Your editing software deleted the face from the photo. The EXIF thumbnail might still have it.
IFD1 in the EXIF APP1 block (tags 0x0201/0x0202). Same structure in WebP EXIF chunks and PNG eXIf blocks — thumbnail travels with the EXIF if you preserve it across conversions.
The nuance: most professional editors (Photoshop, Lightroom, GIMP) do regenerate the thumbnail. Many simpler tools, batch processors, and scripted workflows don't. Even tools that usually do may skip it in certain scenarios.
A mismatch is a finding. Clean check ≠ unedited. Photoshop also writes a separate APP13 resource 0x040C thumbnail alongside IFD1 — disagreement between them is its own signal.
snapWONDERS extracts IFD1, JFIF JFXX, Photoshop APP13, C2PA, and more — labels each by provenance, runs automated mismatch comparison across JPEG, WebP, PNG, HEIC, AVIF, and RAW.
Full piece: https://kennethbspringer.au/the-exif-thumbnail-that-gave-the-edit-away/
#OSINT #digitalforensics #imageforensics #JPEG #EXIF #infosec #metadata









