Web iconSSL Lock icon / Tor Logo / I2P Logo — Browsing Safely ( read more )
snapWONDERS is modernising — introducing Vaultify, our new platform for hiding files inside photos and videos. Try Vaultify → What’s changing →
PREPARING DIGITAL MEDIA FOR REGENERATION — PLEASE WAIT

Your Photo / Image Forensic Analysis Report

Every image is a forensic artefact. Beneath the pixels, your photo carries a detailed record — metadata exposing where and when it was taken, a hardware identifier unique to the device that captured it, authoring details, embedded thumbnail history, and potentially steganographic content. Forensic analysis of this data can be used to identify, track, and authenticate both the image and its origin.

Understanding what your files reveal is the first step. Our steganography workflows go further — embedding content inside images in ways specifically designed to resist forensic detection.

We never store your files — all content is deleted when your session ends.

Privacy, Authenticity & Forensic Analysis Score & Summary

F
Critical
Overall Grade
PrivacyA — Clean
OriginB — Low Risk
ManipulationF — Critical
SecurityC — Moderate Risk
PropertiesInfo only

Hide this photo — or any private message — inside an ordinary image, invisible to every scanner including this one.

Discover Vaultify

Results are indicative only. All checks — including grades — are produced by automated heuristic algorithms and may contain false positives or false negatives. Results must not be used as evidence in legal proceedings, insurance claims, or professional forensic investigations, and do not constitute a professional opinion on image authenticity. See our Terms of Service for full details.

A
Privacy
Clean
Location, identity & personal information embedded in this file
CheckResult
Contains location details?No location information has been detected
Contains faces?'AI Face Detection' analysis did not find any faces. If this is a false negative and the photo is sensitive in nature then consider blotting out the 'faces' before sharing online.
Contains tracking?No tracking was detected
Has maker note content?No maker note information was detected
Contains date/time details?No meaningful date/time detected. However, the date/time of the file can infer when content was created
Contains camera / device information?No camera / device information was detected
Contains text?'AI Text Detection' analysis did not find any text content. If this is a false negative and the photo is sensitive in nature then consider blotting out the 'texts' before sharing online.
Contains comments / descriptions?No comments / descriptions was detected
Has authoring information?No authoring information detected. You should consider adding authoring metadata to protect your works. read more
Has thumbnail(s)?No thumbnails was detected
B
Origin
Low Risk
Evidence the file came directly from a capture device, not re-encoded by software
CheckResult
Original Photo taken from Camera?This does not look like it is an original photo taken from a camera - READ WARNING BELOW! read more
Contains C2PA Content Credentials?No C2PA Content Credentials found. This does not mean the image is inauthentic.
Progressive JPEG encoding?Sequential JPEG encoding (SOF0/SOF1) — consistent with direct camera output.
Chroma subsampling Chroma subsampling: 4:2:0 — most common camera output — no subsampling concern.
F
Manipulation
Critical
Signs of editing, compositing, or re-encoding of pixel content after capture
CheckResult
Copy-move regions detected?Copy-move regions detected. Multiple similar image blocks found at spatially distant locations — consistent with content cloning or object duplication. read more
Resampling artifacts detected?Strong resampling artifacts detected. Periodic patterns in the prediction residual strongly indicate the image (or a region) has been resized and re-saved. read more
Noise level inconsistency?Significant noise inconsistency detected. Noise levels vary strongly across image regions — a strong indicator of compositing, copy-paste, or inpainting from multiple sources.
Printer / scanner artifact?Possible printer / scanner halftone pattern detected. Periodic peaks in the FFT power spectrum suggest the image may have been printed and re-scanned — a common technique to obscure editing history.
Natural scene statistics (NSS)?DCT coefficient statistics deviate from natural scene statistics. The distribution of first significant digits in block DCT coefficients deviates from Benford’s law — a potential indicator of synthetic generation or heavy post-processing.
GPS timezone triangle?GPS timezone triangle not applicable or not run (requires GPS coordinates, GPS UTC timestamp, and EXIF DateTimeOriginal).
JPEG block grid alignment?JPEG block grid misalignment detected (offset X:0px, Y:6px). The JPEG 8×8 DCT block grid does not start at pixel (0,0) — consistent with a crop or composite operation that shifted the grid relative to the original capture.
Compression artefact inconsistency (ELA)?No manipulation detected. Mean residual 2.2/255, 0.0% of pixels in the high-artefact range — compression artefacts are consistent throughout, consistent with a single-pass encode. read more
Thumbnail matches main image?Thumbnail mismatch check not available — no EXIF thumbnail detected or format not applicable. read more
Histogram re-encoding gaps?Luminance histogram is continuous with no significant gaps (0 zero bins in the usable range). read more
JPEG Ghost (prior save quality)?JPEG Ghost detected at quality 95. The image shows evidence of a prior JPEG save at a different quality setting — may indicate re-compression or editing. read more
Double JPEG compression?No double JPEG compression detected. Compression quality probe shows a clean monotone residual curve consistent with a single-pass JPEG encode. read more
Metadata field consistency?No cross-field metadata inconsistencies detected. read more
Orientation tag consistent?Orientation consistency check not applicable — no EXIF Orientation tag present. read more
Flash tag consistent?Flash consistency check not applicable — no EXIF Flash tag present. read more
Anti-forensics patterns?No metadata stripping or anti-forensics patterns detected.
C
Security
Moderate Risk
Hidden data, steganography & concealed embedded content
CheckResult
Polyglot / hidden archive?Polyglot check: no embedded archive or document format detected.
Contains steganography?High statistical anomaly detected — possible steganography. read more
Trailing data appended to photo?No trailing data information was detected
Contains digital watermarks?No digital watermark detected by frequency-domain and AI analysis. read more
Embedded binary strings?No suspicious embedded strings (URLs, emails, paths, IPs) found in JPEG binary header.
i
Image Properties
Informational
Copyright, metadata types & format details
CheckResult
Contains metadata?No metadata information was detected
Is copyrighted?No copyrights © detected. You should consider adding copyrights metadata to protect your works. read more
Contains unreadable metadata?All information was readable
Detailed Findings
Full detail for each check, grouped by category.
Privacy
Location, identity & personal information embedded in this file
Origin
Evidence the file came directly from a capture device, not re-encoded by software

Original Photo taken from Camera Concerns

This does not look like it is an original photo taken from a camera. If you have already shared or sent the original photo then the personal & private information contained may already be extracted and removed. Otherwise the photo has been edited or resized and have some metadata lost in the process. It is always best to use the original photo taken from the camera as this is generally what is selected when sharing online. Use the original source to see what was revealed to the other party (i.e. the social platform, online service, or recipient).

C2PA Content Credentials

No C2PA Content Credentials were found in this file. C2PA (Coalition for Content Provenance and Authenticity) is an open standard that embeds verifiable provenance metadata — including the creator tool, signing identity, and edit history — directly into the file. The absence of C2PA data does not mean the content is inauthentic; most files do not carry it.
Manipulation
Signs of editing, compositing, or re-encoding of pixel content after capture

Clone / Copy-Move Detection

Copy-move regions detected. 38 matching block pairs found at spatially distant locations. This is consistent with content cloning, object duplication, or background filling.
FieldValue
VerdictBad
Matching block pairs38
Block size (px)16
Stride (px)8
Region pairs (x,y)(296,1416)→(336,1416) (96,1416)→(152,1416) (152,1416)→(8,1416) (112,1416)→(64,1416) (48,1416)→(128,1416) (16,1416)→(120,1416) (120,1416)→(160,1416) (160,1416)→(24,1416) (24,1416)→(168,1416) (184,1416)→(424,1416)
About this check: Copy-move forgery is a common image manipulation technique where a region of the image is copied and pasted elsewhere — to clone an object, cover up content, or duplicate a texture. This check divides the image into overlapping 16×16 px blocks and computes a compact block-DCT descriptor for each. Blocks whose descriptors match closely (within a Euclidean distance threshold) but are spatially far apart are flagged as candidate copy-move pairs. Low-variance blocks (uniform textures such as sky or walls) are excluded to suppress false positives. False alarms can occur on highly repetitive patterns such as fabric, grass, or tiled floors.

Resampling / Interpolation Detection

Strong resampling artifacts detected. Periodic patterns detected in the horizontal and vertical prediction residual — strongly consistent with the image (or a region) having been resized and re-saved.
FieldValue
VerdictBad
Horizontal peak ratio193
Vertical peak ratio148
Horizontal periodicYes
Vertical periodicYes
About this check: When an image is resized using bilinear, bicubic, or Lanczos interpolation, the resampling kernel introduces periodic correlations between adjacent pixels. This check computes a prediction residual (each pixel minus the mean of its left and right neighbours), averages the residual across rows and columns to produce 1D signals, then looks for a dominant spectral peak (FFT peak-to-mean ratio) that would indicate a regular, repeating pattern. A strong periodic peak suggests the image was resized; the axis (horizontal/vertical or both) indicates the direction of resampling. Nearest-neighbour scaling and lossless crops do not produce this pattern. Heavy JPEG compression can partially mask it.

ELA / Compression Artefact Inconsistency Analysis

No significant compression artefact inconsistencies detected. ELA residuals are consistent with a uniformly compressed image.

ELA DetailsValue
Re-compression quality85/100
Pixels analysed1,500,896
Mean ELA residual2.18 / 255
Residual std deviation2
High-residual pixels (>30)0.00% of image
Maximum residual (extrema)25 / 255
About ELA: Error Level Analysis re-compresses the image at a known JPEG quality level and measures the per-pixel difference between the original and re-compressed versions. A uniformly compressed image produces a uniform residual map. Composited or locally edited regions — having a different compression history — produce elevated residuals. Results are less conclusive on images that have already been re-encoded multiple times.

Histogram / Re-encoding Gap Analysis

No significant histogram gaps detected. The luminance histogram is continuous with only 0 zero bins in the usable range — consistent with an image that has not undergone repeated lossy re-encoding or destructive levels adjustment.

Histogram Analysis DetailsValue
Pixels analysed1,500,896
Zero bins (range 10–245)0
Comb score (pairs)0
Comb pattern detectedNo
VerdictGood
About this check: Every lossy compression cycle discards certain tone values from the luminance histogram, leaving zero-count bins ("gaps") that cannot be recovered by subsequent saves. An image saved once from a camera has a near-continuous histogram; an image that has been re-encoded, resaved, or edited repeatedly develops progressively more gaps. A comb-like alternating zero/non-zero pattern specifically indicates a levels or curves adjustment applied to an already-compressed image. Analysis excludes the extreme shadows (0–9) and highlights (246–255) to avoid false positives from clipping.

Metadata / Cross-field Consistency Analysis

No cross-field metadata inconsistencies detected. All checked metadata fields are internally consistent.

Double JPEG Compression Detection

No double JPEG compression detected. The re-compression residual curve is monotonically decreasing — consistent with a single-pass JPEG encode. No quantisation ghost was found across the probed quality range.
Probe QualityMean Abs. Difference
Quality 603
Quality 702
Quality 802
Quality 901
Quality 951
Non-monotone rises0
Double JPEG detectedNo
About this check: When a JPEG is compressed twice (camera original at quality Q1, then re-saved at quality Q2), the quantisation tables from the first pass leave a characteristic fingerprint. Re-compressing the doubly-encoded image at a quality near Q1 produces a "ghost" — a local error minimum below the expected monotone trend. This probe tests five quality levels (60, 70, 80, 90, 95) and checks whether the mean absolute residual (vs the original) decreases consistently as quality increases. A rise in the residual at any quality level is the ghost signature. Note: this is a statistical heuristic; some innocent operations (thumbnail extraction, embedded preview generation) can also produce minor non-monotone artifacts.

JPEG Ghost Detection

JPEG Ghost detected. The probe found a MAD minimum at quality 95 (dip depth: 21.9%). This indicates the image was originally saved as a JPEG at approximately quality 95 before any subsequent processing. A ghost at a quality different from the current save settings can indicate re-compression — for example, uploading to a social media platform that re-encodes at a lower quality, or editing and re-saving the image in a different application. This does not by itself imply manipulation.
Probe QualityMean Abs. Difference
Quality 511
Quality 107
Quality 156
Quality 205
Quality 254
Quality 304
Quality 354
Quality 403
Quality 453
Quality 503
Quality 553
Quality 603
Quality 653
Quality 702
Quality 752
Quality 802
Quality 852
Quality 901
Quality 911
Quality 921
Quality 931
Quality 941
Quality 95 ★1
Ghost quality95
Ghost depth21.9%
About this check: The JPEG Ghost technique re-saves the image at every quality level from 5 to 95 and measures the mean absolute pixel difference vs the original. For a singly-saved JPEG the error decreases smoothly. If the image was previously saved at quality Q, re-saving at Q produces a local minimum — the "ghost" — because the quantisation tables approximately match. This probe uses a coarse sweep (every 5th quality) followed by a fine sweep around the minimum (±4 qualities) for precision. A ghost does not confirm tampering — it confirms that the image passed through a JPEG encoder at approximately quality Q at some point in its history.

Orientation Consistency

Orientation consistency check was not applicable for this file type.

Flash Consistency

Flash consistency check was not applicable for this file type.

Thumbnail / Embedded Preview Mismatch Analysis

Thumbnail mismatch analysis is only available for JPEG images with an embedded EXIF thumbnail. This file either is not a JPEG or contains no EXIF block.
Security
Hidden data, steganography & concealed embedded content

Digital Watermark / Steganography Analysis

Anomalies detected — statistical or frequency-domain irregularities were found. This may indicate steganography or an invisible watermark, but is not conclusive.

Pixel-Level Statistical Analysis — These tests examine the raw pixel values of the image for patterns that are statistically unlikely in natural photos and may indicate hidden data embedded by steganography tools.
Pixel-Level AnalysisValue
Image Complexity Colour diversity is consistent with a natural photograph.
Colour diversity: 221/256 distinct values, dominant value 1.2% of pixels, information content 7.30 bits. Tests calibrated for natural photos may be less reliable on synthetic or cartoon content.
LSB Chi-Square p-value: 0.0000 — suspicion: high 1
Tests whether adjacent pixel value pairs are unnaturally equal in frequency — the signature of LSB substitution steganography.
RS Analysis RS ratio: 1.0000 — suspicion: high 1
Regular-Singular analysis. Groups pixels into "Regular" and "Singular" sets — hidden data disrupts the natural R/S balance.
Histogram Even/Odd Bias bias score: 0.1552 — suspicion: none
Checks whether even and odd pixel brightness values are unusually balanced — overwriting the LSB of every pixel creates this artefact.
JPEG Huffman Tables (DHT) Standard IJG Huffman tables — consistent with original camera output
Compares the JPEG compression tables against the 4 standard IJG tables. Non-standard tables can indicate the image was re-saved, possibly by a watermarking tool.
Legend:
  1. Chi-square and RS results on JPEG files may include false positives because JPEG re-compression alters pixel values in ways that can resemble steganography patterns.


Frequency-Domain & AI Analysis — These tests look at the mathematical structure of the image rather than raw pixel values, detecting invisible watermarks and anomalies that survive JPEG compression.
Frequency-Domain & AI AnalysisValue
DCT Mid-Frequency Anomaly score: 18.8599 — normal
Analyses the kurtosis (peakedness) of DCT coefficients in the mid-frequency range. Watermark embedding tools often leave a flatter distribution here than natural images.
DCT Notenormal distribution
Wavelet Noise Floor score: 25.5059 — normal
Decomposes the image into frequency sub-bands using Daubechies-4 wavelets and checks whether the high-frequency noise floor is unnaturally flat — a sign that data has been injected.
Wavelet Notenormal noise floor
SD Invisible Watermark confidence: 0.00 — not detected
DWT-DCT-SVD blind watermark detector. Looks for the specific frequency-domain pattern left by stable diffusion and similar AI image generation tools.
SD Notenot detected
Image Properties
Copyright, metadata types & format details

Add or Modify Copyrights / Authoring Details

Add or modify Copyrights / Authoring to your own content. Protect your works and declare ownership to your photo / images and metadata. Reduce photo theft by signing your works.

Manage Copyright in Vaultify



Photo / Image Break Down Analysis

This section details the break down of the photo / image and decoding the embedded metadata.

General

PropertyValue
File Namemeneame-media-link-4183968.jpeg
File Size221,802 bytes
Image TypeJpeg
Image Dimensions1080 x 1459 (Large images may be re-sized)
Image Data Size221,211 bytes
Number of Sections Found6
Sections FoundDHT, DQT, EOI, SOF0, SOI, SOS

Main Photo / Image

The main photo / image may be scaled to a smaller size if it has a width or height larger than 900 pixels. We do not store photos or images and content is removed when your session has ended

Image showing large Thumbnail

Section Break Down

Below shows the break down of the metadata sections contained within the image:

SOI - Start of Image

Showing 6 items
PropertyValue
MarkerD8h
NameSOI
DescriptionStart of Image
Data Size0 bytes
Order1 of 6
Number of Identical Sections1

DQT - Define Quantization Table

Showing 7 items
PropertyValue
MarkerDBh
NameDQT
DescriptionDefine Quantization Table
Data Size130 bytes
Order2 of 6
SignatureNone Determined
Number of Identical Sections1

DQT Details

Showing 5 items
PropertyValue
Id0
Table RoleLuminance (Y channel)
Precision8-bit
Quality Estimate
Data Size129 bytes (64 coefficients)
865812202631
6671013293028
7781220293528
79111526444031
911192834555239
1218283241525746
2532394452616051
3646484956505250
Row-major (top-left = DC coefficient)
........ ........ ........ ........ ....$.'. ",#..(7) ,01444.' 9=82<.34 2....... ....2!.! 22222222 22222222 22222222 22222222 22222222 22222222 22
0008 0606 0706 0508 0707 0709 0908 0A0C 140D 0C0B 0B0C 1912 130F 141D 1A1F 1E1D 1A1C 1C20 242E 2720 222C 231C 1C28 3729 2C30 3134 3434 1F27 393D 3832 3C2E 3334 3201 0909 090C 0B0C 180D 0D18 3221 1C21 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232 3232

SOF0 - Encoding (Baseline)

Showing 7 items
PropertyValue
MarkerC0h
NameSOF0
DescriptionEncoding (Baseline)
Data Size15 bytes
Order3 of 6
SignatureNone Determined
Number of Identical Sections1

SOF0 Details

Showing 4 items
PropertyValue
Compression TypeBaseline DCT
Bits / Sample8 bits
Image Dimensions1080 × 1459 pixels
Colour SpaceYCbCr (3 components)
Showing 3 items
ComponentSampling / QT Table
Y (Luminance)H:2 V:2 (4:2:0 — chroma halved both axes) — QT table 0
Cb (Chroma Blue)H:1 V:1 (4:4:4 — no subsampling) — QT table 1
Cr (Chroma Red)H:1 V:1 (4:4:4 — no subsampling) — QT table 1
....8.." .......
0805 B304 3803 0122 0002 1101 0311 01

DHT - Define Huffman Table

Showing 7 items
PropertyValue
MarkerC4h
NameDHT
DescriptionDefine Huffman Table
Data Size416 bytes
Order4 of 6
SignatureNone Determined
Number of Identical Sections1

DHT Details

Showing 6 items
PropertyValue
Id0
Table KindDC
Number of Codes12
Symbol Data399 bytes of symbol data
Codes per Length[
  L2: 1 (1 symbol encoded with 2-bit patterns);
  L3: 5 (5 symbols encoded with 3-bit patterns);
  L4: 1 (1 symbol encoded with 4-bit patterns);
  L5: 1 (1 symbol encoded with 5-bit patterns);
  L6: 1 (1 symbol encoded with 6-bit patterns);
  L7: 1 (1 symbol encoded with 7-bit patterns);
  L8: 1 (1 symbol encoded with 8-bit patterns);
  L9: 1 (1 symbol encoded with 9-bit patterns)
]
Table TypeOptimized (custom per-image)
........ ........ ........ ........ ........ .....}.. ......!1 A..Qa."q .2....#B ...R..$3 br...... ..%&'()* 456789:C DEFGHIJS TUVWXYZc defghijs tuvwxyz. ........ ........ ........ ........ ........ ........ ........ ........ ........ ........ ........ ........ ........ ........ .....w.. .....!1. .AQ.aq." 2...B... ..#3R..b r...$4.% .....&'( )*56789: CDEFGHIJ STUVWXYZ cdefghij stuvwxyz ........ ........ ........ ........ ........ ........ ........ ........ ........
0000 0105 0101 0101 0101 0000 0000 0000 0000 0102 0304 0506 0708 090A 0B10 0002 0103 0302 0403 0505 0404 0000 017D 0102 0300 0411 0512 2131 4106 1351 6107 2271 1432 8191 A108 2342 B1C1 1552 D1F0 2433 6272 8209 0A16 1718 191A 2526 2728 292A 3435 3637 3839 3A43 4445 4647 4849 4A53 5455 5657 5859 5A63 6465 6667 6869 6A73 7475 7677 7879 7A83 8485 8687 8889 8A92 9394 9596 9798 999A A2A3 A4A5 A6A7 A8A9 AAB2 B3B4 B5B6 B7B8 B9BA C2C3 C4C5 C6C7 C8C9 CAD2 D3D4 D5D6 D7D8 D9DA E1E2 E3E4 E5E6 E7E8 E9EA F1F2 F3F4 F5F6 F7F8 F9FA 0100 0301 0101 0101 0101 0101 0000 0000 0000 0102 0304 0506 0708 090A 0B11 0002 0102 0404 0304 0705 0404 0001 0277 0001 0203 1104 0521 3106 1241 5107 6171 1322 3281 0814 4291 A1B1 C109 2333 52F0 1562 72D1 0A16 2434 E125 F117 1819 1A26 2728 292A 3536 3738 393A 4344 4546 4748 494A 5354 5556 5758 595A 6364 6566 6768 696A 7374 7576 7778 797A 8283 8485 8687 8889 8A92 9394 9596 9798 999A A2A3 A4A5 A6A7 A8A9 AAB2 B3B4 B5B6 B7B8 B9BA C2C3 C4C5 C6C7 C8C9 CAD2 D3D4 D5D6 D7D8 D9DA E2E3 E4E5 E6E7 E8E9 EAF2 F3F4 F5F6 F7F8 F9FA

SOS - Start of Scan

Showing 7 items
PropertyValue
MarkerDAh
NameSOS
DescriptionStart of Scan
Data Size10 bytes
Order5 of 6
SignatureNone Determined
Number of Identical Sections1

SOS Details

Showing 3 items
PropertyValue
Scan Components3 (3 channels included in this scan)
Spectral SelectionSs:0 Se:63 (full DCT block — baseline / sequential scan)
Successive ApproximationAh:0 Al:0 (baseline / first progressive pass — full precision)
Showing 3 items
ComponentHuffman Tables
Y (Luminance)DC table 0 / AC table 0
Cb (Chroma Blue)DC table 1 / AC table 1
Cr (Chroma Red)DC table 1 / AC table 1
........ ?.
0301 0002 1103 1100 3F00

EOI - End of Image

Showing 6 items
PropertyValue
MarkerD9h
NameEOI
DescriptionEnd of Image
Data Size0 bytes
Order6 of 6
Number of Identical Sections1
snapWONDERS Vaultify Hide & conceal files inside any photo — free to try, no account needed. Hide a file → Learn more about Vaultify →