Image, video and document authentication

01Scope

Exif, XMP and IPTC metadata in images: capture time, offset, GPS, device, software
JPEG structure: quantisation tables, thumbnail consistency, double compression indicators
Video containers (MP4/MOV): atoms, creation times, encoder strings, frame-rate and edit-list consistency
Office documents: core/app properties, revision IDs, tracked changes, embedded objects, template chains
PDF: Info dictionary vs XMP, incremental updates, producer and creator strings, signature validity
Provenance signals: C2PA manifests where present, platform re-encoding fingerprints

Was this photo taken when and where the metadata says?
Was this image or video edited after capture, and how?
Was this document created on the date it bears, or back-dated?
Is this PDF the version that was signed, or was it changed afterwards?
Did this file pass through a messaging platform or social network that stripped or rewrote metadata?

Source	What it yields	Note
The original file from its first storage location, with file-system metadata	Embedded metadata, structure, file-system times to compare against	A copy received by chat or email has been re-encoded; ask for the device or the original store.
The capture device or its photo database (Photos.sqlite, gphotos)	Independent record of capture, import, edit and location	The database may hold the original even when the exported file is edited.
Reference samples from the same device or software	Expected metadata fields, quantisation tables, encoder strings to compare	A known-good sample from the same model turns 'unusual' into 'inconsistent' or 'consistent'.
Document revision history (version history in cloud drives, tracked changes, backups)	Independent dates for creation and edits	Cloud version history is server-side evidence and cannot be edited by the user.

Hash and identify the file by content
Record the hash, confirm the format from its signature, and note any mismatch between extension, declared type and actual structure.
Read every metadata layer separately
Exif, XMP, IPTC, container atoms, PDF Info and XMP, OOXML core and app parts. Tabulate each field with its source and compare them for internal consistency.
Compare with external references
Device database records, file-system times, cloud version history, sun position and weather for the claimed time and place where relevant, and a reference sample from the same device or software.
Look for edit traces in the structure
Software tags, mismatched thumbnails, double-compression patterns, PDF incremental updates after a signature, revision ID gaps, template names that post-date the claimed date.
Conclude in terms of consistency
'Consistent with', 'inconsistent with' or 'cannot be determined', each tied to the specific observations. Authenticity is not proven by the absence of detected edits.

The library records behind this area:

Exif DateTimeOriginal has no time zone unless OffsetTimeOriginal is present; the device's zone at capture must be established separately.
GPS tags record the device's position estimate, which can be stale, spoofed or absent indoors.
Messaging platforms strip Exif and re-encode images; missing metadata is not evidence of tampering.
Office 'created' dates travel with templates; a new document can carry its template's creation date.
Error-level analysis and similar visual methods are suggestive at best and are not reliable alone.

File identity: name, size, hash, true format, source location and how it was obtained.
Metadata table per layer with raw values, decoded values and time-zone basis.
Observations supporting consistency and inconsistency, listed separately, with the reference used for each.
The conclusion phrased as consistency with the stated account, and what remains undetermined.

Was the original file examined, or a copy that passed through a platform?
Which time zone was assumed for the capture time, and on what basis?
Was a reference sample from the same device or software used?
Does the conclusion say 'consistent with' or does it claim proof of authenticity?