Forensic Articles
What a media file gives away, and how far each forensic test can actually be trusted.
What GPS EXIF tags reveal about location
The GPS block in a photo's EXIF can hold coordinates, altitude, heading, speed and UTC time. What each field records, and why a precise-looking map pin is still a claim.
Read guide ↗What is a MakerNote?
The proprietary block camera makers hide inside EXIF holds serial numbers, shutter counts and lens data, and is one of the hardest metadata fields to fake well.
Read guide ↗What is ENF analysis? Dating a recording by the mains hum
The electrical mains hum a microphone picks up can pin when a recording was made, sometimes to the second. How ENF matching works, what it needs, and why it names a grid, not a city.
Read guide ↗Double-JPEG / compression-analysis tamper signals
How re-compression leaves statistical traces of an edit, what aligned and nonaligned double-JPEG reveal, and why every extra re-save weakens the signal.
Read guide ↗What is double-encoding detection in audio?
Double-encoding detection finds a file that was compressed, edited and compressed again. Why the read is asymmetric, only one layer deep, and erased by a final re-encode.
Read guide ↗Clone / copy-move forgery detection, explained
How copy-move detection finds a region duplicated inside the same photo, why cloning slips past the other tamper checks, and the edits that defeat it.
Read guide ↗What is copy-move detection in audio?
Copy-move forgery duplicates a segment inside the same recording. Why audio cloning is provable by signal subtraction, the detectors that find it, and how it differs from image copy-move.
Read guide ↗What does an audio file's metadata reveal?
Audio metadata can name the encoder and preset, the recording app, the container muxer and the timestamps behind a recording, and its structure can expose editing. What each field tells an examiner, and why none of it is proof on its own.
Read guide ↗What can forensics learn from an audio recording?
What a recording reveals about when and where it was made, on what device, and whether it was edited, trace by trace, and how far each read holds.
Read guide ↗What can forensics learn from a photo?
What a single still image reveals about its camera, its edits and its history, trace by trace, and how far each read holds before it collapses.
Read guide ↗C2PA Content Credentials in a photo, as one forensic signal
What a C2PA Content Credential proves about a photo's origin and edits, why its absence proves nothing, and why forensics reads it as corroboration, not proof.
Read guide ↗How microphone fingerprinting works
A microphone fingerprint is the frequency-response coloration and electronic self-noise a device leaves in every recording. Where the fingerprint comes from, how a match is read, and why it names a model, not a unit.
Read guide ↗How accurate is microphone fingerprinting?
Microphone fingerprinting is highly accurate on enrolled devices and fails on open sets. The real numbers, where the match collapses, and when a result is worth trusting.
Read guide ↗Does uploading audio strip its metadata?
Uploading audio often strips or rewrites its metadata, because platforms rewrap or re-encode the file. What is lost, why a downloaded clip's tags can point at the wrong device, and what the signal still reveals.
Read guide ↗Can audio metadata be faked?
Audio files carry encoder tags, timestamps and app signatures, but every field can be rewritten or stripped in seconds. How to spot forged audio metadata, and what survives it.
Read guide ↗Audio tampering detection: what gives an edit away
Edits leave seams. How splice detection, copy-move subtraction and ENF phase breaks flag a tampered recording, and why each is a supporting signal, never proof.
Read guide ↗Audio spectrogram analysis for investigators
The spectrogram is the examiner's main lens, a picture of frequency over time that shows the mains hum, splice seams, codec cutoffs and background events. What each pattern means and how far to trust it.
Read guide ↗What is Error Level Analysis (ELA)?
Error Level Analysis resaves a JPEG at a known quality and highlights regions whose compression error does not match the rest. How the technique works step by step, and why it is a lead rather than a verdict.
Read guide ↗What does EXIF data actually reveal about your photo?
EXIF metadata can reveal the camera, lens, date, editing software and GPS location of a photo. What each field tells an investigator, and why none of it is proof on its own.
Read guide ↗PRNU camera sensor-noise fingerprinting, explained
PRNU is the noise fingerprint every camera sensor leaves in its photos. Where the fingerprint comes from, how a match is declared, and why it identifies the device, not the model.
Read guide ↗How accurate is camera fingerprinting (PRNU)?
Camera fingerprinting is highly accurate on original files and much weaker on shared ones. The real-world numbers, where the match collapses, and when a PRNU result is worth trusting.
Read guide ↗Does a screenshot or upload remove a photo's metadata?
Uploading a photo usually strips its EXIF, and a screenshot goes further, replacing the original metadata with your own device and the current time. What survives, and what it means.
Read guide ↗What can forensics learn from a file?
A field guide to what a photo, video or audio file can reveal, when it was made, where, by what device, whether it was edited, and how far to trust each answer.
Read guide ↗Is Error Level Analysis reliable?
What Error Level Analysis can and cannot show in a photo, why its own creator calls the results inconclusive, and when a bright ELA map means nothing.
Read guide ↗How reliable is photo forensics?
What digital photo forensics can and cannot prove, why every method is a probability not a verdict, and when a forensic result is actually worth trusting.
Read guide ↗Can EXIF data be faked?
EXIF tags reveal a photo's camera, time and GPS, but every field can be rewritten in seconds. How to spot forged metadata, and when to trust it.
Read guide ↗Nothing matches this media type yet.