Every image and video carries invisible forensic data — GPS coordinates, device fingerprints, editing history, and sometimes concealed payloads. Below are the six evidence categories our analysis pipeline surfaces. Curated real-world cases are being added now.
Our analysis pipeline examines photos and videos across seven distinct evidence layers — each with real-world privacy and authenticity implications. Cases demonstrating each category are being published now.
Smartphones embed precise latitude and longitude into every photo they capture. A single image can silently expose a home address, workplace, or the location of a private meeting — often without the photographer ever knowing it is there. Our analysis resolves GPS coordinates to named locations and flags proximity to sensitive sites.
JPEG files contain quantisation tables (DQT) unique to each camera model, sensor, and firmware revision. By matching these signatures against a database of thousands of devices, we detect mismatches between the claimed camera and the actual encoder — exposing re-encoding, software conversion, and AI-generated imagery masquerading as a real photograph.
Re-saving a JPEG after editing alters the local compression entropy in mathematically detectable ways. ELA maps these compression-level differences across the image, highlighting pasted regions, inserted objects, removed elements, and text overlays that carry a different error signature from the surrounding original content.
Photo editing software embeds author names, computer usernames, email addresses, and editing timestamps directly into image file headers. These fields frequently survive social media re-uploads and can reveal the real identity of an anonymous poster, the complete editing history of a manipulated image, or the organisation that produced it.
Inconsistencies between encoder fingerprints, quantisation profiles, colour spaces, and EXIF data indicate post-processing, format conversion, screenshot capture, or AI generation. Each mismatch type carries a specific forensic implication — from social media re-compression to deliberate metadata stripping — with a calibrated severity rating.
Steganography conceals data inside ordinary images or videos, hiding the very existence of the payload rather than just its meaning. Our proprietary detection engine identifies statistical anomalies consistent with LSB and frequency-domain hidden payloads — including Vaultify-encoded content — even when the file passes all standard format validation checks.
Multiple independent signals identify AI-generated images and video: frequency-domain patterns unique to AI image generators, C2PA provenance declarations from tools like DALL-E and Midjourney, absent camera metadata, and motion gradient statistics that deviate from real-camera physics for AI-generated video. When faces are present, each face is examined independently for signs of AI face-swapping and digital manipulation — surfacing alterations that survive visual inspection.
Our own photos and files, run through the same analysis you can use. Each case shows the before and after, what the report caught in plain words, and what it could not.
We made a feature image with Google Gemini, posted it, and downloaded the copies LinkedIn, Mastodon and X served back. The original was certified AI-generated. All three copies read likely authentic.
See the example
We checked a cropped photo of the banners outside the State Library of Victoria. With no location left in the file, the only thing the report found it giving away was the writing in the picture.
See the example
Two of our own phone photos, neither edited, both graded Authenticity A. Their Exposure grades differ: C for a farm view in Sabah, D for the State Library of Victoria, where the report also found writing.
See the example
We swapped the pale dawn sky in our photo of Mount Kinabalu for a coloured one and kept the file's original details. The small preview stored inside the file still showed the old sky.
See the example
We changed the time stored in a copy of our photo near Southern Cross Station in Melbourne. The satellite time recorded alongside the location no longer agreed, and the report flagged it.
See the example
We covered two exhibition names on our photo of the State Library of Victoria with black boxes and kept the file's original details. The small preview inside the file still showed both names.
See the example
We checked one photo twice: the original off the phone, and the copy WhatsApp delivered. The original showed where, when and on what phone. The copy showed none of it.
See the example
We recorded trams at one Melbourne stop on two phones. The AI check read both as likely authentic. Both still graded Authenticity C, and the reason is not AI.
See the example
We photographed the same building on an Android phone and an iPhone. Neither copy carried a location, but one carried the SIM country and the other the exact lens.
See the example
We made two copies of our own photo, one for Alex and one for Sam, each hiding the recipient's name. They look identical. The password shows whose copy is whose.
See the example
We trimmed four seconds from our own iPhone clip. The copy lost its capture date, make, model and lens, and named the software that wrote it instead.
See the example
We checked our own photo of canola fields beside a canola image Google Gemini generated. Our photo and a screenshot of the Gemini image both read likely authentic. The signed label caught the original.
See the example
We removed one lamp post from our own photo of a pier. The report did not point at the lamp post. It showed the file had been saved again by software.
See the example
We hid a short note inside our own photo with snapWONDERS Vaultify. The two pictures look the same. With the password, the note came back readable.
See the example
A sunrise photo of Mount Kinabalu, checked as it came off the phone. The file gave away the place, the time to the second, and the time zone.
See the example
We changed one digit on a photo of our own receipt. The report shows the file was saved again by software. It does not show which number changed; the maths does.
See the example
The same photo, copied off the phone over USB and picked in the phone's browser. The browser copy arrived with its location set to zero.
See the example
We copied a real scratch along a car door, the way someone might inflate a claim. The report caught the re-save, not the copied damage itself.
See the example
One of our own photos, with location switched on, checked before and after Strip Metadata. Every hidden detail the report flagged was gone. The picture was not changed.
See the example
We added a tiny ZIP archive to the end of a photo. It still opens as the same picture. The report found data it could not explain, and a file that is two things at once.
See the exampleThe tools below run the same forensic pipeline used to produce every case on this page.
Upload any JPEG, PNG, HEIC, WebP, or RAW image and get its full forensic report — GPS, camera fingerprint, ELA, steganography detection, and more.
Analyse NowSubmit an MP4, MKV, WebM, or AVI and get a forensic breakdown — codec fingerprint, DRM detection, GPS atoms, encoder trail, and hidden content checks.
Analyse NowConceal any file inside an ordinary photo or video — encrypted with AES-256-GCM, invisible to every analyser including this one.
Get StartedUpload a photo or video that has a Vaultify payload and extract everything hidden inside it.
Reveal Now
Web Browser over SSL
Same snapWONDERS services on all three networks. Read more
Analyse
Convert
Vaultify
Get updates on new snapWONDERS features, privacy tools, and dark web access improvements — including Vaultify. Nothing else, and you can unsubscribe any time.
© 2026 snapWONDERS · All rights reserved.
ABN: 72 080 510 827
snapWONDERS.com
Analyse & Expose your Digital Media
Forensic Analysis / Metadata Extraction / File Conversion : photos + images + videos
Brought to you by the team at:
goldenSoftwareENGINEERS®
