Your editing software deleted the face from the photo. The EXIF thumbnail might still have it.

IFD1 in the EXIF APP1 block (tags 0x0201/0x0202). Same structure in WebP EXIF chunks and PNG eXIf blocks — thumbnail travels with the EXIF if you preserve it across conversions.

The nuance: most professional editors (Photoshop, Lightroom, GIMP) do regenerate the thumbnail. Many simpler tools, batch processors, and scripted workflows don't. Even tools that usually do may skip it in certain scenarios.

A mismatch is a finding. Clean check ≠ unedited. Photoshop also writes a separate APP13 resource 0x040C thumbnail alongside IFD1 — disagreement between them is its own signal.

snapWONDERS extracts IFD1, JFIF JFXX, Photoshop APP13, C2PA, and more — labels each by provenance, runs automated mismatch comparison across JPEG, WebP, PNG, HEIC, AVIF, and RAW.

Full piece: https://kennethbspringer.au/the-exif-thumbnail-that-gave-the-edit-away/

#OSINT #digitalforensics #imageforensics #JPEG #EXIF #infosec #metadata

You stripped the EXIF. Did you check the MakerNote?

Standard EXIF strippers remove GPS, timestamp, and the public tag block. They don't touch the manufacturer's proprietary MakerNote — which is a separate binary structure per brand, undocumented, and contains internal camera state at capture: AF mode, lens firmware version, scene classification, internal processing flags.

Canon, Nikon, Sony, Panasonic, Fujifilm — all different formats, all reverse-engineered by the forensics community. The data in there goes well beyond what the camera's own display ever shows.

Forensic value: MakerNotes survive many workflows that strip standard EXIF completely. You can confirm camera origin from a MakerNote when the public tags are gone.

Full article: https://kennethbspringer.au/2026/06/10/makernote-forensics-what-camera-manufacturers-hide-inside-every-photo/

#OSINT #digitalforensics #imageforensics #privacy