2026-09-09

Your camera writes its serial number into every photo — what a 2015 gear-theft case and a tool built since 2011 show

Most of what gets written about photo metadata privacy — including on this blog — is about where: the GPS coordinates a camera drops into a JPEG's EXIF block. That's the field that got John McAfee arrested and Adam Savage's home address published in one tweet. But EXIF carries a second, quieter kind of identifier that has nothing to do with location: information about the device itself, and sometimes about the person who owns it. One field is welded in by the camera's firmware and can't be turned off from any menu. The other is typed in once, by whoever owned the camera at the time, and then usually forgotten — including by whoever owns the camera next. A real theft case from 2015 and a tool that's been running since 2011 both show exactly how that plays out.

The field no menu can clear

Most DSLR and mirrorless camera bodies write their own serial number into the EXIF of every photo they take — commonly under the standard BodySerialNumber tag (EXIF 0xA431), and often a matching lens serial number alongside it. Unlike GPS, there's no setting to turn this off; the firmware writes it the same way regardless of what the photographer wants. It's also not a smartphone problem: cameraphones generally don't record a device serial number in their EXIF at all, which means this specific risk sits with dedicated cameras — the kind used by working photographers, hobbyists with a "real" camera, and, as it turns out, whoever is currently holding one that used to belong to somebody else.

A tool built entirely around reading that field

That serial number isn't a theoretical risk — there's a site that has spent over a decade indexing it. Stolen Camera Finder describes its own mechanism plainly: "stolen camera finder crawls the internet searching for photos, collecting the serial numbers of the cameras that took them," and when you drag in a photo of your own, it "reads the unique serial number from the exif data of your photo and uses it to match against serial numbers it has stored." Security researcher Bruce Schneier covered it on his blog back in May 6, 2011, describing it as "a clever Web app that locates your stolen camera by searching the EXIF data on public photo databases for your camera's serial number." The site is still running (its own footer is copyrighted through the current year), which means the underlying fact hasn't gone away either: any JPEG with an intact serial number is, in principle, searchable against every other JPEG on the public web carrying the same number — whether the person searching is a robbery victim or someone with a very different reason to link two sets of photos to one device.

The field that actually caught a burglar

The mechanism that put a specific person in specific trouble in real life wasn't the serial number — it was the other kind of camera-identity field, the one a person sets on purpose. DIYPhotography reported, in a July 9, 2015 piece by Allen Mowery, that Australian photographer Jon Grundy listed some lenses for sale online in July 2014; a buyer showed interest, got Grundy's address to arrange the pickup, then backed out — and days later Grundy's house was burgled, $15,000 of camera gear gone. The person who took it used it to shoot stunt photography that he sold online and used to build a media profile. What he apparently never checked was that "each of his photos was meta-tagged with the name of the photographer from whom he stole." In October 2014, another photographer working alongside him noticed the name "Jon Grundy" sitting in the image metadata, quietly asked around, and contacted Grundy directly. That tip led to an arrest for burglary and handling stolen goods, and the gear went back to its owner; the case ended in a guilty plea and 100 hours of community service.

The field that gave it away was the camera's own Artist/Copyright EXIF tags (0x013B and 0x8298) — on Canon bodies set through a Copyright Information menu item, on Nikon through Setup Menu → Copyright information, per the how-to DIYPhotography added to the same piece. Grundy had set it once, on his own camera, at some point before it was stolen. The person holding it afterward never went looking for that setting, so it kept writing Grundy's name into every frame — a mutable field nobody bothered to mutate.

Why this isn't only a theft story

Nothing about either mechanism requires a crime. The exact same two fields sit in the EXIF of a secondhand camera bought at a normal price from a normal seller, a camera borrowed from a friend or a studio's shared kit, or a camera sold on without anyone thinking to open its menu first. A body's serial number is permanent no matter who's holding it or why. An owner-name field is something one specific past owner typed in and the current one may not know exists — until a client, a stock photo agency, or just a curious stranger opens a photo's properties and finds someone else's name attached to it. The same pair of fields is also the quiet link between two sets of photos someone would rather keep unconnected — a stock-agency portfolio and a personal blog, a submission to an anonymous contest and a body of publicly credited work — with no GPS tag required to make the connection; the serial number alone is enough, if both sets of files still carry it.

What NearScrub actually removes here — and where it stops

For a JPEG, NearScrub's scrubJpeg() drops the entire APP1 "Exif" segment as one block before anything leaves your device — no partial, field-by-field editing. That segment is where the camera make/model, the BodySerialNumber tag, and any Artist or Copyright string a previous owner typed in all live, right alongside GPS. Scrubbing a photo removes all of it at once, in the browser tab, with nothing uploaded anywhere — the same architecture as every other near app.

Two limits are worth stating plainly rather than leaving implicit. First, NearScrub only ever touches a file that's already on your device — it has no way to reach the camera itself. If you're the one selling or handing over the physical body, the owner-name field the previous step describes lives in the camera's own firmware settings, not in any file, and clearing it means opening that camera's menu directly (the Copyright Information / Setup Menu → Copyright information paths above), not running a scrubber. Second, NearScrub reads JPEG, PNG, PDF, and Office files — it doesn't parse RAW formats like CR2, NEF, or ARW. Stolen Camera Finder's own FAQ notes the same boundary from the other direction: RAW files aren't supported for its drag-and-drop search either, for the same underlying reason RAW and JPEG structure metadata differently. A serial number sitting in a RAW file you export or share as-is won't be touched by scrubbing the JPEG you made from it separately — only the exported JPEG's own EXIF gets cleaned.

Two fields, two fixes

If a camera body itself is changing hands — sold, given away, returned after a loan — clearing its Copyright Information menu setting takes a minute and is the only way to stop it from writing someone else's name into every future frame; no file-level tool reaches a setting that lives in the device's firmware. If it's the photos that are moving — off a card, into an email, onto a stock site or a public post — running them through NearScrub before they leave clears the serial number, the owner-name fields, and GPS together, in the browser, before any of it has a chance to turn a photo into a record of which camera took it and who that camera used to belong to.