What to Look For

When I pull metadata on an image, I’m usually checking a few things:

• Are the camera make and model fields populated, and do they make sense?
• Is there any mention of generative tools in the software or creator fields?
• Are there C2PA tags present? (https://c2pa.org/)
• Do the timestamps and any location data line up with what’s being claimed?

I’ve seen cases where an image had no EXIF data whatsoever, which immediately raised questions. In other cases, the file had metadata, but it pointed to an editing program rather than a camera. These aren’t automatic proof of manipulation, but they’re useful signals that something might be off.

It’s also worth noting that social media platforms and messaging apps often strip or alter metadata when images are uploaded or shared. So, consider the source of the image when you start diving in. The absence of data doesn’t always mean the image was AI-generated it could just mean it went through a platform that strips out some of that information.  

Free Tools Worth Using

There are several free tools that make this kind of checking fairly straightforward:

• ExifTool is still the most reliable option for pulling detailed metadata. It works from the command line and handles batch processing well.
• FotoForensics gives you both metadata and Error Level Analysis in one place, which can help spot areas that were added or altered after the original file was created.
• JPEGsnoop is good for looking at compression details and quantization tables.
• Forensically is a browser-based option that includes metadata, ELA, and noise analysis.
• MediaInfo is quick for getting a technical overview of the file.
• https://image-meta.com/ a new comer that takes a very interesting approach.

For a faster check on AI-related markers, the detector at ExifReader.com can flag C2PA credentials and some generative tool signatures.

A Few Practical Notes

Metadata analysis works best as an early step, not the final answer. People can remove or alter EXIF data, and some newer generators are getting better at producing cleaner files. That’s why I usually combine this with reverse image searches and a visual check for things like inconsistent shadows, strange reflections, or text that doesn’t quite make sense.

In my experience, the strongest results come from looking at multiple indicators together rather than relying on any single one. Metadata might tell you the file didn’t come from a camera. Visual inspection might show physical impossibilities. And OSINT work might reveal where the image actually originated.

Using EXIF and Metadata in OSINT and Forensic Verification

When examining a suspicious image:

1. Extract and review core EXIF fields — Look for camera make/model consistency with the claimed source. Real photos from a specific device should show matching device identifiers across multiple images. AI images often show blank or mismatched fields.
2. Check for generative tool signatures — Fields like “Software,” “CreatorTool,” or prompt-related parameters (in some generators) can directly reveal AI involvement.
3. Examine C2PA Content Credentials — Increasingly adopted by platforms (OpenAI, Adobe Firefly, LinkedIn, Meta), C2PA provides cryptographically signed provenance data. Presence of these credentials can confirm AI generation or editing.
4. Cross-reference with other metadata layers — JPEG quantization tables, compression signatures, and thumbnail inconsistencies can reveal post-generation processing or compositing.
5. Combine with OSINT techniques — Perform reverse image searches (Google, TinEye, or specialized tools) to trace origins. Compare claimed capture dates/locations against EXIF timestamps and geolocation data. Inconsistencies often surface quickly.

If you’re dealing with something that could end up in a report or legal matter, document what you find and how you found it. These small details matter when you need to explain your process later.