Images that look identical may contain different amounts of information. A source camera file, a resaved copy and a screenshot have different creation histories. This affects the available features and the questions that can justifiably be posed for a forensic photographic examination.
What is meant by an original
The file's provenance is established first: which device and application created it, where it was copied from and what operations were performed on it. Simply naming a file “оригинал.jpg” is not enough. Where possible, the original storage medium and the sequence of transfers are preserved, without changing the working system before agreeing on the task.
What changes during forwarding
A messaging app, editor or publishing service may change dimensions, compression, metadata and presentation. The presence of such changes does not prove compositing that alters the content. It may, however, limit the search for traces relating to an earlier state of the file.
- Submit the available source file and derivative versions separately.
- Do not sharpen or enhance the image in the only available copy.
- Preserve information about the applications and forwarding methods.
- Keep your explanations separate from the file's original data.
- Specify the particular suspected alteration to be checked.
Why a screenshot is a different object
A screenshot captures how an image is displayed in a particular environment. It may include scaling, the interface and additional transformation. Some observations may be possible from it, but it does not automatically carry over all the properties of the source photograph or replace its metadata.
What a checksum means
A checksum helps compare the byte contents of two files and track changes to a saved copy. Recording it after receipt does not prove that the file was never edited earlier. Provenance, the copying method and storage history also matter.
How to describe the limitations of an examination
The report must identify the versions examined and the available features. If particular traces are not detected in a copy, this does not always establish that the source image was never altered in any way. The degree of certainty of the answer is assessed against the material's quality and provenance.
For a preliminary consultation, prepare an inventory: the source file, publication, forwarded version, screenshot and an explanation of how they relate to one another. This set helps select examination questions and avoid expecting information from a single derivative image that it may no longer contain.