What can photographs and their metadata show?¶

The image can show visible content, while metadata can record technical file history; neither alone proves who captured it or when the depicted event occurred.

Identify the media generation¶

Distinguish original camera file, edit, screenshot, download, attachment, thumbnail and cloud copy. Metadata may include capture time, device, dimensions, software and GPS, but apps can remove, rewrite or add it. A service-estimated or manually assigned place is not embedded camera location, and a screenshot time belongs to the screenshot.

Reconcile file, app and scene¶

Compare hashes, dimensions and message/database references to connect derivatives and transfers. Separate capture, creation, modification, import, download and sync times. Visual details, original camera-folder evidence, provider or sender records and attributed possession can strengthen origin and human attribution; report each link rather than treating file presence as authorship.