Camera serial numbers in JPEGs: how photos get traced

Open the EXIF block of a JPEG straight from a modern camera and there is a field most photographers never check: BodySerialNumber. Some manufacturers also write LensSerialNumber, InternalSerialNumber, OwnerName and a per-shutter-actuation count. Once a JPEG carries a body serial, every subsequent photo from that camera can be linked to the same physical device — and, with one matching purchase record, to a real name. Camera serial numbers in JPEGs are not a new exposure, but they are the quiet way investigators, researchers and adversaries chain anonymous photographs back to a single source.

Which cameras write serials, and where

It varies by manufacturer and by firmware:

• Canon: EXIF:SerialNumber on most DSLRs and mirrorless bodies since the EOS 1D series. Lens serial appears in MakerNote:LensSerialNumber on some bodies.
• Nikon: EXIF:SerialNumber on the prosumer line. The MakerNote also carries ShutterCount, the lifetime number of shutter actuations.
• Sony: EXIF:SerialNumber on Alpha bodies. The MakerNote often holds ImageCount.
• Fujifilm: serial in EXIF:BodySerialNumber.
• Smartphones: most do not write a hardware serial, but they write the precise model designation and, on Apple devices, a stable identifier for the camera assembly that ties images to a specific iPhone model variant.

The fields are always written in plain text. Anyone with a hex editor or exiftool can read them in seconds.

How serial numbers chain photos together

Two photographs from the same camera that share a serial number can be cross-referenced even if everything else has been changed. The same is true for the lens: a photographer might use one body but rotate through several lenses, or share a body inside a team. The pair of (BodySerial, LensSerial) is a stronger fingerprint than either alone.

When a serial leaks alongside a public attribution — a press credit, a stock-library upload, an image used in a court exhibit — that single match identifies the photographer for every subsequent anonymous photo from that camera, going forwards and backwards in time. Investigative outlets have used exactly this technique to attribute photographs sold to one buyer to a specific photographer who had previously credited a different image with the same serial.

Pattern noise: the second fingerprint

Even if the EXIF serial is stripped, every camera sensor has a unique pixel-by-pixel response pattern called Photo Response Non-Uniformity (PRNU). It is a fingerprint of the sensor's manufacturing imperfections. Forensic tools compare a target image's PRNU against a reference set built from known photos by a particular camera; a strong match attributes the image to the same physical sensor.

PRNU is not metadata in the strict sense — it is baked into the pixel data — and stripping EXIF does not remove it. Modest re-encoding (resave at lower JPEG quality, mild blur, downsampling) weakens it; deliberate noise injection or significant re-rendering breaks it. For most casual cases, that is overkill. For most casual cases, removing the EXIF serial is enough to break the explicit chain of attribution.

Where serial-number leaks have actually mattered

The pattern shows up wherever a person who needs to be anonymous publishes images:

• Whistleblower photographs published to a news outlet which then served the original full-resolution files instead of re-encoded copies. The body serial number matched a previously credited photograph published under the source's real name elsewhere.
• Anonymous social-media accounts run by people whose day job involves taking photographs — the day-job photos and the anonymous photos were the same camera.
• Stock-library uploads and personal portfolios sharing a serial with images sold to private clients through a different account.

None of these required exotic forensics. They needed a one-line exiftool query.

Thumbnails embedded by phones and editors

Modern cameras and editing software write a small embedded thumbnail into the JPEG's EXIF block. The thumbnail is regenerated when the image is edited, but in older firmware and several common editors the thumbnail update lags behind the visible image. The result is a file that visually shows the cropped or retouched picture and an embedded thumbnail that still shows the original frame. People have rediscovered this every few years for two decades. It applies to TIFF, HEIC and several RAW formats too, and stripping the thumbnail is part of any reasonable EXIF clean-up pass.

What to remove before publishing

For most photographers, the relevant cleanup is straightforward:

1. Strip BodySerialNumber, LensSerialNumber, InternalSerialNumber and OwnerName from every image before publication.
2. Remove the MakerNote block entirely. It carries shutter counts, GPS-related fields some bodies write into the proprietary section, and the original camera-internal asset ID.
3. Strip GPS, IPTC and XMP at the same time — if you are cleaning, clean everything.

You can do this manually with exiftool: exiftool -all= -tagsfromfile @ -orientation file.jpg keeps the orientation flag and removes the rest. The cleaner on the homepage handles the same operation in a browser, including for HEIC, RAW and TIFF files where the serial sometimes lives in proprietary sub-blocks.

Camera serial numbers are useful when they are inside the camera. They stop being useful the moment a photograph leaves the photographer's hands.