Photo Evidence Report: Metadata, Edit Traces and Hashes

About the Photo Evidence Report: Metadata, Edit Traces and Hashes

A photo can carry a great deal about itself: the camera and its serial number, when it was taken and in which time zone, where (GPS), which program last saved it, an edit history, a small thumbnail of the picture as it first was, and the tables its JPEG was compressed with. Read together, these show whether a photo is what it seems: a thumbnail of another picture, an editing program in its history, a modified time after the capture time or compression tables a camera does not use are all edit signs.

Choose the photos, a folder or a ZIP archive, and the page checks every photo on your device: JPEG, HEIC and HEIF, PNG, TIFF, DNG and camera RAW files (through their embedded previews), WebP. It hashes each file with SHA-256, reads its Exif, XMP and IPTC metadata, compares its picture with its thumbnail and finds exact and near copies across the set. You get one report with a page per photo, a spreadsheet, a CSV and a JSON manifest. Nothing is uploaded.

Metadata can be edited or removed by anyone, so a finding is a reason to look closer, never proof, and a photo without findings proves nothing either. Without a pass every photo is checked and every count shows, with the first photos’ findings and marked thumbnails; the full report, the spreadsheet and the manifest unlock with an Ultimate pass.

Common uses

• Insurance and fraud checks: are the photos of a claim from one camera, one day, one place, and untouched?
• Journalists checking pictures sent to them before they are used.
• Lawyers and HR teams fixing the state of photo evidence on receipt, with a hash per file.
• Sorting a large set: which photos carry edit signs, which are copies of each other.

What each photo is checked for

• Camera and software: make, model, serial number and lens; the Software field and XMP’s CreatorTool. An editing or metadata program named there is an edit sign.
• Dates: when it was taken, digitized and last modified, with their time-zone offsets where the file gives them (CIPA DC-008, Exif); the date in the file name, the GPS time and the file’s own modified time are compared with them. A modified time after the capture time is an edit sign.
• Edit history: XMP’s history of actions (saved, converted, derived) with the program and the time of each, Camera Raw and Lightroom settings, and a reference to the document it was derived from (XMP, ISO 16684-1).
• The thumbnail: the small picture a camera writes into the Exif block is decoded, turned the way the photo is shown (its Exif orientation), and compared with the picture through a 64-bit fingerprint; a different picture or another shape is an edit sign. A picture too even to fingerprint steadily, such as a clear sky or a dark frame, is not compared, and neither is a turned photo the page cannot line up with its thumbnail for certain (a turned HEIC photo or camera RAW file): its notes say so.
• The JPEG itself: its quantization tables, compared with the standard tables most libraries and editing programs write (ITU-T T.81 Annex K at the IJG quality scale); the order of its blocks; an Adobe resource block; data after the end of the picture.

The whole set

Across the photos the page counts the cameras (by model and serial number), the capture dates, the photos with a location and the places they show (about 1 km apart), and finds exact copies (the same SHA-256) and near copies: the same picture saved again, resized or lightly edited, found with the same 64-bit picture fingerprint (a picture too even to fingerprint steadily, such as a clear sky, is left out of this search). Two copies of one picture with different metadata are worth a close look.

What a finding means

An edit sign says the file itself records a change or an editing program. A note is worth knowing but is not a sign by itself: some cameras write standard compression tables, some mobile devices write no thumbnail or no time zone. And every field can be written by anyone with the right program: metadata supports what the photos show, it does not prove it. The picture’s pixels are not analysed for retouching.

What the device needs

Each photo is read whole and checked one after the other, so a set of thousands takes time but no more memory than its largest photo plus the small pictures of the report (about 30 to 50 KB each: 20,000 photos keep about 1 GB of them). For thousands of photos, or for camera RAW files, use a computer with at least 8 GB of memory, and keep the tab open while it works. HEIC photos are decoded by the browser where it can (Safari), otherwise by a decoder downloaded once (about 1.5 MB).

Limitations

• Metadata can be edited or removed: a finding is never proof, and its absence proves nothing.
• Photos passed through messaging apps or social networks have usually lost their metadata and been compressed again; check the original files where you can.
• The pictures themselves are not analysed for retouching, cloning or generated content.
• Camera RAW files are checked through their metadata and their largest embedded JPEG preview; files over 300 MB are named and not read.
• Where the browser cannot draw a picture (TIFF in most browsers, a RAW file without a usable preview), its hash and metadata are still read, without the thumbnail comparison and the near-copy search; its notes say so.
• Use these tools only on devices and data you own or may examine; no password cracking and no device unlocking. The page reads photos you hold; it recognises no face and identifies no person.

Privacy

On this device; its files download once

The photos are read by your browser on your device; nothing from them is sent anywhere. The only download is the HEIC decoder, when a browser cannot decode HEIC itself. Photos and their locations can be personal data: keep the report with the same care as the photos.

How to check that nothing is uploaded

Open-source components

This page can load these open-source components, each only when a task needs it:

• It uses libheif and libde265 under the LGPL v3, through libheif-js: licence and source code.

You may replace them with your own builds. Their licences and the credits of every library the site uses are on the open-source credits page.