Tampering with Video File Metadata for No Reason at All
Year of Hacking - 0x21
For the first time in 2025, the entire country is united. Unfortunately, it's because we're all certain that the government is hiding something about Jeffrey Epstein, who was killed committed suicide by shooting himself 37 times at the tail end of the first Trump administration. Lately, the President has claimed that Hillary Clinton wrote the Epstein files, which implicate her husband. Given her circumstances, I would do the same.
Hypothetically, let's assume that there was some video that the government released that would exonerate themselves from any involvement in a high-profile investigation. Also, let's assume many Americans voted to expose corruption on the Hill, some even voted because of veiled campaign promises to publish evidence relating to this investigation. It would look REALLY bad if the government left any evidence that they tampered with what they advertised as damning evidence.
At best, such an event would be evident of amateurish behavior from the Department of Justice and that the president has no control over his top administration officials. At worst, the administration is covering up for a serial child trafficker on behalf of the most powerful man cabal of people in the world.
Good thing our government isn't that incompetent. Coincidentally, I stumbled upon this website, which contains a nearly eleven-hour long capture of a security camera in what looks like a prison.
There's really two videos here, video1.mp4 and video2.mp4. We can download the files with the following commands. The DOJ describes video1.mp4 as the "raw" version, so we’ll be digging into it.
curl -C - -O https://www.justice.gov/video-files/video1.mp4
curl -C - -O https://www.justice.gov/video-files/video2.mp4This will work on any Windows, Linux, or Mac command line interface. This took me about twelve minutes to download at 30 Megabytes per second. If the connection breaks, rerun the command and it will pick up where it left off.
There is a missing minute starting at 11:59 PM until midnight. After midnight, the aspect ratio slightly changes, and what looks like an overlay in the top right from the security camera software is removed.
Next, let's look at the metadata. Most cameras and editing software exports images and video with EXIF metadata, which we can easily view EXIF data using ExifTool downloaded from exiftool.org:
exiftool ./video1.mp4Here are the complete contents of the EXIF dump:
ExifTool Version Number : 12.76
File Name : video1.mp4
Directory : .
File Size : 21 GB
File Modification Date/Time : 2025:07:12 19:36:54-06:00
File Access Date/Time : 2025:07:13 22:29:11-06:00
File Inode Change Date/Time : 2025:07:12 19:36:54-06:00
File Permissions : -rw-rw-r--
File Type : MP4
File Type Extension : mp4
MIME Type : video/mp4
Major Brand : MP4 v2 [ISO 14496-14]
Minor Version : 0.0.0
Compatible Brands : mp42, mp41
Movie Header Version : 0
Time Scale : 90000
Duration : 10:52:24
Preferred Rate : 1
Preferred Volume : 100.00%
Preview Time : 0 s
Preview Duration : 0 s
Poster Time : 0 s
Selection Time : 0 s
Selection Duration : 0 s
Current Time : 0 s
Next Track ID : 2
Track Header Version : 0
Track Create Date : 2025:05:23 23:53:22
Track Modify Date : 2025:05:23 23:53:22
Track ID : 1
Track Duration : 10:52:24
Track Layer : 0
Track Volume : 0.00%
Matrix Structure : 1 0 0 0 1 0 0 0 1
Image Width : 1920
Image Height : 1080
Media Header Version : 0
Media Create Date : 2025:05:23 23:53:22
Media Modify Date : 2025:05:23 23:53:22
Media Time Scale : 30000
Media Duration : 10:52:24
Media Language Code : eng
Graphics Mode : srcCopy
Op Color : 0 0 0
Handler Type : Alias Data
Handler Description : Alias Data Handler
Compressor ID : avc1
Source Image Width : 1920
Source Image Height : 1080
X Resolution : 72
Y Resolution : 72
Compressor Name : AVC Coding
Bit Depth : 24
Start Timecode : 00;00;00;00
XMP Toolkit : Adobe XMP Core 9.0-c001 79.c0204b2, 2023/02/09-06:26:14
Create Date : 2025:05:23 19:53:22-04:00
Modify Date : 2025:05:23 20:16:48-04:00
Metadata Date : 2025:05:23 20:16:48-04:00
Creator Tool : Adobe Adobe Media Encoder 2024.0 (Windows)
Video Frame Rate : 29.970030
Video Field Order : Progressive
Video Pixel Aspect Ratio : 1
Start Time Scale : 30000
Start Time Sample Size : 1001
Orientation : Horizontal (normal)
Instance ID : xmp.iid:c4d847fd-0cc5-eb40-bab9-d3eecaca1e63
Document ID : 3c89c950-cf8b-5b00-9465-272900000053
Original Document ID : xmp.did:4d1a28b8-4684-3b41-b7c8-74e89168a332
Format : H.264
Duration Value : 3522945426
Duration Scale : 1.11111111111111e-05
Project Ref Type : Movie
Tracks Track Name : Markers
Tracks Frame Rate : f30000s1001
Tracks Markers Start Time : 464017
Tracks Markers Type : Comment
Tracks Markers Guid : 8ac346e6-cc11-4c7b-a23a-79f4ed6400a5
Tracks Markers Cue Point Params Key: marker_guid
Tracks Markers Cue Point Params Value: 8ac346e6-cc11-4c7b-a23a-79f4ed6400a5
Video Frame Size W : 1920
Video Frame Size H : 1080
Video Frame Size Unit : pixel
Start Timecode Time Format : 29.97 fps (drop)
Start Timecode Time Value : 00;00;00;00
Alt Timecode Time Value : 00;00;00;00
Alt Timecode Time Format : 29.97 fps (drop)
History Action : saved, created, saved, saved, saved
History Instance ID : eeb39973-89ab-0637-3854-54b800000080, xmp.iid:bb85b8e0-8748-7a46-8f92-46c1516611d4, xmp.iid:e502948f-6387-9a4a-807e-6a5beaeef4de, xmp.iid:c4c7743d-0247-e14f-8816-9664e3d39fc7, xmp.iid:c4d847fd-0cc5-eb40-bab9-d3eecaca1e63
History When : 2025:05:23 20:16:48-04:00, 2025:05:23 16:48:57-04:00, 2025:05:23 20:16:48-04:00, 2025:05:23 20:16:48-04:00, 2025:05:23 20:16:48-04:00
History Software Agent : Adobe Adobe Media Encoder 2024.0 (Windows), Adobe Adobe Media Encoder 2024.0 (Windows), Adobe Adobe Media Encoder 2024.0 (Windows), Adobe Adobe Media Encoder 2024.0 (Windows), Adobe Adobe Media Encoder 2024.0 (Windows)
History Changed : /, /, /metadata, /metadata
Ingredients Instance ID : 027d9566-205a-ec45-65a2-aecc00000086, 027d9566-205a-ec45-65a2-aecc00000086, 47f19133-8591-6d7f-b8ce-155500000086, 47f19133-8591-6d7f-b8ce-155500000086
Ingredients Document ID : 94b3bbdc-bda0-cfcf-a91e-efc700000059, 94b3bbdc-bda0-cfcf-a91e-efc700000059, 1e222147-e736-4acc-115b-f98500000059, 1e222147-e736-4acc-115b-f98500000059
Ingredients From Part : time:0d6035539564454400f254016000000, time:0d6035539564454400f254016000000, time:0d3907621605888000f254016000000, time:0d3907621605888000f254016000000
Ingredients To Part : time:3907621605888000f254016000000d6035539564454400f254016000000, time:3907621605888000f254016000000d6035539564454400f254016000000, time:0d3907621605888000f254016000000, time:0d3907621605888000f254016000000
Ingredients File Path : 2025-05-22 21-12-48.mp4, 2025-05-22 21-12-48.mp4, 2025-05-22 16-35-21.mp4, 2025-05-22 16-35-21.mp4
Ingredients Mask Markers : None, None, None, None
Pantry Create Date : 1904:01:01 00:00:00Z
Pantry Modify Date : 2025:05:23 13:57:09-04:00
Pantry Metadata Date : 2025:05:23 13:57:09-04:00
Pantry Orientation : Horizontal (normal)
Pantry Instance ID : 47f19133-8591-6d7f-b8ce-155500000086
Pantry Document ID : 1e222147-e736-4acc-115b-f98500000059
Pantry Original Document ID : xmp.did:e03635c9-4363-454a-8597-94934a949adb
Pantry Duration Value : 15556150
Pantry Duration Scale : 0.001
Pantry History Action : saved
Pantry History Instance ID : 47f19133-8591-6d7f-b8ce-155500000086
Pantry History When : 2025:05:23 13:57:09-04:00
Pantry History Software Agent : Adobe Adobe Media Encoder 2024.0 (Windows)
Pantry History Changed : /
Derived From Instance ID : xmp.iid:bb85b8e0-8748-7a46-8f92-46c1516611d4
Derived From Document ID : xmp.did:bb85b8e0-8748-7a46-8f92-46c1516611d4
Derived From Original Document ID: xmp.did:bb85b8e0-8748-7a46-8f92-46c1516611d4
Windows Atom Extension : .prproj
Windows Atom Invocation Flags : /L
Windows Atom Unc Project Path : C:\Users\MJCOLE~1\AppData\Local\Temp\mcc_4.prproj
Mac Atom Application Code : 1347449455
Mac Atom Invocation Apple Event : 1129468018
Warning : End of processing at large atom (LargeFileSupport not enabled)
Image Size : 1920x1080
Megapixels : 2.1
Rotation : 0Initially, I thought that the "File Modification Date/Time" fields were evidence that someone in the Mountain Timezone has messed with this "evidence" after it was made public on July 7th. It took me an embarrassing amount of time to realize it was evidence of me futzing around with the metadata two nights ago.
I've pared this list to some points we should focus on:
Track Create Date : 2025:05:23 23:53:22
Track Modify Date : 2025:05:23 23:53:22
Media Create Date : 2025:05:23 23:53:22
Media Modify Date : 2025:05:23 23:53:22
Tracks Markers Type : Comment
History Action : saved, created, saved, saved, saved
History When : 2025:05:23 20:16:48-04:00, 2025:05:23 16:48:57-04:00, 2025:05:23 20:16:48-04:00, 2025:05:23 20:16:48-04:00, 2025:05:23 20:16:48-04:00
Ingredients File Path : 2025-05-22 21-12-48.mp4, 2025-05-22 21-12-48.mp4, 2025-05-22 16-35-21.mp4, 2025-05-22 16-35-21.mp4
Pantry Modify Date : 2025:05:23 13:57:09-04:00
Pantry Metadata Date : 2025:05:23 13:57:09-04:00
Windows Atom Unc Project Path : C:\Users\MJCOLE~1\AppData\Local\Temp\mcc_4.prprojWindows Atom Unc Project Path : C:\Users\MJCOLE~1\AppData\Local\Temp\mcc_4.prprojFirst, this line tells us that a) the person who did the final exporting has the username MJCOLE~1, which could be Deputy Attorney General James M Cole, though I think this is unlikely and b) this file was composed with Adobe Premiere Pro, as evident by the .prproj ending. The Premiere Pro conclusion is consistent with the contents of other fields, which contain XMP data, which Adobe uses in most of their software suite.
Track Create Date : 2025:05:23 23:53:22
Track Modify Date : 2025:05:23 23:53:22
Media Create Date : 2025:05:23 23:53:22
Media Modify Date : 2025:05:23 23:53:22
...
Tracks Markers Type : Comment
History Action : saved, created, saved, saved, saved
History When : 2025:05:23 20:16:48-04:00, 2025:05:23 16:48:57-04:00, 2025:05:23 20:16:48-04:00, 2025:05:23 20:16:48-04:00, 2025:05:23 20:16:48-04:00The actual file was created late on a Friday night on May 23rd by someone in the Eastern Timezone. It was edited that same night. We can see that the “Media Create Date” field was after the modifications tracked in “History When”. Thus we can assume this refers to the time when the file was finally exported.
It’s a little suspicious that someone exported this file late on a Friday night, but I'm willing to chalk it up to our faithful public servants diligently working hard to provide transparency to the American public.
Also, the History Action field does not show any major modifications to the clips beyond saving and adding a clip. This field is limited to the following values:
converted, copied, created, cropped, edited, filtered, formatted, version_updated, printed, published, managed, produced, resized, save
To my understanding, this field does not show a history of stitching clips together or placing them on a timeline. This also doesn't rule out the clips being edited in an external software, then brought into Premiere Pro for composition.
Ingredients File Path : 2025-05-22 21-12-48.mp4, 2025-05-22 21-12-48.mp4, 2025-05-22 16-35-21.mp4, 2025-05-22 16-35-21.mp4
Pantry Modify Date : 2025:05:23 13:57:09-04:00
Pantry Metadata Date : 2025:05:23 13:57:09-04:00
This reveals that the clip is constructed from two files: 2025-05-22 21-12-48.mp4 and 2025-05-22 16-35-21.mp4, placed into Premiere on that May 23rd.
What does this prove?
Nothing, only that the footage that was meant to absolve the government would likely not be admissible in any court given the broken record of how the evidence was handled. This record is called the chain of custody and it contains what alterations have been made, how it was collected, transported, and analyzed, as well as who has access to it. While it is unreasonable to assume that the government will produce an accurate chain of custody for what amounts to a press release, they should have known that anything else will be seen as a cover-up.
In the digital forensics field, maintaining a solid chain of custody is of upmost importance. Why bother collecting evidence if its inadmissible in court?
Reporters have had to independently construct a timeline of what has been done to this file. Voters aren’t furious because the footage is evidence of a cover-up, but because the footage isn't evidence at all. Predictably, the closure of this investigation has made massive waves, with even Laura Loomer shittalking AG Pam Bondi. Balls and strikes, she’s been remarkably consistent. Thankfully, this conspiracy seems to stop exactly one step from the president.
Realistically, the missing minute and aspect ratio change in the video after midnight can be chalked-up to stitching two clips together for easy presentation to a higher-up. The DOJ (if their goal is to provide accurate information) should have released the two original clips separately, included a statement about the missing minute as well as a technical description about the camera setup that would necessitate a minute of lost footage.
How do I avoid getting found out?
You're a 22-year old intern at the Deep State Agency. You scored this job off of merit and hard work, and didn't allow your senator dad to write you a letter of recommendation. Your boss assigns you to be one of the infinite monkeys on infinite typewriters banging out propaganda to fool the sheeple. You're tasked with stitching two videos together to convince the public of some woke BS like vaccines save lives or that freedom of speech should include drag shows. How do you prevent journalists at literally every tech publication from reading your creation's metadata and finding you out?
You have a few options. You can blank slate the metadata by using this command:
exiftool -all= ./video1.mp4 This will remove all of the XMP metadata from Adobe, as well as any metadata that isn’t part of the mp4 format. However, that's very suspicious because you just set all the timestamps to exactly zero:
ExifTool Version Number : 13.32
File Name : video1.mp4
Directory : .
File Size : 21 GB
File Modification Date/Time : 2025:07:14 01:17:54-06:00
File Access Date/Time : 2025:07:14 01:18:13-06:00
File Inode Change Date/Time : 2025:07:14 01:17:54-06:00
File Permissions : -rw-rw-r--
File Type : MP4
File Type Extension : mp4
MIME Type : video/mp4
...
Create Date : 0000:00:00 00:00:00
Modify Date : 0000:00:00 00:00:00
...
Track Create Date : 0000:00:00 00:00:00
Track Modify Date : 0000:00:00 00:00:00
...
Media Create Date : 0000:00:00 00:00:00
Media Modify Date : 0000:00:00 00:00:00Let's alter individual timestamps to provide a more convenient narrative:
exiftool -CreateDate="2025:07:14 18:54:33" -ModifyDate="2025:07:14 18:54:33" -overwrite_original video1.mp4...
Create Date : 2025:07:14 18:54:33
Modify Date : 2025:07:14 18:54:33
...You can alter, create, or delete any metadata field using exiftool, and can lead those pesky tech-savvy journalists to any conclusion you want.
To alter every timestamp in this list, use this command:
exiftool -CreateDate="2025:07:14 17:42:33" \
-ModifyDate="2025:07:14 17:42:33" \
-TrackCreateDate="2025:07:14 17:42:33" \
-TrackModifyDate="2025:07:14 17:42:33" \
-MediaCreateDate="2025:07:14 17:42:33" \
-MediaModifyDate="2025:07:14 17:42:33" \
-overwrite_original video1.mp4Make sure to change the timestamp for individual fields to fit your propaganda needs. I suggest using some nonsensical timestamp like 50 years in the past or future to really mess with people, or a few days before your next planned national tragedy.
For more of this, subscribe.
Music I listened to this week
Feeling pretty punk rock this week. Wonder why.
Holiday in Cambodia - Dead Kennedys
Too Drunk to Fuck - Dead Kennedys
Werewolf Women of the SS - Rob Zombie
Come Out and Play - The Offspring