Trusted Time vs Phone Time: How Photo Timestamps Get Faked
How photo timestamps get faked (phone clock, EXIF edits, re-stamping) and how server-synced time plus a monotonic clock helps, with honest limits.
On an ordinary phone, the time printed on a photo comes from the phone’s own clock, so anyone can open Settings, wind it back, and produce a photo “taken at 7:55” when it is really 9:30. Trusted time fixes this by syncing with a server and then using an internal monotonic clock to count elapsed time, even with no signal. Below we cover the common ways timestamps are faked, how trusted time works step by step, and what it cannot do.
Note: This article is general information, not legal advice. How much evidential weight a photo carries is decided by the relevant authority in each case.
Three common ways photo timestamps are faked
1. Changing the phone clock
The easiest trick. Turn off automatic time, set the clock back, open the camera or a timestamp app, take the shot, then switch automatic time back on. Every app that reads system time prints the wrong value, EXIF included. Changing the time zone has much the same effect.
2. Editing EXIF metadata
A JPEG file stores a DateTimeOriginal field in its EXIF data. Plenty of free desktop and mobile tools rewrite it in seconds. On top of that, chat apps and social networks often strip EXIF entirely, so the recipient has nothing to compare against.
3. Re-stamping an old photo
Take yesterday’s photo, open it in an editor and type a fresh date and time on it. A variation is photographing a screen that shows the old photo using a timestamp camera. Either way you get an image that looks freshly captured with a convincing stamp.
| Method | Effort | What a recipient might notice |
|---|---|---|
| Changing the phone clock | Trivial | Practically nothing from the image alone |
| Editing EXIF | Easy | Nothing without the original file |
| Re-stamping an old photo | Easy | Mismatched fonts, light that does not fit the weather |
| Photographing a screen | Moderate | Screen edges, moiré patterns, soft focus |
What they share: the photographer controls the clock. The fix is a time source they do not control.
How trusted time works
Step 1: sync with the server
When online, the app asks the server for the current time and measures the round trip. Samples on a very slow connection are discarded. From the rest the app estimates the server time at the moment the reply arrived, with an error far smaller than anything that matters for attendance or site reports. Syncing repeats periodically while the app is open and whenever connectivity returns.
Step 2: anchor it to a monotonic clock
Every phone has a monotonic clock: a counter of time since the device booted, which keeps running while the screen is off and does not change when the user edits the clock. On Android this is elapsed time since boot; iOS has an equivalent continuous counter.
The app stores an anchor: the server time and the monotonic reading at the same instant.
Step 3: compute the time at capture
When you press the shutter, trusted time equals the anchored server time plus however much the monotonic clock has counted since. For example:
- Sync completes at 08:00 with the monotonic counter at value A.
- The worker switches off data and winds the phone clock back two hours.
- At a real 09:00, the monotonic counter has advanced 60 minutes.
- The photo shows 08:00 + 60 minutes = 09:00, whatever the phone clock says.
Because no network is needed at the moment of capture, this keeps working in basements, mountain areas and new sites without coverage. See offline photo proof for the full offline workflow.
When time can no longer be verified
There is one known weak point: the monotonic clock resets when the phone restarts. If the phone is powered off or rebooted while offline, the old anchor is no longer valid. Rather than guess, the app does two things:
- It uses the device clock for the stamp and records the time source as “device time, not verified”.
- It flags the photo so the server and managers can see it, until the next successful sync.
Likewise, if the anchor gets too old because the phone has been offline for a very long time, photos are marked unverified. Being upfront about a limit beats printing a confident number with nothing behind it.
What the server checks on top
Trusted time on the device is the first layer. When the photo is uploaded, the server checks again:
| Check | Purpose |
|---|---|
| Clock drift | Compares phone time with corrected time and flags a significant gap |
| Late upload | Flags photos that reach the server more than 15 minutes after capture |
| Rooted or jailbroken device | Unlocked system protections make tampering easier |
| Invalid app build | The photo did not come from an official build |
For clock-in photos the system keeps both the trusted capture time and the time the server received it. Capture time drives lateness and hours worked; the gap between the two shows managers which photos were sent late. More in stop attendance fraud.
Honest limits
- It is not a certified timestamp. SnapID Mark’s trusted time is not issued by a timestamping authority under a standard such as RFC 3161, and it carries no digital signature.
- Phone signals can be tampered with. A modified app or a rooted phone can send false data. The server re-checks and flags, but cannot guarantee everything.
- Correct time does not prove correct content. Trusted time says when a photo was taken, not that the scene is genuine; someone could photograph a printed picture.
- Before the first sync, there is no anchor, so only device time is available.
How SnapID Mark applies trusted time
SnapID Mark stamps trusted time on every photo, along with the date, weather, GPS coordinates, address, a mini map and a SnapID code with a QR code. In photo details, the capture time line states its source: “Network time · device clock ignored” or “Device time · not verified”. Anyone scanning the QR code sees the capture time the system recorded, not just the text on the image. Photos taken offline stay on the device and upload automatically later. Read more under security and features.
If your team needs capture times that cannot be changed by adjusting the clock, download SnapID Mark and try taking a photo after changing your phone’s time.
FAQ
Does changing my phone clock change the time on SnapID Mark photos?
No, as long as the app has synced with the server since the phone last booted. The stamp is the server anchor plus the time counted by the monotonic clock.
Is the time still right after a full day offline?
Yes, provided the phone has not restarted. The monotonic clock keeps counting with no network and with the screen off.
Why does my photo say “device time, not verified”?
Usually because the phone restarted while offline, or had never synced. Once you are back online, the app syncs and later photos use trusted time again.
Does changing time zones on a business trip matter?
The recorded moment does not change; the time zone only affects how the time is displayed on the stamp.
Is trusted time legally equivalent to a digital signature?
No. It is technical evidence that makes checking easier, not a certified timestamp. See timestamped photos as evidence in Vietnam.