• Direct file copy — binary intact
  • Archives — bypassing the pipeline
  • Email
  • Messaging apps
  • MMS — carrier compression
  • Proximity and wireless transfer
  • What it all means
  • Checking a received photo
  • Platform-specific results — coming in the follow-up
Skip to content
Kenneth B. Springer
Menu
  • About
  • Our Story
  • Websites
  • FAQ
    • Your FAQ
    • Privacy Policy
    • Terms of Service
  • News
  • Connecting

Month: June 2026

Image showing what metadata survives when you send via different means
Blog / Digital Forensics · 24 June 2026

Can you get metadata from a photo someone sent you?

Whether you can read metadata from a received photo depends on the channel, not the tool. Email and AirDrop pass the file unchanged. Messaging apps re-encode — EXIF is gone, but a compression signature takes its place.

Photo shows LHS and RHS where LHS has person standing in photo and RHS has person missing
Blog / Digital Forensics · 17 June 2026

The EXIF thumbnail that gave the edit away

JPEG, WebP, PNG, HEIC, AVIF, and camera RAW files embed a firmware-generated thumbnail before any editing software has touched them. When software re-saves the image without updating the thumbnail, the mismatch is forensic evidence — one of 60+ forensic checks snapWONDERS runs automatically on every photo and video.

camera with streams coming out of the lens trying to illustrate that camera contains makernote
Blog / Digital Forensics · 10 June 2026

MakerNote forensics: what camera manufacturers hide inside every photo

MakerNote is the manufacturer-written EXIF block that standard stripping tools typically leave intact — carrying lens serial numbers, shutter counts, burst UUIDs, and capture context that survives a standard privacy scrub. Its absence from a known device is equally revealing.

A photograph split vertically — left half shows a pristine original outdoor scene labelled "Original"; right half shows the same scene with a thin cyan "Inconsistency detected" overlay on a region of compression irregularity
Blog / Digital Forensics · 3 June 2026

How to tell if a photo has been edited

How to tell if a photo has been edited: forensic analysis reads compression signatures, manufacturer metadata baselines, and thumbnail mismatches across JPEG, WebP, PNG, and video.

Recent Posts

  • Proof of work showing LHS verses RHS, where LHS tries to confirm real person and RHS confirms proof of workI Couldn’t Use Google’s reCAPTCHA — So I Built My Own Bot Challenge for Clearnet, Tor, and I2P26 August 2026
  • Image showing stego 3 mistakesI audited a real open-source steganography tool. Here’s every mistake it made19 August 2026
  • Diagram showing clear path through a busy, dense block of componentsWhy I Built Official SDKs for the snapWONDERS API11 August 2026
  • A picture of a thumbnail broken up into a tiled grid areaBenford’s Law: Detecting AI-Generated Images Without AI5 August 2026
  • Picture of the street with a subtle lock icon on the top RHS. Label underneath says looks the same but it isn't...How to Hide a File Inside a Photo29 July 2026

Recent Comments

    Archives

    • August 2026
    • July 2026
    • June 2026
    • May 2026
    • April 2026
    • December 2025
    • October 2025
    • August 2025
    • June 2025
    • May 2024
    • April 2024
    • February 2024
    • December 2023
    • November 2023
    • October 2023
    • September 2023
    • August 2023
    • June 2023
    • February 2023
    • December 2022
    • January 2022
    • November 2021
    • March 2021
    • August 2020
    • March 2020
    • February 2020
    • January 2020
    • June 2017
    • October 2016
    • March 2014

    Categories

    • Accessibility
    • Blog
    • Digital Forensics
    • Infrastructure
    • News
    • Our Story
    • Press Release
    Keep Updated
    Copyright © 2026 Kenneth B. Springer
    Kenneth B. Springer logo
    This website uses cookies to ensure you get the best experience on our website.