal yielded gibberish. I’ll have to leave this key as unknown, and the rest as mysteries for the reader. Please send me an email at danny@a-r-studios.com if you have any information.
Update: Since writing this article, a couple people have filled me in on some more details. The timestamp in key 3 is the time since the device was turned on according to KryptoFo, and HackerFactor adds some more information in that this time includes time on wall power, but excludes time the device is suspended. From his analysis, it also seems Apple started adding this info in iOS7.
Update 2: The key 17 is used for live photos to link the photo to the video file that constitutes the “live” portion. The value for key 17 is also included in the video’s metadata as "com.apple.quicktime.content.identifier".
Cheers,
The Photo Investigator
The Photo Investigator App makes viewing, editing, removing and sending photo metadata. Photo and video metadata may include location (if enabled by the camera), date, device, software versions, file size, file name, an “iOS Metadata” section, and many more metadata items. more. Users can view and share DEPTH MAPS by selecting a portrait photo and tapping “Portrait”.
