The EXIF thumbnail that gave the edit away
JPEG, WebP, and PNG files can all carry an EXIF thumbnail generated at capture. Whether editing software updates it is inconsistent — and that inconsistency is the forensic signal.
MakerNote forensics: what camera manufacturers hide inside every photo
MakerNote is the manufacturer-written EXIF block that standard stripping tools typically leave intact — carrying lens serial numbers, shutter counts, burst UUIDs, and capture context that survives a standard privacy scrub. Its absence from a known device is equally revealing.
How to tell if a photo has been edited
How to tell if a photo has been edited: forensic analysis reads compression signatures, manufacturer metadata baselines, and thumbnail mismatches across JPEG, WebP, PNG, and video.
Your camera’s fingerprint survives EXIF stripping — here’s how
Stripping EXIF metadata doesn’t make a photo anonymous. Two compression signatures — quantisation tables and Huffman tables — survive every standard strip and reveal both the original encoder and whether the file was re-processed. Here’s what forensic analysis actually reads.