I was doing some reading about EXIF data and came across a quirk that I’ve been having some fun fooling around with.

Most digital cameras embed EXIF data into every image, listing such things as the type of camera, date and time the photo was taken and other details as well as a thumbnail of the image so that the file previews faster.

Most of the time, this information is lost or at least updated when an image is edited. However, sometimes the original EXIF data will carry over. Depending on the editing tool or circumstance, an image file that’s been cropped, re-sized, oriented or otherwise edited will sometimes still carry an embedded thumbnail of it’s original state, fresh off the digital camera.

There’s a few tools out there for pulling he thumbnails out of an image’s EXIF data. I decided to use jhead with my Kubuntu laptop (there are OSX and Windows clients as well, but I’ve never used them). After installing, fire up a terminal and type:

jhead -st 'thumbnail-output-filename' 'desired-image.jpg'

If there is a thumbnail embedded in the image it will be extracted to whatever filename you specify. You can then view it with whichever program you choose.

Now understand that there may not be a thumbnail and nine out of ten photos that do have them will be exact miniatures of their parent files. Still, one out of those ten photos can yield some interesting shit. Just take a minute to think of the various and plentiful reasons why a person or organization may need to edit, obscure or otherwise change an image’s original state and you might get the point of this.

To give an example, I took this image from Wikipedia, (mainly because of it’s not under some restrictive copyright and work safe) and after saving it locally, used jhead to extrat the EXIF thumbnail giving me the image below.

If you compare the thumbnail below to the image linked in the paragraph above, you can clearly see that it has been rotated ninety degrees right with parts of two additional statues and a window being completely cropped out of the image.

Here’s a link to a page where someone uses a script to search the internet, checking for and displaying images with EXIF thumbnails whose dimensions are not perfectly scaled (like the file has been cropped or otherwise changed since it’s creation) and displays them for your amazement/boredom.

So many wacky possibilities. Go spend some time on Flickr, Friendster, or MySpace. Try it on documents that have had sections digitally blacked out for confidential reasons. Go forth and be snoopy.