Start with the high-level facts
Compare format, dimensions, file size, GPS status and the metadata groups present before reading individual tags. These facts quickly reveal whether a platform or editor created a derivative file.
- Same or different file type
- Same or different pixel dimensions
- GPS added, removed or unchanged
- EXIF, XMP, IPTC and ICC markers
- Possible Content Credentials data
Read field changes by direction
A useful comparison separates fields that were removed, added or changed. Removed capture fields may result from an export. Added software fields may describe the latest application. Changed timestamps can belong to a new file rather than the original capture.
Do not turn a difference into a verdict
Normal rotation, optimization, messaging and color-management workflows can rewrite a file. Compare results are technical evidence, not proof that a scene was manipulated or that a person acted deceptively.
What this does not prove
A metadata result describes the fields and structures that the supported parser could read. It does not, by itself, prove authenticity, intent, authorship or the truth of the visible scene.