Useful clues to inspect
Software, creator tool, modification date, XMP history and thumbnail mismatches can be relevant clues. Read them together with file structure and known copies rather than relying on one tag.
- Software or creator-tool fields
- Modify dates and timezone context
- XMP history when present
- Dimensions and encoding changes
- C2PA actions when signed credentials exist
Why absence proves very little
A clean export may remove every software tag. A screenshot creates a new file. A social platform may rewrite the image. Someone can also edit ordinary metadata directly. No supported edit tag is therefore a neutral result.
Use stronger evidence when stakes are high
Keep trusted originals, compare cryptographic hashes when you have known copies, inspect signed provenance where available, and use qualified forensic review for consequential decisions.
What this does not prove
A metadata result describes the fields and structures that the supported parser could read. It does not, by itself, prove authenticity, intent, authorship or the truth of the visible scene.