Start with the high-level facts
Compare format, dimensions, file size, GPS status and the metadata groups present before reading individual tags. These facts quickly reveal whether a platform or editor created a derivative file.
- Same or different file type
- Same or different pixel dimensions
- GPS added, removed or unchanged
- EXIF, XMP, IPTC and ICC markers
- Possible Content Credentials data
Read field changes by direction
A useful comparison separates fields that were removed, added or changed. Removed capture fields may result from an export. Added software fields may describe the latest application. Changed timestamps can belong to a new file rather than the original capture.
Do not turn a difference into a verdict
Normal rotation, optimization, messaging and color-management workflows can rewrite a file. Compare results are technical evidence, not proof that a scene was manipulated or that a person acted deceptively.
Compare like-for-like files
Use the earliest original available and the exact derivative you plan to inspect. A messaging-app download, thumbnail or screenshot adds another transformation and can make the comparison describe platform behavior instead of the edit you care about.
Record hashes and dimensions so the two inputs cannot be confused. A byte hash will almost always change after metadata editing, even when compressed pixels remain unchanged, so combine it with field and payload comparisons.
- Confirm filenames and dimensions
- Hash when chain of custody matters
- Compare normalized and raw field paths
- Keep the original untouched
What the four-field test proves
The comparison correctly marked GPS as removed, software as changed, color space as added and camera make as unchanged. That is the appropriate level of claim for metadata evidence.
It would be incorrect to conclude that Editor 2 manipulated the scene, that removed GPS proves deliberate concealment or that an added sRGB field changed colors. Normal export and optimization workflows can produce all three differences.
Turn differences into useful follow-up
A removed private field may confirm a cleaning goal. A changed orientation or color profile deserves a visual check. New software or timestamp fields can document a workflow but should be corroborated if authorship or intent matters.
Save the comparison report with the two file hashes when reproducibility is important. Otherwise, use the result as a practical before-and-after privacy check and avoid forensic conclusions.
What this does not prove
A metadata result describes the fields and structures that the supported parser could read. It does not, by itself, prove authenticity, intent, authorship or the truth of the visible scene.