Metadata analysis of images and documents
Every file carries information about its own creation. Camera, time, place, program, changes. Metadata analysis is the craft of reading them and noticing when they do not agree.
Updated 2026-08-31 · Veriflied
What metadata is
When a phone takes a picture, it stores more than pixels. It also writes make, model, capture time, focal length, often GPS position, and in many cases a small thumbnail of the image inside the file. A document similarly stores which program made it, when, and how many times it was saved.
That information is called metadata. It is not visible in the picture or on the page, but a program can read it, and it tells a story about how the file came to be.
What can be read from an image
The camera chain
Make, model and the manufacturer-specific fields that are hard to fabricate. An iPhone writes things nobody else writes. If they are missing but the make is present, something was removed or added.
Time
Capture time, often with fractions of a second and time zone. It can be cross-checked against incident date, claim date and against the GPS module's own time, which sits separately in the file and does not change when someone corrects the date.
Place
GPS position and accuracy. Does the place match the incident address? Are the coordinates suspiciously round numbers, or in the middle of the sea?
The thumbnail
The embedded thumbnail is made at capture. If the image was edited afterwards without updating the thumbnail, the thumbnail shows the original version.
Editing software
Photoshop, Lightroom, AI tools and many apps write themselves into the file. Some remove everything. What was removed, and what remained, is also a trace.
What can be read from a document
Producer and Creator, creation and modification time, XMP history, revisions and document id. See the PDF forensics guide for details. The principle is the same as for images: the layers must tell the same story.
Missing metadata is information too
Images sent via messaging apps or social media lose most of their metadata. That is normal and not suspicious in itself. But the pattern of what was removed says something. Platforms remove everything. When make and model are intact but precisely the capture time is missing, the date was removed by a person, not a platform.
Metadata alone rarely decides a case. Combined with image analysis, document forensics and the case's own dates, it is one of the strongest tools there is, because most people do not know it exists.
Frequently asked questions
Can metadata be faked?
The visible fields, yes. But an image has many layers that must agree: camera fields, GPS module time, thumbnail, compression profile. Inconsistencies between the layers are exactly what an analysis looks for.
What if all metadata is gone?
Then the image still carries traces in the pixels themselves: compression pattern, noise, and whether it is AI-generated. And the absence of metadata, considered with how the image was submitted, is a data point in itself.
Can I see metadata myself?
Yes, with free tools such as ExifTool. But interpreting it, reconciling the layers and cross-checking against case dates is what a forensic analysis does automatically.
Is GPS data reliable?
Often, but it can be switched off or faked. The analysis therefore looks at whether the GPS module's own fields (accuracy, satellites, module time) look like a real fix or like typed-in numbers.
Try it on your own document
Create an account and analyse your first 10 images or documents for free. You get a report with the concrete findings, not just a score. All processing in the EU.