WINDOWS 7 EXIF EDITOR WINDOWS

Windows Explorer’s “Remove Properties and Personal Information” feature removes DIRENTRY structures (properties), but does not remove StrAscii structures (properties’ string values). They are at the exact same location as in the original file (Canon_40D.jpg):Ĭonclusion: when you use Windows Explorer’s “Remove Properties and Personal Information” feature, Exif properties will be removed, but if these are string properties, they are not completely removed. However, these 3 StrAscii string values are still inside the APP1 segment: And the StrAscii structures for these 3 properties do not appear in the template result. Notice that this file has 8 DIRENTRY structures in stead of 11: 3 Exif properties have been removed (Make, Model & Software). Let’s take a look now, again with 010 Editor, at the cleaned file that was created by clicking “Remove Properties and Personal Information” (Canon_40D-redacted-W11.jpg): The Model DIRENTRY structure points to an ASCII string (StrAscii), size is 4 bytes and offset is 152 bytes. Literal string values (StrAscii structures) are stored inside the Exif data structure, after the list of DIRENTRY structures. What it does contain, is the size of the string (6 bytes) and an offset to the string itself (an offset of 146 bytes). Remark that the string “Canon”, that is the string value of the Make property, is not contained inside the DIRENTRY structure for said property. Opening the template DIRENTRY structure for property Make reveals the following fields: There are 11 properties, the first is Make (tag 0x010F) and the second one is Model (tag 0x0110). The JPG template is also able to parse Exif data: I drilled down in the template hierarchy, until I found the Exif properties (circled in red). This can be seen in the Template Results below the hexadecimal dump: When I open the original file (Canon_40D.jpg) with 010 Editor, a template for JPEG files is automatically used to parse the structure of the JPEG file. Although properties have been removed, Microsoft Explorer’s removal feature did not shrink the segment.

Segments APP1 of both pictures have the same size, 2476 bytes. This means that only the Exif data has changed, nothing else, like the picture itself. Notice that all the hashes of the segments are identical, except for the third segment, APP1. Here is the output for file Canon_40D.jpg (original file), I’m using option -E to include the SHA256 hash of the data of each segment:Īnd here is the output for file Canon_40D-redacted-W11.jpg (redacted file): JPEG files are composed of segments of data, these segments can be analyzed with my tool jpegdump.py. Looking at the redacted file with binary editor 010 Editor, I noticed that these properties had not been completely removed. When you click OK, a new file will be created: Canon_40D – Copy.jpg (I renamed this file to Canon_40D-redacted-W11.jpg, because I tested this first on my Windows 11 machine).įile Canon_40D.jpg contains Exif data pertaining to the camera, like its maker and model:įile Canon_40D-redacted-W11.jpg (the redacted version of file Canon_40D.jpg) contains less Exif data: the maker and model properties have been removed: Then click “Remove Properties and Personal Information”: Within an open folder (Windows explorer), select a media file (I’m using Canon_40D.jpg), right-click and select properties: There is an issue with this feature: it does not properly remove Exif data.

For example, removing Exif data from JPEG files. Windows explorer has an option to remove properties from media files: “Remove Properties and Personal Information”.

Windows 7 exif editor