Normalizing IPTC and EXIF Timestamps Across Time Zones

A digitized image carries its capture moment in a scatter of tags that rarely agree and almost never state a time zone, yet a preservation record needs exactly one unambiguous instant. This walkthrough belongs to the Metadata Extraction Workflows stage of the wider ingest pipeline, and it solves a narrow but corrosive problem: turning the timezone-naive, split, and sometimes contradictory timestamps that ExifTool or python-xmp-toolkit pull out of a file into a single canonical UTC ISO 8601 value that is safe to store as a PREMIS eventDateTime and to sort a whole campaign by. The failure this page prevents is the quiet one: an ingest that guesses a zone, records 2019-06-01T09:14:22 with no offset, and leaves every downstream auditor unable to say whether two objects were captured minutes or hours apart.

# Root-Cause Analysis of Ambiguous Capture Timestamps

Capture timestamps are unreliable not because the tags are missing but because the standards that define them never required a time zone, and different tools populate different subsets. Six concrete causes recur across a digitization campaign:

1. EXIF DateTimeOriginal has no zone. The EXIF 2.2 field (0x9003) is a 19-character string, "YYYY:MM:DD HH:MM:SS", defined purely as local time with no offset component. Read in isolation it is timezone-naive: 2019:06:01 09:14:22 could be Los Angeles morning or Berlin morning, an eight-hour spread.
2. OffsetTimeOriginal is frequently absent. EXIF 2.31 added OffsetTimeOriginal (0x9011) to carry the "+HH:MM" or "-HH:MM" offset that resolves the ambiguity, but scanners, older cameras, and most flatbed capture software never write it. When present it is authoritative; when absent there is nothing in the file to disambiguate the local time.
3. IPTC splits the date from the time. The IPTC IIM core stores capture as two separate fields — DateCreated (2:55, CCYYMMDD) and TimeCreated (2:60, HHMMSS±HHMM). The time field can carry an offset, but the two fields are written independently, so a batch may hold a valid date with an empty or truncated time, or a time whose offset contradicts the EXIF view.
4. SubSecTimeOriginal lives in yet another tag. Sub-second precision is not part of DateTimeOriginal; it is a separate fractional-seconds string (0x9291). Dropped during normalization, two frames captured 400 ms apart collapse to the same second and sort non-deterministically.
5. Scanner clock skew and DST transitions. Bench scanners are rarely NTP-synchronized. A station clock drifting minutes, or left on standard time through a daylight-saving change, stamps a local time that no fixed offset reconstructs correctly — the same wall-clock string means different instants on either side of the transition.
6. Mixed local zones across one campaign. Objects digitized at partner sites, or on travelling scanners, arrive with local times from several zones in one accession. Sorting the naive strings interleaves the timeline incorrectly, and a global “assume UTC” rule silently shifts every non-UTC capture.

The consequence is that no single tag can be trusted blindly. Resolution is a precedence problem: prefer the most explicit, offset-bearing source; fall back to a per-station configured zone only when the file itself is silent; and refuse to guess when the sources actively disagree. The decision tree below encodes that policy.

Which source wins, whether an explicit offset applies, and where the pipeline refuses to guess: the resolver converts to UTC only when the zone is known, and flags rather than fabricates when offsets disagree.

# Step-by-Step Resolution

The resolver reads a single dictionary of already-extracted tags — the shape returned upstream by the extraction stage — and returns one timezone-aware UTC value plus the provenance needed to defend it. The precedence is deliberate: EXIF DateTimeOriginal is the photographer/scanner’s intended capture field, so it leads; IPTC supplies the fallback local time and, importantly, may itself carry an offset; XMP CreateDate (already normalized to RFC 3339 by most writers) is the last resort. Sub-second precision is folded in from SubSecTimeOriginal so ordering within a burst stays deterministic.

from __future__ import annotations

import logging
import re
from dataclasses import dataclass
from datetime import datetime, timedelta, timezone
from zoneinfo import ZoneInfo

logger = logging.getLogger("archival.metadata.timestamp")

EXIF_DT = "%Y:%m:%d %H:%M:%S"
_OFFSET_RE = re.compile(r"^([+-])(\d{2}):?(\d{2})$")


class AmbiguousTimestampError(ValueError):
    """Raised when sources disagree on the zone and no safe canonical value exists."""


@dataclass(frozen=True)
class ResolvedTimestamp:
    """A canonical capture instant plus the provenance that justifies it."""

    utc_iso: str            # e.g. "2019-06-01T16:14:22.400Z"
    source_tag: str         # which tag supplied the local wall-clock time
    applied_offset: str     # "+00:00" style; from tag or fallback zone
    offset_origin: str      # "tag" | "fallback_zone"
    original_value: str     # verbatim source string, retained for the record


def _parse_offset(raw: str) -> timedelta | None:
    """Parse an EXIF/IPTC offset string like '+02:00' or '-0800' to a timedelta."""
    match = _OFFSET_RE.match(raw.strip())
    if match is None:
        return None
    sign, hours, minutes = match.groups()
    delta = timedelta(hours=int(hours), minutes=int(minutes))
    return -delta if sign == "-" else delta

With the parsing primitives in place, the core resolver walks the precedence order, decides whether an explicit offset is available, and only then converts to UTC. The two guards that keep it honest are the offset-agreement check (disagreement raises rather than guesses) and the requirement that a naive time never becomes UTC without a configured fallback zone attached.

def resolve_utc_timestamp(
    tags: dict[str, str],
    *,
    station_id: str,
    fallback_zone: str,
    disagreement_tolerance: timedelta = timedelta(minutes=1),
) -> ResolvedTimestamp:
    """Resolve scattered EXIF/IPTC/XMP tags to one canonical UTC timestamp.

    ``fallback_zone`` is the IANA zone configured for the scanning station and is
    applied only when the file carries no explicit offset. Raises
    ``AmbiguousTimestampError`` when two explicit offsets disagree beyond tolerance.
    """
    local_dt, source_tag, subsec = _select_local_datetime(tags)

    tag_offset, offset_source = _collect_explicit_offset(tags, local_dt)
    if tag_offset is not None:
        _assert_offsets_agree(tags, local_dt, tag_offset, disagreement_tolerance)
        aware = local_dt.replace(tzinfo=timezone(tag_offset))
        offset_origin, applied = "tag", _fmt_offset(tag_offset)
        logger.info(
            "timestamp_offset_from_tag",
            extra={"station": station_id, "source_tag": source_tag,
                   "offset_source": offset_source, "applied_offset": applied},
        )
    else:
        zone = ZoneInfo(fallback_zone)
        aware = local_dt.replace(tzinfo=zone)
        offset_origin = "fallback_zone"
        applied = _fmt_offset(aware.utcoffset() or timedelta())
        logger.warning(
            "timestamp_offset_from_fallback",
            extra={"station": station_id, "source_tag": source_tag,
                   "fallback_zone": fallback_zone, "applied_offset": applied},
        )

    utc_dt = (aware + subsec).astimezone(timezone.utc)
    return ResolvedTimestamp(
        utc_iso=_iso_z(utc_dt),
        source_tag=source_tag,
        applied_offset=applied,
        offset_origin=offset_origin,
        original_value=tags.get(source_tag, ""),
    )

The helper functions carry the precedence table and the disagreement guard. Keeping them separate makes the policy auditable — an archivist can read the source order without reading the conversion arithmetic.

_PRECEDENCE = ("EXIF:DateTimeOriginal", "IPTC:DateCreated", "XMP:CreateDate")


def _select_local_datetime(tags: dict[str, str]) -> tuple[datetime, str, timedelta]:
    """Return the naive local datetime from the highest-precedence populated tag."""
    subsec = _parse_subsec(tags.get("EXIF:SubSecTimeOriginal", ""))
    for tag in _PRECEDENCE:
        raw = tags.get(tag, "").strip()
        if not raw:
            continue
        if tag == "EXIF:DateTimeOriginal":
            return datetime.strptime(raw, EXIF_DT), tag, subsec
        if tag == "IPTC:DateCreated":
            time_raw = tags.get("IPTC:TimeCreated", "000000").strip()[:6] or "000000"
            combined = f"{raw[:8]}{time_raw}"
            return datetime.strptime(combined, "%Y%m%d%H%M%S"), tag, subsec
        # XMP:CreateDate is RFC 3339; strip any zone to a naive local wall-clock.
        return datetime.fromisoformat(raw).replace(tzinfo=None), tag, subsec
    raise AmbiguousTimestampError("no capture-time tag present in metadata")


def _collect_explicit_offset(
    tags: dict[str, str], local_dt: datetime
) -> tuple[timedelta | None, str]:
    """Prefer EXIF OffsetTimeOriginal, then an offset embedded in IPTC TimeCreated."""
    exif_off = _parse_offset(tags.get("EXIF:OffsetTimeOriginal", ""))
    if exif_off is not None:
        return exif_off, "EXIF:OffsetTimeOriginal"
    iptc_time = tags.get("IPTC:TimeCreated", "")
    if len(iptc_time) > 6:
        iptc_off = _parse_offset(iptc_time[6:])
        if iptc_off is not None:
            return iptc_off, "IPTC:TimeCreated"
    return None, ""


def _assert_offsets_agree(
    tags: dict[str, str], local_dt: datetime,
    chosen: timedelta, tolerance: timedelta,
) -> None:
    """Raise if a second explicit offset contradicts the chosen one beyond tolerance."""
    other = _parse_offset(tags.get("EXIF:OffsetTimeOriginal", "")) \
        if len(tags.get("IPTC:TimeCreated", "")) > 6 else None
    iptc_off = _parse_offset(tags.get("IPTC:TimeCreated", "")[6:]) \
        if len(tags.get("IPTC:TimeCreated", "")) > 6 else None
    for candidate in (other, iptc_off):
        if candidate is not None and abs(candidate - chosen) > tolerance:
            raise AmbiguousTimestampError(
                f"conflicting offsets: {_fmt_offset(chosen)} vs {_fmt_offset(candidate)}"
            )


def _parse_subsec(raw: str) -> timedelta:
    digits = raw.strip()
    if not digits.isdigit():
        return timedelta()
    return timedelta(seconds=float(f"0.{digits}"))


def _fmt_offset(delta: timedelta) -> str:
    total = int(delta.total_seconds())
    sign = "+" if total >= 0 else "-"
    total = abs(total)
    return f"{sign}{total // 3600:02d}:{(total % 3600) // 60:02d}"


def _iso_z(dt: datetime) -> str:
    """RFC 3339 UTC with a Z suffix and millisecond precision when sub-second."""
    if dt.microsecond:
        return dt.strftime("%Y-%m-%dT%H:%M:%S.") + f"{dt.microsecond // 1000:03d}Z"
    return dt.strftime("%Y-%m-%dT%H:%M:%SZ")

The value that comes back is directly usable as a PREMIS eventDateTime. The capture event this records — and the way the resolved instant maps onto PREMIS semantics — is defined in PREMIS Metadata Mapping; the resolver’s job is only to guarantee the value it hands over is unambiguous and stably sortable.

# Validation and Verification

Do not trust a normalized timestamp because the function returned without raising. Confirm the resolution the same way you would confirm a fixity result — against the source and against the recorded provenance:

• Round-trip the offset. Re-derive the local wall-clock time by converting utc_iso back through applied_offset; it must equal the original_value to the second. A mismatch means the offset was applied in the wrong direction.
• Assert provenance is retained. Every ResolvedTimestamp must carry a non-empty original_value and an offset_origin of either tag or fallback_zone. An empty original string means the source column was dropped and the record can no longer be defended.
• Sort a known burst. Feed a sequence captured milliseconds apart and confirm the UTC values sort in capture order — proof that SubSecTimeOriginal survived normalization.
• Inspect the PREMIS event. The emitted eventDateTime must be valid RFC 3339 with a Z or explicit offset. A naive value (no zone) reaching the event record is a defect, not a warning — reject it at the schema boundary the same way batch validation rejects a malformed field.

Because the fallback path emits logger.warning while the tag path emits logger.info, a campaign’s log stream immediately shows how many objects relied on a configured zone versus an in-file offset — a cheap, continuous audit of how much guessing the accession required.

# Edge Cases and Gotchas

Three archival-specific traps deserve extra care. First, legacy IPTC encoded in Latin-1: a TimeCreated field round-tripped through a non-UTF-8 writer can carry stray bytes in the offset suffix, so parse defensively and treat an unmatched offset as “no offset” rather than crashing the batch. Second, the local-time DST ambiguity window: a wall-clock time inside a fall-back hour maps to two real instants; zoneinfo resolves it deterministically via its fold attribute, but you should log when a value lands in that window so an auditor knows the resolution was rule-based. Third, do not overwrite the original: the verbatim source string is provenance. The whole discipline of extracting embedded XMP from TIFF files is undone if normalization silently discards the pre-conversion value, because a future zone-policy correction then has nothing to re-derive from.

# Frequently Asked Questions

# Why not just assume every capture time is UTC?

Because EXIF DateTimeOriginal is defined as local time with no zone, assuming UTC silently shifts every non-UTC capture by its true offset — up to twelve hours. That corrupts the ordering of a multi-site campaign and produces a PREMIS eventDateTime that is confidently wrong. The safe rule is to convert to UTC only when the zone is known, either from an in-file offset or from the scanning station’s configured IANA zone, and to record which source supplied it.

# What should happen when EXIF and IPTC offsets disagree?

Nothing should be guessed. When two explicit offsets differ beyond a small tolerance, the resolver raises AmbiguousTimestampError and the object is held for review rather than promoted with a fabricated instant. A disagreement usually means the camera clock and the cataloguing software were set to different zones, and only a human with campaign context can say which is authoritative. Flagging preserves the integrity of the audit trail; guessing destroys it.

# Why keep the original timestamp string after converting to UTC?

The original value is provenance. If the station’s fallback zone was later found to be misconfigured, the only way to re-derive correct UTC values for the whole accession is from the untouched local strings. Storing original_value alongside the canonical UTC value, plus the offset_origin, means a zone-policy correction is a re-computation rather than a permanent loss. Overwriting the source in place forecloses that recovery.

# How do I handle sub-second precision for stable sorting?

Fold SubSecTimeOriginal into the datetime before converting, and serialize with millisecond precision. DateTimeOriginal resolves only to the second, so a burst captured within one second collapses to identical timestamps and sorts non-deterministically. Carrying the fractional-seconds tag through normalization — and asserting the millisecond suffix survives — keeps capture order deterministic across the whole batch.

# Related

• Metadata Extraction Workflows — the parent stage: the tag dictionary this resolver consumes and the field contract normalization must satisfy.
• Extracting Embedded XMP Metadata from TIFF Files — how the CreateDate and offset fields reach the resolver, and why the original string is retained.
• ExifTool vs python-xmp-toolkit for Metadata Extraction — which extractor surfaces OffsetTimeOriginal and IPTC TimeCreated reliably enough to trust.