01The question
Is the submitted JPEG consistent with an original photograph taken by the stated device on the stated date, or does it show signs of editing or re-saving?
02Background
In a fictional insurance dispute, a claimant submits a phone photograph said to show damage on a given date. Only the image file was provided, not the phone. The examination assesses internal consistency; it cannot by itself prove when the photographed event occurred.
03Constraints
- The capturing device was not available for comparison.
- Metadata can be present, absent, edited or stripped; its presence is not proof and its absence is not disproof.
04Evidence received
| Item | Form | Hash | Note |
|---|---|---|---|
| The submitted JPEG file | F-02 | sha256: c40b…2f91 | Hashed on receipt; all work done on a copy. |
05Examination method
Read EXIF and the metadata blocks
The EXIF, and any XMP and IPTC blocks, were read for the capture date/time, device make and model, lens and exposure fields, and any software field. The DateTimeOriginal, DateTimeDigitized and file-modify times were compared. A Software value naming an editor was recorded.
Compare the embedded thumbnail with the full image
Many cameras store a small EXIF thumbnail written at capture. The thumbnail was extracted and compared with the full image; a thumbnail that still shows content the full image no longer shows is a sign of later editing. The thumbnail here matched the full image.
JPEG EXIF date, offset and GPS tagsExif and GPS readerHex viewer and data inspector
Examine the JPEG structure and quantisation
The marker segments were read in order. The quantisation tables and the encoder signature were compared with what the named device model is known to write; a save by common editing software leaves different tables and marker order. Signs of double compression were looked for.
JPEG EXIF date, offset and GPS tagsHex viewer and data inspectorFile signature identifier
State internal consistency, not the external event
The findings were framed as whether the file is internally consistent with an unedited original from the stated model, separately from whether the depicted scene is what it is claimed to be. The device clock, which sets EXIF time, can be wrong or set by hand.
06Findings
Probable
The file's structure, quantisation tables and embedded thumbnail are consistent with an unedited original written by the stated device model.
BasisNo Software editor field, matching thumbnail, no double-compression signs, tables consistent with the model; but the device was not available to confirm.
Possible
The EXIF capture date is consistent with the claimed date.
BasisEXIF time depends on the device clock, which can be wrong or set manually; it is consistent, not proof.
07Limits
- Internal consistency with an original is not proof that the scene is genuine or that the stated date is correct.
- Absence of an editing marker does not prove no editing; metadata can be rewritten to look original.
- Without the device, the examination cannot match sensor-level characteristics to the specific phone.
08Report excerpt
The JPEG carries no Software field, the EXIF thumbnail matches the full frame at the pixel level, and the quantisation tables and marker order match those the stated model writes. We find it consistent with an unedited original (probable). The capture time is only consistent (possible) with the claimed date, since it rests on the device clock.
09Lessons
- Separate two questions: is the file an unedited original, and is the depicted event what is claimed. Answer only the first.
- The EXIF thumbnail is a strong, often overlooked check for later editing.
- EXIF time rests on the device clock; present it as consistent, never as proof of date.