The short answer
EXIF can record exactly when a camera believes a photo was taken — often to the second. Whether that equals reality depends on the device's clock, the file's journey, and whether anyone edited it. A timestamp is strong, checkable evidence when its chain is intact — and just a claim when it is not.
The four dates inside (and around) a photo
The shutter moment, per the camera's clock at capture. The primary evidence.
When the file was last saved — moves with every editor pass.
Created/modified on your disk. Copy or download the file and these are new; they say nothing about capture.
Time from the GPS fix or container stamp — useful cross-checks, since they don't rely on the camera clock alone.
How timestamps go wrong
- Wrong clock — a camera set to the wrong timezone shifts every timestamp, sometimes by hours; some never set at all (asking for 1970 or 2000 dates).
- Editor passes — re-saving updates ModifyDate while DateTimeOriginal usually survives; some tools reset both.
- Platform stripping — social apps remove timestamps entirely; "the date" in a chat app is the send date, not the capture date.
- Deliberate forgery — free tools rewrite any EXIF field in seconds; timestamps are among the easiest fields to fake.
When a timestamp IS trustworthy
- Chain intact — original file from the camera, never re-saved or stripped, with matching thumbnail and structure (a "camera original" journey classification).
- Corroborated — GPS fix time, file structure and content (shadows, events) all agree.
- Contemporaneous records — platform upload logs, cloud timestamps or backups from the period support it.
How to check a photo's dates
- Upload to the free EXIF viewer — DateTimeOriginal, ModifyDate and related fields appear in the Camera & Metadata card.
- Check the Journey classification: a camera-original file's timestamp carries real weight; a stripped or platform-processed file's story is unverifiable.
- Compare against GPS time and file structure for agreement.
The calibrated conclusion
Say "the file records a capture time of…" — not "the photo was taken at…". The first is a fact about the file; the second is an inference the evidence may or may not support. That distinction is the whole discipline.