Metadata Integrity Check

Validates the internal consistency of Exchangeable Image File Format (EXIF) metadata against the actual binary structure. Key checks include:

• Timestamp Coherence: Cross-referencing DateTimeOriginal, DateTimeDigitized, and DateTime fields for impossible sequences (e.g., a modification date preceding the capture date)
• Device Signature Matching: Verifying that the reported Make and Model tags align with the camera's characteristic metadata ordering and proprietary MakerNote structure
• GPS Coordinate Validation: Checking for impossible location data (e.g., 0.0, 0.0 coordinates) or timestamps that conflict with the image's capture time zone

A common red flag is a file claiming to be an original camera output but containing EXIF fields injected by Adobe Photoshop or GIMP in the software processing history.

Performs a byte-level analysis of the file container to detect structural anomalies that indicate re-encoding or tampering. Critical indicators include:

• EOF Truncation: Detecting appended data after the End-of-Image marker (FF D9 in JPEG), which may contain hidden payloads or evidence of steganography
• Thumbnail Mismatch: Extracting the embedded JPEG thumbnail and comparing it pixel-for-pixel with the full-resolution image; a mismatch often reveals that the thumbnail reflects the original, unaltered scene
• Quantization Table Fingerprinting: Extracting the DQT (Define Quantization Table) markers and comparing them against known camera model signatures in forensic databases like the Dresden Image Database

Adobe's own research confirms that 90% of re-saved images can be identified through quantization table analysis alone.

Analyzes the compression history embedded in the file's structure to reconstruct the encoding pipeline. Forensic techniques include:

• Double JPEG Compression Detection: Identifying the presence of two distinct quantization tables, which proves the image was decompressed, modified, and re-compressed
• H.264/HEVC GOP Structure Analysis: Examining the Group of Pictures (I, P, B-frame) pattern in video files; re-encoding typically disrupts the original cadence, introducing detectable anomalies
• Bitrate and Profile Inconsistency: A file claiming to be a direct camera original but exhibiting a variable bitrate encoding profile typical of FFmpeg or HandBrake re-encoding is a definitive forgery indicator

These techniques are foundational to tools used by the Defense Advanced Research Projects Agency's (DARPA) Media Forensics program.

Extends the integrity check beyond the file itself to the surrounding operating system artifacts. Advanced validation includes:

• NTFS $MFT Entry Analysis: Comparing the file's embedded timestamps against the Master File Table records, which contain nanosecond-precision creation and modification times that are extremely difficult to forge retroactively
• Extended Attribute (xattr) Inspection: On macOS and Linux systems, examining extended attributes like com.apple.quarantine or user.xdg.origin.url that record the file's download source and transfer history
• Thumbcache and .DS_Store Correlation: Cross-referencing the file against system thumbnail caches, which may preserve a visual snapshot of the file from a previous state before tampering occurred

This approach is a core component of the C2PA (Coalition for Content Provenance and Authenticity) standard's trust model, which relies on a chain of cryptographically signed assertions from capture to consumption.