<p><a href="/blog/camera-serial-number-metadata-who-reads-it.html">Camera serial numbers</a> are the best-known sneaky identifier in photo metadata. The one hiding in plain sight in almost every photo from the last fifteen years is the unique image number. Canon calls it ImageNumber. Nikon calls it ShotNumber. Every digital camera assigns one, incrementing with each shutter press, and unlike GPS it cannot be turned off because it is baked into the file at the factory level. It is also how police actually find people.</p>
<p>The case that made this technique famous was the 2022 investigation of far-right chat networks in Germany, where researchers and reporters traced leaked photos back to specific phones and cameras using a combination of unique image numbers, EXIF timestamps and weather matching. It has since become a standard open-source intelligence technique, used by Bellingcat, by police, and by divorce lawyers. If you photograph anything you would rather not be linked to, this is the field that links you.</p>
<h2>How the image number works</h2>
<p>Every photo a camera takes gets an internal counter value, typically written as a folder-and-number pair like 100-0427 or a plain integer. The counter starts at zero on a new camera and increments by one per shot. Two facts make it identifying. First, it is unique per camera body, so two photos published years apart with sequential numbers came from the same physical device. Second, it never resets when you delete photos, copy files or swap cards, because it lives in the camera, not the storage.</p>
<p>Phone cameras are more varied. iPhones do not write a comparable EXIF counter, but they write an internal asset identifier and often a ContentIdentifier tag in bursts and screen recordings, which uniquely marks the capture event. Many Android phones write a running shot number in their maker notes. The detail varies by manufacturer, but the pattern holds: something in the file counts how many times the shutter has fired on that device.</p>
<h2>Why it is worse than GPS</h2>
<p><a href="/blog/does-your-photo-still-have-gps-data.html">GPS data</a> is scary because it is precise, but it is also easy to disable and increasingly stripped by platforms. The image number cannot be disabled at all. Its danger comes from correlation rather than location. Consider the pattern that has caught multiple people in real investigations:</p>
<ul>
<li>A photo is leaked anonymously. It carries no GPS, but it shows a kitchen, a document, a hotel room.</li>
<li>Investigators harvest the image number and the camera model from its EXIF.</li>
<li>They search photo sites and marketplaces for other images with numbers just before or just after. The same camera, days earlier, was used to photograph a car for sale, with the seller's phone number in the listing.</li>
<li>The number gap tells them the two photos came from the same roll, hours apart. The anonymous leaker now has a name.</li>
</ul>
<p>This works because people are careful about location and careless about everything else. A stripped GPS tag means the photo cannot be placed on a map. An intact image number means the photo can be placed next to every other photo the same camera ever produced, anywhere, forever.</p>
<h2>The truncation trap</h2>
<p>One more mechanism, because it catches even careful photographers. Some upload pipelines and chat apps truncate or reprocess files in ways that keep partial EXIF. A file that survives resizing can retain its image number while losing its GPS, which flips the perceived risk. The photographer checked for location data, found none, and published, trusting that the remaining metadata was inert. The counter was not inert. It was the thread.</p>
<p>We covered the same mechanism when looking at <a href="/blog/what-messaging-apps-do-with-photo-metadata.html">what messaging apps keep</a>: send a photo as a file rather than as an image and the full EXIF block travels with it, counters included.</p>
<h2>How investigators chain the fields</h2>
<p>In practice the image number is never used alone. It combines with three neighbours in the same block. The <strong>DateTimeOriginal</strong> timestamp places the photo in time. The camera and lens model narrow the device. And visible content, weather, shadows, reflections, links the timestamp to a place. A unique number says "same camera". A timestamp says "when". Content says "where". Together they are a signature that is genuinely hard to fake across a batch of files, because fabricating consistent counters, timestamps and sensor behaviour across dozens of photos is far harder than editing one.</p>
<h2>What you can actually do</h2>
<p>You cannot stop your camera writing the counter. You can stop it leaving your machine. Make it a rule that files get cleaned before they are published anywhere public, not just where you feel cautious, because the correlation risk is invisible at the moment of posting. Drag the file onto <a href="/">the reader on our homepage</a> and look at what is actually in there, serials, counters, timestamps, the lot, parsed locally in your browser with nothing uploaded. Then strip what does not need to travel.</p>
<p>For anything sensitive, the discipline is the same one investigators exploit, reversed: publish photos from a device that has never photographed anything connected to your name. A camera with a zero-public-footprint has no neighbours to correlate against. The counter still increments, but it counts toward nothing anyone can reach.</p>
<p>Metadata stripping raises the cost of identification. It does not make photos anonymous, and the image number is the clearest example of why: the identifier you never knew was there, that no setting disables, that turns one anonymous photo into a timeline of everything that camera has ever shot. Check before you share.</p>