Guide · 8 min read · Updated September 2026

Signal four: file metadata, the evidence that is easiest to read and easiest to forge

Metadata is the data a file carries about itself: what made it, when, with what settings, and what software has touched it since. It is the only signal family that can speak directly about origin rather than inferring it from appearance, which makes it valuable — and it is also fully editable by anyone with a free tool, which means it can never carry a verdict alone. Understanding both halves of that sentence is the whole skill.

By Ira Peoples

What is actually in there

EXIF is the block cameras and phones write into an image file. At its fullest it records make and model, lens, focal length, aperture, shutter speed, ISO, orientation, the camera's date and time, a thumbnail of the original, and often GPS coordinates. Separate blocks — IPTC and XMP — carry captions, credits, copyright, and edit history written by software.

Video and audio files carry the equivalent in their container: encoder name and version, track structure, creation and modification timestamps, bitrate and codec parameters. The encoder string in particular is informative, because capture devices, editing suites and generation pipelines all write different ones.

What metadata can establish

Internal contradiction is the strongest thing metadata offers. A file claiming a camera model that never supported the recorded resolution, a GPS location inconsistent with the timestamp's timezone, a modification time earlier than a creation time, or a thumbnail that does not match the full image — these are hard findings, because forging metadata convincingly means forging it consistently, and most people do not.

Software traces are the next most useful. An editing suite's name in the history field tells you the file has been processed; some generation tools write an identifying string of their own. And the settings themselves have to make sense together: a photograph taken at f/1.4 in bright sun at a slow shutter speed and low ISO would be hopelessly overexposed, so that combination did not come from a camera.

Why absence proves nothing

Almost every major platform strips metadata on upload, for privacy and file size. An image that has been through a social network, a messaging app or most content management systems arrives with nothing. Screenshots contain only the screenshotting device's data. Exported and re-saved files typically lose the original block.

So 'no metadata' is the normal state of nearly every image you will ever be sent, and it says nothing whatever about authenticity. Anyone presenting stripped metadata as evidence of fakery is misreading the signal — which unfortunately includes a good deal of confident commentary online.

Why presence proves little

The reverse trap matters just as much. EXIF is a plain, editable block. Free tools rewrite any field in seconds: camera make, timestamp, GPS coordinates, all of it. A generated image can be given the complete metadata of a Canon photograph taken at a specific place last Tuesday.

Metadata is therefore corroborating evidence, never determining evidence. It can strengthen a case built from artefacts and physics, and it can raise a flag through internal contradiction, but a clean plausible EXIF block on a suspicious image should not move you much at all.

C2PA and signed provenance

The serious answer to forgeable metadata is cryptographic signing. The C2PA standard, supported by a growing number of cameras, editing applications and generation tools, attaches a signed manifest recording how a file was created and what was subsequently done to it. Because it is signed, tampering is detectable rather than invisible, and several major generators now attach a manifest declaring their output synthetic.

Two things limit it today. Coverage is partial — most devices and most files in circulation carry nothing — and the manifest is stripped by the same platform pipelines that strip EXIF. A valid C2PA manifest is strong evidence; its absence remains, once again, no evidence at all.

Reading metadata sensibly

Always work from the original file rather than a screenshot or a re-download, and be clear about which copy you are examining, since each hop rewrites the record. Compare the timestamp against what the image claims to show, checking the timezone rather than assuming it. Compare GPS coordinates against the visible scene and its geography.

Then hold the result loosely. Metadata's job in a verdict is to agree or disagree with the other three families. When it disagrees with them, the disagreement is the finding worth investigating, and the direction it points is usually towards asking a human where the file came from rather than towards a more sophisticated tool.

Where this leaves the four signals

Taken together, the four families cover different ground and fail in different conditions. Artefacts read the finest detail and die under compression. Physical consistency reads large structure and survives almost anything. Editing signatures read local history and are erased by a uniform re-save. Metadata reads declared origin and can be rewritten at will.

No single family is sufficient, which is the entire argument for combining them — and for reporting which ones fired rather than collapsing everything into one number. When you read a VTYAI result, the useful question is not 'what is the score' but 'which of these four agreed, and which had nothing to say'.

The short version

Metadata is the only family that speaks to origin directly, and the only one anyone can rewrite.
Internal contradictions — impossible settings, mismatched thumbnails, timezone conflicts — are the real findings.
Missing metadata is the normal state of shared images and proves nothing at all.
C2PA signing is tamper-evident and genuinely strong, but coverage is partial and platforms strip it.
Metadata's value is agreeing or disagreeing with the other three signal families.