I’ve used the phrase “GPS triangulation” in my own bio for a long time, as shorthand for the location-forensics work snapWONDERS does. The actual report doesn’t call it that. The row reads “GPS timezone triangle?” — a question, not a boast.
Here’s the short version of what that question is checking: does the place a photo claims to have been taken actually agree with the two separate times also stamped into the same file — a satellite’s absolute clock, and the camera’s own local clock? When those three facts don’t line up, that’s a specific, file-level sign the GPS coordinates may have been copied in from a different photo, spoofed, or added after the fact. Not proof by itself — a concrete reason to look harder at everything else in the report.
A reader comment on an earlier article — pointing out, correctly, that GPS only appears in a photo if location services were switched on — is what finally made me sit down and write this out properly.
First, what this isn’t. Real GPS triangulation — trilateration, strictly — is what your phone already did before you ever pressed the shutter: it listens for signals from several satellites at once, often backed up by nearby cell towers and Wi-Fi networks, measures the tiny differences in when each signal arrives, and calculates a position from where those measurements overlap. That work is finished the moment a photo is taken. It’s not something a forensic report does — it’s something already baked into the coordinates sitting in the file by the time the report ever sees them, done by hardware built for exactly that job. What a report can do is something else: not find the location, but check whether the location it’s been handed actually makes sense.
A photo’s GPS block carries two clocks, not one. And a genuine photo needs all three of its facts — location, and both clocks — to agree.
The three points that have to agree
Every GPS-tagged photo stores a latitude and longitude, taken from the satellite fix at the moment of capture. Alongside it, the same fix carries a timestamp — in UTC, because satellites don’t know what timezone they’re flying over. Separately, completely independently, the camera writes its own capture time into a different field, in whatever local time its internal clock happens to be set to.
Three facts, from two different sources inside the same file: where, when in absolute terms, and when according to the device sitting in someone’s hand. If the photo is exactly what it claims to be, those three facts form a closed triangle. Take the coordinates, look up which timezone they actually sit in, convert the satellite’s UTC time into that timezone, and it should land on the same minute the camera’s own clock recorded.
The satellite’s clock is the one leg of this triangle you don’t have to worry about — it’s derived from atomic clocks accurate to a fraction of a microsecond, a precision no camera’s own clock gets near. When this check finds a gap, it is never the satellite side that moved.
What actually breaks the triangle
The triangle doesn’t care whether the coordinates look plausible. It cares whether the three facts were ever true of the same moment.
Paste a set of coordinates from one photo into another, and the location changes but the camera’s local-clock field doesn’t move with it — it’s still reporting whatever time the device’s clock said when that second photo was actually taken. Spoof a location through software rather than a real GPS fix, and the same kind of gap tends to open up, because the two fields come from different places in the file and editing one rarely means the other was even considered. The size of that gap is a fact you can measure directly from the file — not an inference from pixel statistics the way error-level analysis or a texture check is.
A quick case study — four situations, four answers
It’s easier to trust a description like this if you can see it play out, so here’s what the triangle actually says across four real situations.
A photo taken in Sydney in the middle of daylight saving — where the offset itself changes depending on the date, not just the place — closes clean. One taken in India, sitting on the UTC+5:30 offset rather than a clean hour boundary, closes clean too, which matters because a half-hour timezone is exactly the kind of edge case a lazier version of this check would get wrong. One taken in New York, camera clock set correctly for the trip, closes clean. And the case from above — coordinates copied in from another photo, camera clock left completely untouched — doesn’t close at all. It comes back with the largest mismatch the check produces.
Three genuine photos, three clean results, across two of the more awkward timezone situations there are. One forged case, and the geometry catches it immediately.
The honest failure mode — and why that’s not a flaw
Here’s the part worth being straight about. The triangle cannot tell “someone lied” apart from “someone forgot.” A traveller who lands in a new country and never gets around to updating their camera’s clock — a genuinely common thing to do — produces exactly the same kind of mismatch as a forged photo. The geometry only knows that the three facts didn’t close together. It has no way to see intent.
There’s a third source of the same false alarm, and it has nothing to do with travel at all. A camera with a dead clock battery, or one that was never configured in the first place, doesn’t leave that field blank — it writes whatever factory-default date it was built with. The triangle has no way to recognise a placeholder date as anything other than a real one, so it compares it against the satellite’s clock exactly as it would any other timestamp, and the gap comes back enormous. A camera that has simply never known what day it is looks, on paper, identical to a deliberately forged photo.
That’s not a bug to be embarrassed about. It’s a precise description of what the check can and can’t claim, and it’s exactly why this is one signal weighed against everything else a report finds, never read on its own as a verdict. A mismatch here is a reason to look harder at the rest of the file, not a conclusion by itself.
GPS is a witness, not a verdict
This is really the point the LinkedIn comment made without meaning to. GPS being present in a photo proves nothing on its own — it’s a plain-text field, trivially copied or edited by hand, as I wrote about from the privacy side a while back. The triangle doesn’t fix that. What it does is give the coordinates a second, independent thing to be tested against — a clock that has to agree with a place, from a source the person editing the location field usually never thinks to touch. GPS stops being a claim you either believe or don’t, and becomes a witness you can cross-examine.
If you want to see what a real file’s triangle looks like, run a geotagged photo through snapWONDERS’ analyse tool — including one where you know the camera’s clock was never updated after a trip, which is the cleanest way to watch the honest failure mode in action rather than take my word for it.
Kenneth Springer is the founder of snapWONDERS, a digital forensic analysis platform for images and video. The GPS/timezone consistency check described here is one of dozens of forensic signals snapWONDERS runs on every upload. snapWONDERS forensic analysis — no account required.