Deep Media Forensics

Error Level Analysis (ELA) re-compresses an image at a known quality level and measures the per-pixel difference between the original and the re-compressed version. Authentic JPEG images have been through a single compression pass and show uniform error across the entire frame. Modified regions — where pixels were edited, painted over, or composited in — have a different compression history, so they compress to a different error level and appear as bright artefacts on the ELA map.

snapWONDERS generates an ELA heat-map and calculates a quantified "high fraction" metric to give a verdict on edit likelihood — moving beyond a visual inspection to a measurable score.

DQT (Define Quantisation Table) fingerprinting analyses the quantisation tables embedded in every JPEG file. Each encoder — camera firmware, Photoshop, GIMP, Lightroom, iOS, Android — uses a characteristic DQT pattern as unique as a fingerprint. Matching it against a database of known encoders identifies the last software or firmware that wrote the file.

snapWONDERS also cross-checks the main image DQT against the embedded thumbnail DQT. Cameras write both using the same firmware tables, so a mismatch between them is strong evidence that the main image was re-saved by editing software after capture — a near-zero false positive signal.

Far more than most people expect. Photos can embed: precise GPS coordinates, altitude, speed and bearing at capture time; camera make, model, serial number, and lens serial; the registered owner name; all capture timestamps including timezone offset; manufacturer MakerNote data (often containing fields invisible to standard EXIF viewers); XMP edit history recording every software save operation with timestamps; and on Windows, the logged-in username written silently by Windows Explorer into the XPAuthor field.

Videos add audio codec and sample rate, encoder software strings, and location data in MP4 udta atoms. Embedded thumbnails can also retain original content after the main image has been edited — revealing the pre-edit version to anyone who extracts them.

Steganography is the practice of hiding a secret payload inside an ordinary-looking carrier file. The most common technique is LSB (Least Significant Bit) steganography: encoding data by modifying the least significant bits of pixel colour values in a way that is invisible to the human eye. Statistical analysis can detect the bias this introduces — via chi-square tests on bit-plane distributions, RS (Regular/Singular) group analysis, and sample-pair analysis.

snapWONDERS runs three independent statistical tests and combines them into a suspicion grade with per-channel breakdown. Beyond pixel-level hiding, the forensic pipeline also detects data appended after the image end-of-file marker ("zip-in-JPG"), polyglot files that are simultaneously valid as two different formats, and arbitrary data concealed inside video container free/skip boxes.

Several forensic signals correlate with AI-generated images. C2PA provenance manifests from tools such as DALL-E, Midjourney (via Adobe Firefly), and Stable Diffusion record the generating tool's identity and are detected and parsed. NSS Benford analysis of JPEG DCT coefficient distributions flags statistical patterns inconsistent with natural scene statistics. Noise field uniformity — measured via wavelet decomposition across 64 image regions — is characteristically high in AI images that lack real sensor noise.

The complete absence of any camera metadata (no MakerNote, no GPS, no device serial, no firmware version) alongside unusual encoder fingerprints is also a strong combined signal. No single check is conclusive — no free tool currently provides a definitive AI detection verdict — but the full 40+ check pipeline provides a comprehensive picture of what the evidence supports.

Standard image formats (8): JPEG, PNG, WebP, GIF, HEIC, AVIF, JXL, TIFF. APNG (animated PNG) is also handled — hidden-frame detection runs on all PNG files.

Camera RAW formats (13 families): Canon CR2/CR3, Nikon NEF/NRW, Sony ARW/SR2/SRF, Fujifilm RAF, Olympus ORF, Panasonic RW2, Pentax PEF, Samsung SRW, Hasselblad 3FR/FFF, Leica RWL, Epson ERF, Kodak DCR, Adobe DNG.

Video (350+ variants): MP4, MOV, MKV, WebM, and AVI containers, with H.264, H.265/HEVC, VP8, VP9, AV1, and MJPEG codecs. All analysis runs on clearnet, Tor (.onion), and I2P — no account or login required.

You control retention. When you submit media for analysis, you choose how long your private report link stays active before the file and report are permanently deleted — options range from minutes to days. No account is required. Your report is accessible only via the unique private link generated for your specific upload; it is not indexed or shared.

For users requiring network-level anonymity, snapWONDERS is available on Tor (.onion) and I2P in addition to the clearnet — your upload traffic never leaves the anonymity network.

A camera device fingerprint is a profile built from multiple forensic signals that together characterise the camera model that captured a photo: DQT quantisation tables, Huffman table structure, chroma subsampling ratio, MakerNote block layout, serial number format, and H.264 SPS encoding constraints. Each camera model produces a characteristic combination of these signals.

snapWONDERS accumulates these signals from real uploads and matches them against a growing device profile database to verify whether a photo's declared Make and Model fields are consistent with its actual encoding characteristics — or whether the device fields have been forged. Device profiles are browsable at snapWONDERS Devices.