Principles first
- Read, don't judge. The engine parses file structures; it does not run statistical pixel models or "AI detectors".
- Facts ≠ interpretation. Recorded fields (a timestamp, a size) are facts about the file. Meaning (who, when, where, real or fake) is interpretation, labeled as such.
- Absence is a finding, not an accusation. Missing metadata most often means stripping by sharing — the report grades survival instead of assuming intent.
- Everything expires. Analysis is ephemeral by design; see Security.
Layer 1 · File identification
Every upload is identified by content, not name or extension: magic-number signature checks, MIME validation, and pixel-dimension decoding. Files that are not genuinely JPG, PNG or WebP (HEIC/HEIF/AVIF arrive as browser-converted JPGs) are rejected before analysis. This is also a security layer — disguised executables don't pass.
Layers 2–4 · Metadata extraction: EXIF, GPS, XMP/IPTC
The analyzer walks the real container (JPEG APP1 segments, PNG chunks, WebP RIFF boxes) and decodes the metadata records: EXIF via PHP's EXIF reader (camera, lens, exposure, orientation, timestamps), GPS coordinates converted to decimal degrees with an optional approximate place name, and XMP/IPTC — CreatorTool, titles, credits, document IDs and digital-source declarations — recovered by targeted byte scanning of the metadata payload.
Limits: EXIF parsing requires intact segment structure; stripped or corrupted metadata simply reads as absent. Values are displayed exactly as recorded — including forged ones. The tool does not attempt to distinguish genuine capture records from injected ones, except where internal contradictions surface (e.g., GPS time vs capture time).
Layers 5–6 · Software information & processing traces
A bounded byte scan (first and last megabytes of the metadata regions) recovers human-readable strings and matches them against a curated signature list: editors (Photoshop, GIMP, Lightroom…), exporters, camera firmware, messaging apps and AI generators (OpenAI/DALL·E, Midjourney, Stable Diffusion, Firefly, FLUX…). Matched markers are reported with their offsets.
Limits: string matching proves a string was present — nothing about when it was written or whether it is genuine. Scanning is bounded; markers deeper inside image bitstreams than the scan window won't be found (rare in practice, as metadata lives at the head).
Layer 7 · File structure
The container is mapped segment by segment: JPEG APPn inventory (Exif/JFIF/XMP/ICC identified with sizes), SOF encoding type (baseline vs progressive), DQT/DHT table counts, COM comments; PNG chunks (IHDR parameters, tEXt/iTXt keywords, eXIf, tIME, iCCP); WebP RIFF boxes (VP8X flags, alpha, animation, EXIF/XMP presence). Trailing-data detection measures bytes after the proper end marker (EOI/IEND/RIFF end) and fingerprints common embedded formats (ZIP, PDF, RAR).
Limits: structure evidence is strong for what it covers — the container as received. It cannot reveal the file's edit history between saves, and appended-data detection fingerprints the format of trailing bytes; it does not extract or judge their contents.
Layer 8 · Hashes
Two fingerprints: SHA-256 over the complete file (exact identity — changes if any byte changes) and a 64-bit perceptual dHash computed from a downscaled luma gradient (visual similarity, robust to resize/re-encode). The client browser also computes SHA-256 preflight, and the two computations can be compared.
Limits: SHA-256 identifies the exact file only — it cannot find similar images. dHash is a similarity heuristic with known failure modes (heavy crops, extreme palette shifts); treat close-but-unequal dHashes as "worth comparing", not "same image".
Layers 9–10 · Entropy & compression characteristics
Entropy is sampled across the file (up to 512 KB spread over 48 slices) and reported per-slice with an average and a band label. Headers, thumbnails and appended payloads often dip against the compressed-payload baseline. Compression analysis estimates JPEG quality from quantization tables (against IJG-standard scales), records progressive/baseline encoding, and summarizes PNG/WebP compression mode.
Limits: entropy is a statistical lens — unusual values flag regions worth attention, they do not identify content. Quality estimation is an approximation validated against standard tables; exotic encoders can skew it.
Layers 11–12 · Image characteristics & provenance
Image characteristics: dominant color palette (six swatches, monochrome flag), megapixels, aspect ratio. Provenance composes the signals above into a reading: a Journey classification (camera original / re-saved / platform-processed / appended payload / stripped-uncertain) with a narrative event timeline, plus AI provenance detection — generator markers, C2PA / Content Credentials presence, IPTC digital-source-type declarations.
Limits: the Journey classification is explicitly labeled as consistency ("consistent with a camera original"), never authentication. Generator markers can be stripped; C2PA presence is detected and displayed, not cryptographically validated; absence of all markers is the internet's default state.
Layer 13 · Filename forensics
Filenames carry journey evidence: IMG-20240517-WA0028 is a WhatsApp export; PXL_… a Pixel camera; Screenshot_… a screen capture; "-edited" a modified copy. Detected patterns are reported with the platform or tool they indicate, alongside the metadata findings.
Limits: filenames are the most trivially editable data on any file — treated as the weakest class of evidence, always displayed as a hint rather than a finding.
Layer 14 · Interpretation
The report assembles the layers into three separated registers: facts (decoded values), signals (matched markers, structural flags, statistical findings) and interpretation (the Journey reading, survival grading). The report ends with a standing disclaimer: metadata can be modified or removed; missing metadata does not imply manipulation; forensic indicators are not always conclusive; results should be interpreted in context.
Known limitations, summarized
- No pixel-level AI detection — by design, because it doesn't reliably exist.
- No C2PA signature-chain validation — detection and display only.
- No recovery of stripped metadata — once gone from a copy, it's gone.
- Bounded scans (head/tail regions) — a deliberate trade for speed and memory safety on shared hosting.
- HEIC/AVIF analysis describes the browser-converted JPG, not the original container.