Forensic Example · ·2 min read

We gave a mountain photo a new sky. Its thumbnail kept the old one.

We swapped the pale dawn sky in our photo of Mount Kinabalu for a coloured one and kept the file's original details. The small preview stored inside the file still showed the old sky.

Mount Kinabalu at dawn, taken on an Android phone. We replaced the pale sky with a coloured one and saved the copy with the file's original details kept, the way many photo editors do.

  • Mount Kinabalu's jagged ridge under a pale dawn sky Before: our photo, straight off the phone.
  • The same view with a deep blue and orange sky After: the sky replaced. Nothing else changed.

What changed

  • The sky. Everything below the ridge is untouched.
  • The thumbnail didn't. The phone stored a small preview inside the file when the photo was taken. Our saved copy kept it, pale sky and all.
  • What saved the file. The copy's compression matches common software, not the phone.

What the report said: Authenticity A for the original, B for the edited copy. It showed the thumbnail it found and flagged that it no longer matched the picture.

The report's thumbnail, still showing the pale sky, and a thumbnail content mismatch flagged with a difference score of 37.7

Go deeper

Tagged edited-photos

More forensic examples

← All forensic examples

Share the ♥

Browsing Safely —
Web SSL Web Browser over SSL
/
Tor
/
I2P

Same snapWONDERS services on all three networks. Read more

Get the App —
Download on the
App Store
Get it on
Google Play
Join the waitlist →

Join the Movement

Get updates on new snapWONDERS features, privacy tools, and dark web access improvements — including Vaultify. Nothing else, and you can unsubscribe any time.

Follow the ♥

© 2026 snapWONDERS · All rights reserved.

ABN: 72 080 510 827

snapWONDERS snapWONDERS.com

Analyse & Expose your Digital Media

Forensic Analysis / Metadata Extraction / File Conversion : photos + images + videos

Brought to you by the team at:
goldenSoftwareENGINEERS®