Deep Media Forensics

Error Level Analysis (ELA) re-compresses an image at a known quality level and measures the per-pixel difference between the original and the re-compressed version. Authentic JPEG images have been through a single compression pass and show uniform error across the entire frame. Modified regions — where pixels were edited, painted over, or composited in — have a different compression history, so they compress to a different error level and appear as bright artefacts on the ELA map.

snapWONDERS generates an ELA heat-map and calculates a quantified "high fraction" metric to give a verdict on edit likelihood — moving beyond a visual inspection to a measurable score.

DQT (Define Quantisation Table) fingerprinting analyses the quantisation tables embedded in every JPEG file. Each encoder — camera firmware, Photoshop, GIMP, Lightroom, iOS, Android — uses a characteristic DQT pattern as unique as a fingerprint. Matching it against a database of known encoders identifies the last software or firmware that wrote the file.

snapWONDERS also cross-checks the main image DQT against the embedded thumbnail DQT. Cameras write both using the same firmware tables, so a mismatch between them is strong evidence that the main image was re-saved by editing software after capture — a near-zero false positive signal.

Far more than most people expect. Photos can embed: precise GPS coordinates, altitude, speed and bearing at capture time; camera make, model, serial number, and lens serial; the registered owner name; all capture timestamps including timezone offset; manufacturer MakerNote data; XMP edit history recording every software save operation; and on Windows, the logged-in username written silently into the XPAuthor field.

Videos add audio codec and sample rate, encoder software strings, and location data in MP4 udta atoms. Embedded thumbnails can also retain original content after the main image has been edited — revealing the pre-edit version to anyone who extracts them.

Steganography is the practice of hiding a secret payload inside an ordinary-looking carrier file. The most common technique is LSB (Least Significant Bit) steganography: encoding data by modifying the least significant bits of pixel colour values in a way invisible to the human eye. Statistical analysis — chi-square tests, RS analysis, sample-pair analysis — detects the bias this introduces.

snapWONDERS runs three independent statistical tests and combines them into a suspicion grade with per-channel breakdown. Beyond pixel-level hiding, it also detects data appended after the image end-of-file marker ("zip-in-JPG"), polyglot files valid as two formats simultaneously, and arbitrary data concealed inside video container free/skip boxes.

Often, when the evidence is there. snapWONDERS reads C2PA Content Credentials, which can carry a signed declaration that a file was made by AI, or signed proof that it was captured by a camera. It also reads AI declarations that generators write into the file's own metadata, and looks for the invisible watermarks some widely used image generators embed. These labels can be stripped, so a trained pixel analysis also looks at the image itself. It is most reliable on original files; shared or recompressed copies are harder. It catches most images from older AI tools but can miss many from the newest ones, and wrongly flags fewer than one in a hundred ordinary camera photos. Very plain scenes, like a bare wall or an empty sky, are more often misread. A low reading is never proof that a photo is real.

Each report gives an AI verdict. A, Verified Camera Capture, needs signed proof of a camera capture. D means AI evidence was found. C, No AI-Generation Evidence Found, means nothing pointed either way. It is not a finding that the file is real. The pixel analysis never sets an AI verdict on its own.

When faces are detected, each also gets a face authenticity reading, and videos get a separate motion check. Both are shown for information and do not set the verdict.

Standard image formats (8): JPEG, PNG, WebP, GIF, HEIC, AVIF, JXL, TIFF. APNG (animated PNG) is also handled — hidden-frame detection runs on all PNG files.

Camera RAW formats (13 families): Canon CR2/CR3, Nikon NEF/NRW, Sony ARW/SR2/SRF, Fujifilm RAF, Olympus ORF, Panasonic RW2, Pentax PEF, Samsung SRW, Hasselblad 3FR/FFF, Leica RWL, Epson ERF, Kodak DCR, Adobe DNG.

Video (350+ variants): MP4, MOV, MKV, WebM, and AVI containers, with H.264, H.265/HEVC, VP8, VP9, AV1, and MJPEG codecs. All analysis runs on clearnet, Tor (.onion), and I2P — no account or login required.

You control retention. When you submit media for analysis, you choose how long your private report link stays active before the file and report are permanently deleted — options range from minutes to days. No account is required. Your report is accessible only via the unique private link generated for your specific upload; it is not indexed or shared.

For users requiring network-level anonymity, snapWONDERS is available on Tor (.onion) and I2P in addition to the clearnet — your upload traffic never leaves the anonymity network.

A camera device fingerprint is a profile built from multiple forensic signals that together characterise the camera model that captured a photo: DQT quantisation tables, Huffman table structure, chroma subsampling ratio, MakerNote block layout, serial number format, and H.264 SPS encoding constraints. Each camera model produces a characteristic combination of these signals.

snapWONDERS accumulates these signals from real uploads and matches them against a growing device profile database to verify whether a photo's declared Make and Model fields are consistent with its actual encoding characteristics — or whether the device fields have been forged. Device profiles are browsable at snapWONDERS Devices.