— Browsing Safely ( read more )

snapWONDERS is modernising — introducing Vaultify, our new platform for hiding files inside photos and videos. Try Vaultify → What’s changing →

JavaScript is DISABLED!!! snapWONDERS is now using the no JavaScript version for: https://snapWONDERS.com ( Read: No JavaScript / Browsing Safely )

Deep Media Forensics

Exhaustive forensic and privacy analysis to surface hidden metadata, detect digital tampering, and provide transparency into media creation.

No account needed

Upload and analyse instantly — no registration or login required.

You control retention

Choose how long your private report link stays active before it expires.

Three networks

Available on clearnet, Tor (.onion), and I2P — use whichever suits your threat model.

Formats supported

Images: JPEG · PNG · WebP · APNG · GIF · HEIC · AVIF · JXL · TIFF · DNG
Video: MP4 · MOV · MKV · WebM · AVI · MPEG · M4V · M2TS · 3GP · FLV · WMV and 350+ more variants

1. Image Forensic Analysis

Visual and statistical properties analysis to identify edits and inconsistencies.

Error Level Analysis (ELA)

Detects: Digital modifications, compositing, or selective editing.

Identifies areas of an image that are at different compression levels. Modified areas typically show a higher error level.

snapWONDERS helps: Generates an ELA map and calculates a "high fraction" metric for a clear verdict.

DQT Fingerprinting (JPEG)

Detects: Specific encoder or software used to save the image.

Analyses the Define Quantisation Table used by the JPEG encoder to identify if an image was last saved by Photoshop or camera firmware.

snapWONDERS helps: Matches the DQT against a growing database of encoder signatures to provide proof of origin.

Thumbnail Mismatch Detection

Detects: Deliberate metadata forgery.

Compares the embedded thumbnail to the main image to ensure they match. A mismatch indicates the main image was likely replaced.

snapWONDERS helps: Automatically extracts and compares thumbnails, flagging discrepancies.

Histogram Gap Analysis

Detects: Re-encoding and post-processing operations.

Statistical analysis of colour distribution. Brightness or contrast adjustments leave detectable "gaps" in the histogram.

snapWONDERS helps: Provides high-resolution histograms and flags gap density.

Double JPEG Compression Probe

Detects: Re-saving an edited image as a JPEG.

Analyses the re-compression error curve across multiple quality factors to find statistical "ghosts."

snapWONDERS helps: Uses an in-memory probe for a fast binary signal for double compression.

JPEG Ghost (Original Quality)

Detects: Up-sampling or re-saving at higher quality.

Sweeps every potential quality factor to find the exact original quality at which an image was first compressed.

snapWONDERS helps: Identifies the specific prior quality, providing proof of a re-save cycle.

Clone / Copy-Move Detection

Detects: "Healing" or cloning used to hide or duplicate objects.

Searches for regions of an image that are identical or near-identical to other regions in the same image.

snapWONDERS helps: Uses block-based DCT matching to find clones even if blurred.

Resampling & Interpolation

Detects: Scaling (resizing), rotation, or transformations.

Analysis of periodic correlations between neighbouring pixels which leave a detectable mathematical grid.

snapWONDERS helps: Detects up-scaled or rotated images masquerading as high-resolution originals.

2. Video Forensic Analysis

Temporal domain analysis checking for consistency across frames and containers. Accepts MP4, MOV, MKV, WebM, AVI, MPEG, M4V, M2TS, 3GP, FLV, WMV and 350+ additional variants.

Video Encoder Fingerprinting

Detects: Discrepancies between claimed device and actual encoding.

Analyses bitstream structure and metadata tags like `©too` to identify the true underlying encoder.

snapWONDERS helps: Identifies if a video matches known editing software rather than camera firmware.

GOP (Group of Pictures) Analysis

Detects: Trimming, joining, or re-encoding.

Analyses how I, P, and B-frames are organised. Edited videos often have irregular intervals or "broken" GOPs.

snapWONDERS helps: Visualises the GOP structure and flags irregularities in keyframe spacing.

Inter-frame Tampering (Spike Analysis)

Detects: Cuts, splices, or frame insertions.

Measures the statistical difference between adjacent frames. Tampered videos show abrupt "spikes" at edit points.

snapWONDERS helps: Samples frames across the video and flags exact timestamps of discontinuities.

Edit List (elst) Analysis

Detects: Trimming and non-destructive editing.

Parses the internal "Edit List" atom in MP4/MOV containers which instructs players to skip media data.

snapWONDERS helps: Surfaces these hidden instructions, showing original trimmed content.

Frame Duplication & Freeze Detection

Detects: "Frame freezing" or conversion artefacts.

Searches for duplicate frames in a sequence where content should be fluid.

snapWONDERS helps: Uses perceptual hashing (pHash) to detect duplicates despite noise.

Security & DRM Detection

Detects: Commercially protected or encrypted content.

Identifies internal encryption markers like `pssh` boxes in MP4 or ContentEncoding in MKV.

snapWONDERS helps: Identifies specific DRM systems (Widevine, PlayReady) in the security report.

We have tested with photos from 3369 different Camera Models / Mobiles and still counting…

camera / mobile photos from popular manufacturers and brands — see full list

3. Metadata & Privacy Analysis

Deep inspection of "data about data" to prevent inadvertent sensitive information leaks.

Privacy Category Taxonomy

Detects: Identity leaks, location tracking, technical fingerprints.

A classification engine that groups thousands of metadata tags into 13 high-level categories ranked by severity.

snapWONDERS helps: Transforms raw tags into a prioritised "Privacy Audit" with risk explanations.

Metadata Consistency Cross-Check

Detects: "Lying" metadata.

Compares different metadata fields (e.g., GPS timezone vs file timestamp) to catch contradictions.

snapWONDERS helps: Acts as a validator to catch tampering that standard viewers miss.

Advanced Forensic Markers

Detects: Adobe transforms, PNG digital signatures, XMP history.

Deep inspection of high-signal metadata blocks that provide a "paper trail" of the file's digital life.

snapWONDERS helps: Surfaces technical blocks usually ignored by standard viewers.

Windows XP Identity Leaks

Detects: Login username of the last person to edit the file.

Specifically targets the `XPAuthor` and related tags that Windows Explorer silently writes into files.

snapWONDERS helps: Explicitly flags these "XP tags" and warns about identity exposure.

4. Structural & Container Integrity

Analysing file formats to find hidden data or "extra" appended content.

Trailing Data (Overlay) Detection

Detects: "Zip-in-JPG", hidden archives, or malware payloads.

Checks for data appended after the standard "End of File" marker of a media file.

snapWONDERS helps: Identifies exactly how much "extra" data is being carried.

Hidden Animation Stream Detection

Detects: Hidden or "flash" frames in APNG, WebP, and GIF.

Parses animated image formats to find frames too short for the human eye to see — including GIF frames with delays of ≤10 ms and non-looping frames that appear only once at imperceptible speed.

snapWONDERS helps: Surfaces properties of every internal frame to ensure nothing is hidden.

Container Offset Tampering (MKV/WebM)

Detects: Byte insertion, removal, or re-packaging of Matroska/WebM video files.

Validates the SeekHead element directory — an internal map that declares the exact byte position of every top-level block. If any declared position doesn't match the actual position in the file, bytes have been inserted, removed, or the file was re-packaged by a tool that didn't update the index.

snapWONDERS helps: Cross-checks every SeekHead entry against the real element locations and reports mismatches with exact byte deltas.

Mislabelled Container Detection (WebM)

Detects: Re-muxed or deliberately mislabelled WebM files.

WebM is a strict subset of Matroska — it only permits VP8, VP9, or AV1 video and Vorbis or Opus audio, with no Chapters or Attachments elements. A file that declares DocType=webm but contains Matroska-only content was relabelled after creation, either by a re-mux tool or deliberately.

snapWONDERS helps: Validates every track codec and container element against the WebM specification and lists all violations found.

JPEG XL Repack Detection

Detects: JPEG files disguised as JPEG XL (JXL) images.

JXL supports lossless JPEG recompression — the original JPEG bitstream is stored verbatim inside the JXL container. A jbrd box in the file means the submission is a repacked JPEG, not a native JXL capture from a camera. The original JPEG can be reconstructed byte-for-byte from the wrapper.

snapWONDERS helps: Detects both naked codestream and ISOBMFF container JXL files, and flags the jbrd JPEG Bitstream Reconstruction Data box with a clear forensic verdict.

Document Steganography & Extraction Coming Soon

Detects: Media hidden inside PDF, DOCX, XLSX, PPTX.

Deep inspection of document containers for embedded streams, structural gaps, or hidden XML.

snapWONDERS helps: Will extract every embedded image/video and run the full forensic pipeline on them.

AVI ISFT Encoder Leak (AVI)

Detects: Desktop editing software signature embedded in AVI containers.

AVI files carry an optional RIFF LIST INFO block with an ISFT (Software) tag written by the muxer. FFmpeg writes Lavf58.x, VirtualDub writes its own version string, and OBS writes obs-output. CCTV firmware that omits the tag is itself a signal. The codec FourCC from the stream header is also fingerprinted — MJPEG indicates a webcam or IP camera; XVID/DIVX indicates legacy PC encoding.

snapWONDERS helps: Decodes the ISFT tag and codec FourCC, cross-checks against the encoder fingerprint database, and flags desktop-encoded AVI as processed rather than camera-original.

AVI Header Integrity Checks (AVI)

Detects: Tampered or inconsistent AVI container headers.

The AVI main header (avih) declares the stream count and frame rate. These must match the actual stream list (strl) blocks and the per-stream rate declared in strh. A mismatch — or an unexpectedly missing indx super-index — reveals partial re-muxing, truncation, or two-tool editing. The ICRD creation date in the INFO block is also extracted and can reveal the original recording timestamp independent of the filesystem.

snapWONDERS helps: Cross-checks stream count, frame rate consistency, and index presence; surfaces the ICRD timestamp for comparison with file modification dates.

Ready to analyse your media?

Start your deep analysis now and expose what's hidden.

Analyse Photos » Analyse Videos »

Want to protect your media after analysing it?

Hide & Conceal with Vaultify → Learn more about Vaultify →