Guide · snapWONDERS ·3 min read

Where did this video come from? How to check a video file

What a video file records about the device that made it, when it was made and whether it has been re-encoded — and how to check one yourself.

A video has a story in it beyond what's on screen. The file itself usually records what recorded it, when, and how it has been handled since. When you need to know whether a clip is what someone says it is, that's where to start.

1. Get the file, not a link

A video that has been posted to a social platform and downloaded again has been re-encoded, and most of its original details are gone. If you can, ask for the file exactly as it came off the device.

2. Check what the file says about itself

A video file can record:

  • The device or app that recorded it.
  • Creation dates — and whether they agree with each other.
  • Location, on some phones.
  • The software that last wrote it — a phone, an editing app, or a platform's re-encoder.

A clip "straight off my phone" that was last written by editing software, or whose dates disagree with each other, deserves a closer look.

3. Use a video identifier check

A video identifier reads that record for you. Upload the video to snapWONDERS: it's free, needs no account, and handles the common phone and camera formats (MP4, MOV, MKV and more). The report shows the device and software details, dates and location where present, and flags signs the file has been re-edited or is carrying extra data.

A worked example: an iPhone clip, before and after a trim

We recorded a tram in Melbourne on an iPhone and shared the file through Google Drive. The report reads straight out of the file:

Report: the clip's creation date with its time zone, and the camera details: Apple, iPhone 15 Pro Max, and the exact lens

The moment recording began (9:50:17 am on 25 September 2026, with its time zone, +10:00), the make and model, and the exact lens. It recorded no location.

Then we trimmed four seconds out of the clip with a free video tool (FFmpeg), the kind of re-save any editing app does, and checked the copy:

Report finding on the trimmed copy: desktop encoder software detected, FFmpeg

The capture date, make, model and lens are all gone, and the file now names the software that wrote it. Origin went from B to C ("moderate risk"). Nothing here proves the clip was faked, but it is no longer the file that came off the phone, and that is what this check is for.

What a result can and can't tell you

  • Re-encoded is not the same as faked. Messaging apps re-encode almost everything.
  • Details that contradict the story — a date before the event, a device the sender doesn't own — matter more than details that are simply missing.
  • Look at the content too. Weather, shadows, signage and seasons in the frame can confirm or contradict when and where a video claims to be from.

Related guides

More guides

← All guides

Share the ♥

Browsing Safely —
Web SSL Web Browser over SSL
/
Tor
/
I2P

Same snapWONDERS services on all three networks. Read more

Get the App —
Download on the
App Store
Get it on
Google Play
Join the waitlist →

Join the Movement

Get updates on new snapWONDERS features, privacy tools, and dark web access improvements — including Vaultify. Nothing else.

Follow the ♥

© 2026 snapWONDERS · All rights reserved.

ABN: 72 080 510 827

snapWONDERS snapWONDERS.com

Analyse & Expose your Digital Media

Forensic Analysis / Metadata Extraction / File Conversion : photos + images + videos

Brought to you by the team at:
goldenSoftwareENGINEERS®