Help me solve a crime - seriously!

18th Oct 2022 05:31 #1

Member

I can't talk about the details of the case, but one part of it hinges on whether a doctored video was produced by the accused (who is based in New Zealand) or their accomplice in Thailand, who they're trying to lay everything on. The metadata is below. Obviously the bit that sticks out is the +12:00 (New Zealand is a UTC+12:00 timezone) on the creation date. But the accused is claiming that they didn't *create* the video, they merely uploaded it, and must have appended a new creation date in the process.

So I got some real specific questions, hopefully this is the right place to come for the very specific expertise?

1. Does anything apart from Apple Quicktime call itself Quicktime? i.e. Does some other thing produce files "written by QuickTime" due to weird library reuse/legacy/compatibility weirdness?
2. Are the encoding date and the com.apple.quicktime.creationdate both written by QuickTime? How should I interpret them being an hour apart?
3. Is there any reason why uploading/downloading - eg. via Facebook, or Whatsapp or Google Drive - would change the encoding date or the creation date?
4. What does com.apple.photos.originating.signature mean? Was it recorded a video recorded with the Photos app?

Hope you can help me crack this one!

Format : MPEG-4
Format profile : QuickTime
Codec ID : qt 0000.00 (qt )
File size : 426 KiB
Duration : 8 s 888 ms
Overall bit rate : 393 kb/s
Encoded date : UTC 2022-05-13 09:16:15
Tagged date : UTC 2022-05-13 09:16:16
Writing library : Apple QuickTime
Copyright : aef7074170af1dde98098fe248d159a5
com.apple.photos.originating.signature : AS4jG3aGyTLsjXeWmpj4eKRsTYOo
com.apple.quicktime.creationdate : 2022-05-13T20:18:49+12:00