The problem with picture metadata is that it's not 100% trustworthy, because it's not stored in any kind of write-once memory. It's just stored in the same JPEG or other file along with the regular data. If the picture has a time stamp of a minute past noon, it may be correct. But just like a picture may have been altered using any graphics editor, the metadata also may have been altered. There are sometimes good reasons to reset a timestamp. For example, a picture I took on film in the 1990's and scanned today would show it was created in 2017, so I routinely reset the date on scanned images to be the date I actually took them. On the other hand, if the time stamp says a picture was taken at 9 AM on a given day and it's claimed to be taken at noon, either somebody at the news agency goofed (they may have looked at the disk filesystem metadata to see that the picture was copied from a memory card to a hard disk at 12:01) or they may be just lying and careless. Or, the third choice, popular among conspiracy theorists, is that the timestamp was deliberately tampered, as a sort of "false flag" argument. I'm not a big fan of this one. On a sunny day we could also tell by the shadow directions, but US presidential inaugurations are held in January, when it's usually overcast in DC.
Since it's not trustworthy, as well as for privacy, social media sites typically just delete all the metadata when you upload a picture.
There's nothing magical about camera metadata; it's not encrypted, and there are plenty of tools to display and alter it. I use one called "exiv2", which you can download for free from https://www.exiv2.org/. Exiv2 is open source, so any computer programmer can look at it and see that is doing exactly what it claims to.
Now let's look at some of the noon photos that show a largely-empty National Mall.
The AP photo coverage is here: https://twitter.com/AP_Politics/status/822548676795133954, claiming to be taken "shortly before noon". CNN repeats this position here:
https://www.cnn.com/2017/01/20/politics/donald-trump-barack-obama-inauguration-crowd-size/index.html
But note that their version is quite different from the AP picture. Both the 2009 and 2017 pictures have an empty band in the middle, of about the same size, which makes sense for a security corridor. The 2009 certainly is packed right to the back. But look at the back part of the mall in this 2017 version, and all but the last two fenced sections are full.
CNN and AP don't make their picture metadata available to the public. But when AP sells a picture to a news organization, it typically leaves it in so the editors can exercise due diligence, e.g., look at the metadata. I think they're supposed to strip it, but not all do. A news site called "inquisitr.com" didn't. Look at https://www.inquisitr.com/3903950/president-obama-had-about-one-million-more-people-than-president-trumps-inauguration-crowd-aerial-photos/ The first image has the Lincoln Monument and the buildings behind it bathed in the red sun of early morning, obviously not taken anytime around noon. The second, the one with the horse's posterior in the middle foreground, also shows the back four rows empty. https://cdn.inquisitr.com/wp-content/uploads/2017/01/inauguration-crowd-photos-trump-2.jpg shows one of the five fenced sections behind the middle break full, and the last 4 empty. Conveniently for us, this picture has its metadata intact. When was it taken? Let's examine the metadata from this picture, using exiv2:
$ exiv2 inauguration-crowd-photos-trump-2.jpg File name : inauguration-crowd-photos-trump-2.jpg File size : 74707 Bytes MIME type : image/jpeg Image size : 512 x 343 Camera make : Canon Camera model : Canon EOS-1D X Mark II Image timestamp : 2017:01:20 09:08:48 Image number : Exposure time : 1/250 s Aperture : F9 Exposure bias : 0 EV Flash : No, compulsory Flash bias : Focal length : 350.0 mm Subject distance: Infinity ISO speed : 2000 Exposure mode : Manual Metering mode : Multi-segment Macro mode : Image quality : Exif Resolution : 5472 x 3648 White balance : Auto Thumbnail : image/jpeg, 9237 Bytes Copyright : Exif comment :
The Exposure mode: Manual is one of the hallmarks of a pro photographer (others include the gear used, the quality of the pictures, and the organization they're working for). The size 512 x 343 tells us that the image has been shrunken from its original (which was 5472 x 3648), but the date stamp tells us what we need to know. This picture appears to have been taken at 9 AM. But was it? The AP photographer who's credited with this picture lives in the DC area, so we can't blame the 9 AM timestamp on, say, a west-coast photog taking it at noon with their camera still set on west coast time. I've reached out to this photog, but had not heard anything by press time. The other picture, number 4 on the Inquisitr site, has a slightly earlier timestamp. It seems likely that these pictures were taken around 9 in the morning.
I do not blame the photographers, and ask y'all to respect their privacy. A working pro will typically be on site hours before an event begins, for many reasons: to get a good spot, to be sure of not getting stuck in traffic, to be sure any equipment damaged (in transit, by protestors or by police action, or even by the photographer by accident) can be replaced, etc. And the pro will start shooting as soon as they get there. And they will, periodically, dump their memory cards onto a hard disk connected to a computer, which will upload them to the company's servers. That computer's file system metadata will record the time the file was copied, not the time the picture was taken. And there are always tight deadlines at a news service, particularly for an event that is only scheduled once every four years. So it would be easy for somebody in the AP office, or the various papers that buy the photo, to be in a hurry and look at the filesystem metadata. But it would also be easy for somebody with bad intentions to pick the "wrong" picture.
We may never know what actually happened.
But we don't have to. Because CNN has recorded a picture for us that shows the crowd filling 4 of the back 5 fence sections! They called it a "gigapixel" since it's made of many, many megapixel images (typical news photographers work with 20-25 megapixel cameras, meaning each picture has 20,000,000 individual color dots). And it was taken during the speech. You can see it here: https://edition.cnn.com/interactive/2017/01/politics/trump-inauguration-gigapixel/ It is interactive. Use your mouse to slide left or right until you can see the Lincoln Monument and the National Mall. Now if you're on a phone or on a device with a touchscreen, pinch to zoom in on the far end of the mall, otherwise use the + button at the bottom. Unless this picture has been altered, or taken down, it will look like the screenshot I made around noon on Monday, 2017-01-23. A lot of people in red baseball caps, so you can be sure it's not a paste-in from an Obama inauguration!
So the questions are: why did CNN show two such different pictures of the same event and claim them to be at the same time? Any how did both AP and CNN make the same "mistake" at the same time?
And what can we conclude? Of course there are other data available: transit ridership was down, bus parking was down, and so on. Perhaps all we can say for sure is that Trump's inauguration attendance figures were smaller than Obama's, and larger than reported by the mainstream media.
Full Disclosure: I am a computer nerd and a photographer. I not a fan either of Trump or of Clinton, only of the truth.