You can often tell a photo has been handled. Telling what was changed is harder. The metadata inside a JPEG records the last program that saved it, the dates, and sometimes an edit history, but all of it can be stripped or rewritten. Here's how to read those clues, what they prove and don't, and what to check in the picture itself when the metadata is gone.
Sometimes. More often you can tell it's been handled without being able to say what changed. A JPEG carries a small record of where it's been: the camera, the dates, the last program that saved it, sometimes a list of edits. Those clues are easy to read and easy to fake. Here's what each clue proves, and what it doesn't:
| Clue | What it proves | What it doesn't prove |
|---|---|---|
| Software tag names an editor (Photoshop, Lightroom, Snapseed) | The file was saved by that program | What was changed. A color tweak and a removed person look the same here |
| Modified date later than the date taken | The file was re-saved after capture | Manipulation. Every camera photo on our disk had been re-saved |
| XMP history entries | A sequence of saves, converts and derived copies | The content of each edit, though Lightroom and Photoshop sometimes list the settings |
| EXIF pixel size differs from the actual image size | The image was cropped or resized after the EXIF was written | Where the crop was or what was removed |
| No EXIF at all | It passed through something that strips metadata, or it was a screenshot | Anything about edits. Social platforms strip EXIF on upload |
The honest summary: metadata can tell you a photo was opened in Photoshop. It can't tell you whether someone straightened the horizon or pasted in a person. For that you need the pixels, or a signed record.
Drop the file into the EXIF viewer and look at three things: the Software tag (the last program to save the file), DateTimeOriginal against ModifyDate (shutter time against last save), and the XMP block, which may carry an edit history. To see what's normal, we read every JPEG on our own drives, 228 unique files:
| Field | Files that had it |
|---|---|
| Any EXIF metadata at all | 25 of 228 |
| Camera make and model | 12 of 228 |
| Date taken (DateTimeOriginal) | 12 of 228 |
| Date taken differs from modified date | 12 of 12 that had both |
| XMP block present | 15 of 228 |
| XMP edit history (xmpMM:History) | 6 of 228 |
| GPS coordinates | 1 of 228 |
Two things stand out. Most JPEGs have no EXIF at all, because stock libraries, web exports and messaging apps strip it, so an empty panel means almost nothing. And every camera photo we found had a modified date later than the capture date, by minutes to two months, with Lightroom Classic, Photoshop or Adobe Bridge in the Software tag. A date mismatch says a photo went through a workflow, not that the workflow lied.
The six files with an XMP history are the interesting ones. Adobe programs log each save and conversion with a timestamp and program name, the closest thing a plain JPEG has to a change log.
It depends on the tool. We cropped one of those portraits, a Canon EOS R6 frame at 4,717 by 3,145 pixels, to a quarter of its area with a Python image library, two ways. Saved the default way, the result had zero EXIF tags: no camera, no dates, nothing to examine. Saved with the metadata copied across, the crop still said Canon EOS R6, kept both original dates, and its EXIF pixel dimensions still read 4,717 by 3,145 while the actual image was 2,358 by 1,572.
That mismatch is the tell. Phone galleries and most desktop editors update the dimension tags when they crop; scripts, batch tools and some web services don't. If the EXIF says the image should be larger than it is, something cut it down after the camera wrote the record. The crop could be innocent. It's still a crop.
The flip side: copying old EXIF onto a new file leaves exactly this inconsistency. If you want a photo to carry nothing, strip it properly with the image metadata remover. Our guide on removing location from photos covers the privacy side.
When the metadata is gone or clean, look at the image:
Fully generated images are a separate question. There's no camera, so metadata is useless. The AI image detector gives a probability, not a verdict, and should be read like any other clue here.
A newer approach that fixes the weakness of EXIF: instead of plain text anyone can rewrite, the camera or editing app cryptographically signs a record of what it did. The standard is C2PA; the user-facing name is Content Credentials. Adobe's apps can attach them, and a few camera and phone makers have started to.
The limits are those of any signature. A missing credential proves nothing, since most images don't have one. A valid one proves the signed steps happened, not that nothing else did, and it can be stripped by saving through an app that doesn't support it. When it's there, though, it beats every other clue on this page. And if a claim or dispute rides on the answer, only the original file from the camera or phone settles it. Documents have their own tells; see how to tell if a PDF has been edited.
Check the EXIF Software tag; Photoshop and Lightroom write their names there when they save. Compare the capture date with the modified date, and the EXIF pixel size with the real size. Then look at the picture for mismatched light, repeated texture and odd edges. None of these alone proves manipulation.
Usually. Most editors update the Software tag and modified date and may add an XMP history entry. Some tools strip everything; some copy the old metadata onto the new file. In our test, a default script crop left zero EXIF tags, while a crop that copied metadata kept the camera's 4,717 by 3,145 pixel dimensions on a 2,358 by 1,572 image.
No. Most JPEGs in the wild have no EXIF. In our sample of 228 files, only 25 had any, and social networks and messaging apps strip it on upload. A missing record only means you can't use metadata to help.
Yes, easily. EXIF and XMP are plain data that any number of free tools can rewrite, including camera model and dates. That's the problem Content Credentials, the C2PA standard, are designed to solve by signing the record so edits to it can be detected.
An EXIF viewer for metadata, a reverse image search for earlier versions, and a forensic tool with error level analysis for the pixels. For a firm answer you need the original file or a valid Content Credential.