Someone has sent you a photo and something about it doesn't sit right. It might be a damage photo on an insurance claim, a listing photo, or a picture a source says they took this morning. You don't need to be a forensic analyst to get a useful answer. You need to know where to look.
1. Ask for the original file, not a screenshot or a forwarded copy
This matters more than anything else on this page. Every time a photo is screenshotted, sent through a messaging app or uploaded to social media, most of the evidence inside it is thrown away. A forwarded copy can look identical and still carry almost nothing to check.
Ask for the file exactly as it came off the phone or camera: emailed as an attachment at full size, or shared as a file rather than as a photo.
2. Look at what the file says about itself
Most photos carry details you can't see: the phone or camera that took it, when, sometimes where, and the software that last saved it.
- Does the device make sense? A claim photo "taken on my phone" that was last saved by desktop editing software is worth a second look.
- Does the date make sense? A photo of storm damage dated before the storm is an obvious problem.
- Does the place make sense? If a location was recorded, does it match where the photo is supposed to be from? (Many phones have location switched off, so a missing location on its own means nothing.)
Details that contradict the story are among the strongest signs you'll find. Details that are simply missing are not.
3. What a "Photoshop detector" actually checks
No tool can see an edit the way you would. What a forensic check does is look for the traces that editing software leaves behind when it saves a file:
- Which software wrote the file. Cameras and editing programs compress images in recognisably different ways, so a check can often tell camera output from a file re-saved by software.
- Signs it was compressed twice. A camera compresses a photo once. Editing and re-saving compresses it again, and that second pass can be measured.
- Regions that don't match. A pasted-in or painted-over area can compress differently from the rest of the picture and show up on a compression map.
- The small preview inside the file. Cameras store a thumbnail at the moment of capture. If the main image has been changed and the thumbnail hasn't, they disagree. If the thumbnail has vanished, something rewrote the file.
4. Look closely at the picture
With the photo at full size, look for edges that are too sharp or too soft, shadows or reflections that point the wrong way, the same patch of texture appearing twice, and text that is slightly misaligned or a different weight from the text around it.
5. Run a check
Upload the photo to snapWONDERS. It's free and needs no account. The report gives two headline grades: Authenticity (has it been edited or generated?) and Exposure (what does it give away?). For this question, Authenticity is the one to read. The full list of checks explains what each one measures, and how to read your forensic report walks through the rest.
A worked example: our own pier photo
We took this photo on a pier in Melbourne with an Android phone, then made a copy and removed the lamp post in editing software. Nothing else changed.
Close-up of the edit. At normal size, few people would notice anything had changed.
Both files went through snapWONDERS. The original came back Authenticity A (nothing flagged). The edited copy came back Authenticity B, with Origin as its weakest area:
The detail shows why. None of it is visible in the picture; it's all in the file:
What gave the edit away:
- Which software wrote the file. The original's compression doesn't match any known editing software, as you'd expect from a phone camera. The edited copy matches a common software encoder.
- Compressed twice. The edited copy shows signs of being saved a second time.
- The thumbnail is gone. The phone stored a small preview inside the original, and it matched the photo. Saving the edit threw it away. A missing thumbnail on a "straight off my phone" photo is a clue in itself.
- The software named itself. The edited file records what saved it. (Not every editor is this honest, and the field is easy to change.)
Notice what the check did not do: it didn't point at the lamp post. It showed that the file had been re-saved by software, which is exactly the question to ask about a photo that's meant to be an original.
What a result can and can't tell you
- A finding is a reason to look closer, not a verdict. Plenty of honest photos are cropped or brightened before they're sent.
- A check often shows that a photo was re-saved, not where it was changed. That is still useful: a "straight off my phone" photo shouldn't have been re-saved at all.
- A clean result doesn't prove a photo is genuine. A screenshotted or forwarded copy may simply have no evidence left in it, which is why step 1 matters.
Photos as evidence
If a photo may end up in a dispute, keep the original file unchanged, write down where it came from and who has handled it, and check a copy, never the only one. A snapWONDERS report is a screening tool, not a certified forensic examination. It helps you decide what needs a qualified examiner and what questions to ask. Whether anything is accepted as evidence is a matter for your jurisdiction.
Why this works
For the detail behind these checks, see Kenneth Springer's How to tell if a photo has been edited and The EXIF thumbnail that gave the edit away.
