• Direct file copy — binary intact
  • Archives — bypassing the pipeline
  • Email
  • Messaging apps
  • MMS — carrier compression
  • Proximity and wireless transfer
  • What it all means
  • Checking a received photo
  • Platform-specific results — coming in the follow-up
Skip to content
Kenneth B. Springer
Menu
  • About
  • Our Story
  • Websites
  • FAQ
    • Your FAQ
    • Privacy Policy
    • Terms of Service
  • News
  • Connecting

Month: June 2026

Image showing what metadata survives when you send via different means
Blog / Digital Forensics · 24 June 2026

Can you get metadata from a photo someone sent you?

Whether you can read metadata from a received photo depends on the channel, not the tool. Email and AirDrop pass the file unchanged. Messaging apps re-encode — EXIF is gone, but a compression signature takes its place.

Photo shows LHS and RHS where LHS has person standing in photo and RHS has person missing
Blog / Digital Forensics · 17 June 2026

The EXIF thumbnail that gave the edit away

JPEG, WebP, PNG, HEIC, AVIF, and camera RAW files embed a firmware-generated thumbnail before any editing software has touched them. When software re-saves the image without updating the thumbnail, the mismatch is forensic evidence — one of 60+ forensic checks snapWONDERS runs automatically on every photo and video.

camera with streams coming out of the lens trying to illustrate that camera contains makernote
Blog / Digital Forensics · 10 June 2026

MakerNote forensics: what camera manufacturers hide inside every photo

MakerNote is the manufacturer-written EXIF block that standard stripping tools typically leave intact — carrying lens serial numbers, shutter counts, burst UUIDs, and capture context that survives a standard privacy scrub. Its absence from a known device is equally revealing.

A photograph split vertically — left half shows a pristine original outdoor scene labelled "Original"; right half shows the same scene with a thin cyan "Inconsistency detected" overlay on a region of compression irregularity
Blog / Digital Forensics · 3 June 2026

How to tell if a photo has been edited

How to tell if a photo has been edited: forensic analysis reads compression signatures, manufacturer metadata baselines, and thumbnail mismatches across JPEG, WebP, PNG, and video.

Recent Posts

  • Photo to show sentimental photo shootSix Million Jobs, and Where This Really Started24 September 2026
  • A film strip showing one frame under analysisWhat “Inter-Frame Tampering?” and “Duplicate Frames Detected?” Actually Check23 September 2026
  • Illustration of a hand showing branching lines stemming out with a spark on one main branch lineI Kept Waiting for AI to Have an Original Idea. It Never Did.15 September 2026
  • Picture showing 3 points on the world map to represent gps triangleWhat the “GPS Timezone Triangle?” Row on a Forensic Report Actually Checks9 September 2026
  • A picture showing two grading meters - one for grade letter, other for confidence levelWhy a Forensic Image Grade Needs Two Numbers, Not One1 September 2026

Recent Comments

    Archives

    • September 2026
    • August 2026
    • July 2026
    • June 2026
    • May 2026
    • April 2026
    • December 2025
    • October 2025
    • August 2025
    • June 2025
    • May 2024
    • April 2024
    • February 2024
    • December 2023
    • November 2023
    • October 2023
    • September 2023
    • August 2023
    • June 2023
    • February 2023
    • December 2022
    • January 2022
    • November 2021
    • March 2021
    • August 2020
    • March 2020
    • February 2020
    • January 2020
    • June 2017
    • October 2016
    • March 2014

    Categories

    • Accessibility
    • Blog
    • Digital Forensics
    • Infrastructure
    • News
    • Our Story
    • Press Release
    Keep Updated
    Copyright © 2026 Kenneth B. Springer
    Kenneth B. Springer logo
    This website uses cookies to ensure you get the best experience on our website.