The Photo That’s Also a ZIP File
A JPEG ends at two bytes, FF D9. Anything after that is invisible to image viewers. How a photo becomes a ZIP file too, and what it means.
Tracking vs Fingerprinting: Two Ways Your Photos Can Point Back to You
A serial number is tracking. Your firmware, colour profile and time zone are a fingerprint. I tested what stripping metadata removes and what it leaves.
What the “GPS Timezone Triangle?” Row on a Forensic Report Actually Checks
Forensic reports flag GPS with a question, not a checkmark: “GPS timezone triangle?” Here’s what that question is actually asking, and what it means when the answer is no.
Why a Forensic Image Grade Needs Two Numbers, Not One
An F built on GPS coordinates and an F built on a texture statistic are not the same finding. One number cannot say both what was found and how much to trust it.
I audited a real open-source steganography tool. Here’s every mistake it made
I audited a real open-source steganography tool’s source. Three mistakes — and the worst one needs no password and no statistics, just knowing where to look.
Building steganography detection: what statistical analysis looks for
How statistical steganalysis actually detects hidden data in images — RS analysis, chi-square testing, and why “undetectable” is a claim no steganography tool should make.
A Complete Guide to JPEG Forensic Analysis
Every JPEG carries six forensic signals beyond what you see in a photo viewer. This guide covers all of them and explains what they reveal in combination.
How to Forensically Detect AI-Generated Images — No Detection Model Required
Three methods now exist for identifying AI-generated images. Two of them fail when the creator says nothing. This article covers all three — and goes deep on the forensic signals that work regardless of what any label says.
Can you get metadata from a photo someone sent you?
Whether you can read metadata from a received photo depends on the channel, not the tool. Email and AirDrop pass the file unchanged. Messaging apps re-encode — EXIF is gone, but a compression signature takes its place.
The EXIF thumbnail that gave the edit away
JPEG, WebP, PNG, HEIC, AVIF, and camera RAW files embed a firmware-generated thumbnail before any editing software has touched them. When software re-saves the image without updating the thumbnail, the mismatch is forensic evidence — one of 60+ forensic checks snapWONDERS runs automatically on every photo and video.
MakerNote forensics: what camera manufacturers hide inside every photo
MakerNote is the manufacturer-written EXIF block that standard stripping tools typically leave intact — carrying lens serial numbers, shutter counts, burst UUIDs, and capture context that survives a standard privacy scrub. Its absence from a known device is equally revealing.
How to tell if a photo has been edited
How to tell if a photo has been edited: forensic analysis reads compression signatures, manufacturer metadata baselines, and thumbnail mismatches across JPEG, WebP, PNG, and video.
Your camera’s fingerprint survives EXIF stripping — here’s how
Stripping EXIF metadata doesn’t make a photo anonymous. DQT quantisation tables and Huffman coding tables are baked into the JPEG compression — a permanent camera fingerprint that survives every standard metadata strip. Two of the 60+ forensic checks snapWONDERS reads from every image.