Deep Media Forensics

Error Level Analysis (ELA) re-compresses an image at a known quality level and measures the per-pixel difference between the original and the re-compressed version. Authentic JPEG images have been through a single compression pass and show uniform error across the entire frame. Modified regions — where pixels were edited, painted over, or composited in — have a different compression history, so they compress to a different error level and appear as bright artefacts on the ELA map.

snapWONDERS generates an ELA heat-map and calculates a quantified "high fraction" metric to give a verdict on edit likelihood — moving beyond a visual inspection to a measurable score.

DQT (Define Quantisation Table) fingerprinting analyses the quantisation tables embedded in every JPEG file. Each encoder — camera firmware, Photoshop, GIMP, Lightroom, iOS, Android — uses a characteristic DQT pattern as unique as a fingerprint. Matching it against a database of known encoders identifies the last software or firmware that wrote the file.

snapWONDERS also cross-checks the main image DQT against the embedded thumbnail DQT. Cameras write both using the same firmware tables, so a mismatch between them is strong evidence that the main image was re-saved by editing software after capture — a near-zero false positive signal.

Far more than most people expect. Photos can embed: precise GPS coordinates, altitude, speed and bearing at capture time; camera make, model, serial number, and lens serial; the registered owner name; all capture timestamps including timezone offset; manufacturer MakerNote data; XMP edit history recording every software save operation; and on Windows, the logged-in username written silently into the XPAuthor field.

Videos add audio codec and sample rate, encoder software strings, and location data in MP4 udta atoms. Embedded thumbnails can also retain original content after the main image has been edited — revealing the pre-edit version to anyone who extracts them.

Steganography is the practice of hiding a secret payload inside an ordinary-looking carrier file. The most common technique is LSB (Least Significant Bit) steganography: encoding data by modifying the least significant bits of pixel colour values in a way invisible to the human eye. Statistical analysis — chi-square tests, RS analysis, sample-pair analysis — detects the bias this introduces.

snapWONDERS runs three independent statistical tests and combines them into a suspicion grade with per-channel breakdown. Beyond pixel-level hiding, it also detects data appended after the image end-of-file marker ("zip-in-JPG"), polyglot files valid as two formats simultaneously, and arbitrary data concealed inside video container free/skip boxes.

Several forensic signals correlate with AI-generated images. C2PA provenance manifests from tools such as DALL-E, Midjourney, and Stable Diffusion record the generating tool's identity and are detected and parsed. Statistical analysis flags distributions inconsistent with natural scene statistics. Noise field uniformity is characteristically smooth in AI images lacking real sensor noise. A deep spectral authenticity check distinguishes optically captured images from AI-synthesised output across GAN, diffusion, and flow-matching model families.

The complete absence of any camera metadata alongside unusual encoder fingerprints is also a strong combined signal. All of these combine into a 0-100 Authenticity Score displayed on every report.

When faces are detected, each is additionally examined by a dedicated face authenticity check — independent of the whole-image score. Video files receive a separate physics-based AI video generation check.

Standard image formats (8): JPEG, PNG, WebP, GIF, HEIC, AVIF, JXL, TIFF. APNG (animated PNG) is also handled — hidden-frame detection runs on all PNG files.

Camera RAW formats (13 families): Canon CR2/CR3, Nikon NEF/NRW, Sony ARW/SR2/SRF, Fujifilm RAF, Olympus ORF, Panasonic RW2, Pentax PEF, Samsung SRW, Hasselblad 3FR/FFF, Leica RWL, Epson ERF, Kodak DCR, Adobe DNG.

Video (350+ variants): MP4, MOV, MKV, WebM, and AVI containers, with H.264, H.265/HEVC, VP8, VP9, AV1, and MJPEG codecs. All analysis runs on clearnet, Tor (.onion), and I2P — no account or login required.

You control retention. When you submit media for analysis, you choose how long your private report link stays active before the file and report are permanently deleted — options range from minutes to days. No account is required. Your report is accessible only via the unique private link generated for your specific upload; it is not indexed or shared.

For users requiring network-level anonymity, snapWONDERS is available on Tor (.onion) and I2P in addition to the clearnet — your upload traffic never leaves the anonymity network.

A camera device fingerprint is a profile built from multiple forensic signals that together characterise the camera model that captured a photo: DQT quantisation tables, Huffman table structure, chroma subsampling ratio, MakerNote block layout, serial number format, and H.264 SPS encoding constraints. Each camera model produces a characteristic combination of these signals.

snapWONDERS accumulates these signals from real uploads and matches them against a growing device profile database to verify whether a photo's declared Make and Model fields are consistent with its actual encoding characteristics — or whether the device fields have been forged. Device profiles are browsable at snapWONDERS Devices.