• Direct file copy — binary intact
  • Archives — bypassing the pipeline
  • Email
  • Messaging apps
  • MMS — carrier compression
  • Proximity and wireless transfer
  • What it all means
  • Checking a received photo
  • Platform-specific results — coming in the follow-up
Skip to content
Kenneth B. Springer
Menu
  • About
  • Our Story
  • Websites
  • FAQ
    • Your FAQ
    • Privacy Policy
    • Terms of Service
  • News
  • Connecting

Month: June 2026

Image showing what metadata survives when you send via different means
Blog / Digital Forensics · 24 June 2026

Can you get metadata from a photo someone sent you?

Whether you can read metadata from a received photo depends on the channel, not the tool. Email and AirDrop pass the file unchanged. Messaging apps re-encode — EXIF is gone, but a compression signature takes its place.

Photo shows LHS and RHS where LHS has person standing in photo and RHS has person missing
Blog / Digital Forensics · 17 June 2026

The EXIF thumbnail that gave the edit away

JPEG, WebP, PNG, HEIC, AVIF, and camera RAW files embed a firmware-generated thumbnail before any editing software has touched them. When software re-saves the image without updating the thumbnail, the mismatch is forensic evidence — one of 60+ forensic checks snapWONDERS runs automatically on every photo and video.

camera with streams coming out of the lens trying to illustrate that camera contains makernote
Blog / Digital Forensics · 10 June 2026

MakerNote forensics: what camera manufacturers hide inside every photo

MakerNote is the manufacturer-written EXIF block that standard stripping tools typically leave intact — carrying lens serial numbers, shutter counts, burst UUIDs, and capture context that survives a standard privacy scrub. Its absence from a known device is equally revealing.

A photograph split vertically — left half shows a pristine original outdoor scene labelled "Original"; right half shows the same scene with a thin cyan "Inconsistency detected" overlay on a region of compression irregularity
Blog / Digital Forensics · 3 June 2026

How to tell if a photo has been edited

How to tell if a photo has been edited: forensic analysis reads compression signatures, manufacturer metadata baselines, and thumbnail mismatches across JPEG, WebP, PNG, and video.

Recent Posts

  • AI agents running in a pyramid40+ AI Agents. One Dynamic Pyramid | AI Orchestration & Multi-Agent Systems14 November 2026
  • Image showing a seal stamped onto a digital photoHow AI-Generated Images Say “Made by AI”: Visible Marks, Watermarks and C2PA12 November 2026
  • Two slightly offset glowing grids over a blurred photograph, suggesting a picture saved twiceEvery Photo Remembers Being Saved: Double JPEG Compression Explained3 November 2026
  • A block structure with a column of green ticks beside it, falling short of the dashed outline of the shape that was intendedNo Human in the Loop. Only AI Acting on Your Intent.27 October 2026
  • snapwonders-lead-driven-synthesis-featureBeyond Vibe Coding: The Era of Lead-Driven Synthesis24 October 2026

Recent Comments

    Archives

    • November 2026
    • October 2026
    • September 2026
    • August 2026
    • July 2026
    • June 2026
    • May 2026
    • April 2026
    • December 2025
    • October 2025
    • August 2025
    • June 2025
    • May 2024
    • April 2024
    • February 2024
    • December 2023
    • November 2023
    • October 2023
    • September 2023
    • August 2023
    • June 2023
    • February 2023
    • December 2022
    • January 2022
    • November 2021
    • March 2021
    • August 2020
    • March 2020
    • February 2020
    • January 2020
    • June 2017
    • October 2016
    • March 2014

    Categories

    • Accessibility
    • Blog
    • Digital Forensics
    • Infrastructure
    • News
    • Our Story
    • Press Release
    Keep Updated
    Copyright © 2026 Kenneth B. Springer
    Kenneth B. Springer logo
    This website uses cookies to ensure you get the best experience on our website. Privacy policy