The EXIF Flash tag (0x9209) is a 16-bit integer in the Exif IFD where separate bit groups answer separate questions: did the flash fire, in what mode, is there a flash at all. ExifTool prints text like "Auto, Fired" for what is stored as 25 (0x19).
How the Flash value is built
| Bits | Field | Values |
|---|---|---|
| 0 | Fired | 0 no, 1 yes |
| 1 and 2 | Strobe return | 00 no detection, 10 not detected, 11 detected |
| 3 and 4 | Mode | 00 unknown, 01 forced on, 10 forced off, 11 auto |
| 5 | Function | 1 means no flash unit |
| 6 | Red-eye | 1 means red-eye reduction |
Strobe return is about whether the flash sensed its own light coming back. 00 means the camera has no way to tell.
Decoding real values
ExifTool 12.76 decodes them like this:
0 0x00 No Flash
1 0x01 Fired
16 0x10 Off, Did not fire
24 0x18 Auto, Did not fire
25 0x19 Auto, Fired
32 0x20 No flash function
89 0x59 Auto, Fired, Red-eye reductionTake 0x10, binary 1 0000: bit 0 clear, mode bits 10, so forced off and not fired. 0x18 is 1 1000, auto mode, not fired: the camera decided it didn't need flash. Add bit 0 and you get 0x19, auto and fired. 0x01 sets only the fired bit and says nothing about the mode. 0x20 means the device has no flash at all, though firmware doesn't always bother: a Canon EOS RP JPEG shot without flash has plain 0, and that body has no built-in flash. 0x59 is 0x19 plus bit 6, red-eye reduction.
Writing the tag without surprises
A bare -Flash= in ExifTool 12.76 does not create the EXIF tag on a file that lacks it; it writes the XMP flash structure instead:
$ exiftool -overwrite_original -Flash#=25 photo.jpg
1 image files updated
$ exiftool -a -G1 -s -EXIF:Flash -XMP-exif:FlashFired -XMP-exif:FlashMode photo.jpg
[XMP-exif] FlashFired : True
[XMP-exif] FlashMode : Autoexiftool -EXIF:Flash#=25 photo.jpg writes the EXIF tag as intended. The XMP version is a separate copy with named fields; EXIF vs IPTC vs XMP explains why the same data can live in both.
The EXIF editor avoids the question for JPEG and TIFF files: it offers the 27 ExifTool labels in a drop-down and writes EXIF:Flash. Flash usually shifts white balance too, which is recorded separately.