MODLAN METADATA FORENSICS LAB · V132
Modern provenance. Legacy compatibility. One byte-first forensic view.
A public, local-first utility for cryptographic identity, deep metadata inspection, AI/provenance declarations, privacy exposure, email-routing context, evidence-set manifesting, structural context and evidence-oriented documentation. Source bytes remain in your browser; matter work requiring custody, validated deep parsers or examiner attestation belongs in professional Secure Ops.
AI-ERA FILE FORENSICS
Designed for captured, edited, generated and legacy artifacts.
V132 preserves the hardened examiner workspace and moves its specialist styles off the global site payload without pretending that metadata alone can classify authenticity. The system records technical observations, declared provenance and limitations so a human examiner can decide what deserves deeper work.
AI provenance declarations
Screens IPTC Digital Source Type plus 2025.1 AI-system, version, prompt and prompt-writer metadata when present. Declarations are reported as declarations—not synthetic-media verdicts.
Content Credential awareness
Screens for C2PA/JUMBF-related markers and separates marker presence from cryptographic manifest, signer, trust-list, ingredient, timestamp or soft-binding validation.
Backward compatibility
Preserves older metadata namespaces, common legacy image/audio/document containers and a SHA-1 correlation hash while keeping SHA-256/SHA-512 as the primary integrity fingerprints.
Structural anomaly context
Adds bounded entropy, printable/null ratios, container inventories, type mismatches and trailing-byte observations to help an examiner identify where deeper review may be justified.
PUBLIC · LOCAL-FIRST FORENSIC WORKSPACE · V130
Interrogate an evidence set without surrendering the source files.
Files are hashed and analyzed in this browser. V130 adds an examiner evidence lens, keyboard-hardened navigation and route-scoped forensic presentation while preserving V129 correlation intelligence and the no-egress boundary.
V130 INTERACTIVE FORENSIC EXAMINER WORKSPACE
One local inspection model for files, email and multi-artifact review.
The public lab now combines byte identity, evidence-set navigation and an interactive email workbench with dedicated command, route, authentication, identity, MIME and signal views. Every interaction remains browser-local; the exported manifest documents what the browser examined but does not create institutional custody.
RFC-aware forensic reconstruction
Received-chain chronology, Authentication-Results, explicit SPF MAIL FROM/HELO identity separation, DKIM signed-header coverage, ARC sets, display-name and punycode context, identity relationships, MIME structure, Message-ID threading context, attachment declarations and URLs are reconstructed locally without executing message content or performing network lookups. Header data remains contextual evidence rather than proof of authorship.
Bounded batch analysis
Up to 64 files are processed with bounded concurrency and explicit per-file and set-size limits so batch utility does not become an uncontrolled browser resource sink.
Observation ≠ conclusion
Fields are classified as declared metadata, structural observations, cryptographic identity, provenance, privacy or routing context with parser version and limitations preserved.
Need a professional examination?
Custody, matter linkage, controlled evidence intake, examiner attestation, validated deep parsers, retention and peer review remain inside protected MODLAN Secure Ops.
WHAT THE LAB INTERROGATES
Identity, structure, metadata, provenance declarations and privacy context—not a single EXIF table.
File identity
name · size · declared type · magic-byte signature · extension mismatch
Cryptographic identity
SHA-256 · SHA-512 · legacy SHA-1 correlation · session manifest
Image / camera
make/model · lens/settings · capture timestamps · GPS · orientation
Extensible metadata
creator tool · dates · rights · document IDs · editing/provenance hints
AI / provenance declarations
IPTC Digital Source Type · AI system/version · prompt metadata · C2PA/JUMBF presence
Container structure
JPEG/PNG/GIF/WebP/TIFF · PDF · ZIP/OOXML · BMFF/MP4/MOV/HEIF/AVIF · audio
Structural integrity
trailing bytes · entropy · printable/null ratios · bounded box/chunk inventory
Exposure classification
location · identity · organization · device · rights · prompt/AI disclosure
Cross-file comparison
exact duplicate · hash match · metadata delta · timestamp delta · field consistency
Backward compatibility
legacy metadata namespaces · older container formats · SHA-1 correlation only
DISCOVERY / LITIGATION SUPPORT
Build the technical foundation. Do not promise the evidentiary ruling.
A MODLAN analysis can preserve reproducibility fields that support authentication and expert explanation. Whether an item is admitted remains a legal question dependent on jurisdiction, foundation, relevance, hearsay and other rules.
- analysis session ID
- tool/parser version
- analysis timestamp
- original filename
- byte length
- byte-derived type
- SHA-256
- SHA-512
- legacy SHA-1 correlation hash
- structure metrics
- provenance / AI declarations
- extracted fields with source namespace
- parser limitations
- warnings
- derived-report hash when produced
PROFESSIONAL MODE
Public convenience and professional evidence handling remain intentionally different products.
The public lab is local-first and does not create institutional custody. Matter work requiring custody, full C2PA validation, validated external adapters, examiner attestation, controlled retention or expert support should move into MODLAN Secure Ops.
WHAT THIS IS
This lab shows raw data. It does not draw conclusions, interpret results, or tell you what a file means.
- Analysis runs locally in page script; no file bytes are sent anywhere
- The lab route is served with a content security policy that blocks outbound connections, so the page cannot transmit your file even if it were asked to
- There is no option to analyse a file by link or address, because that would move parsing onto a server
- There is no result storage, no shareable result link, and no delivery of a report by email
- There is no analytics, error reporting or third-party script on the page that could carry file data off it
- Reads embedded metadata from supported formats entirely inside your browser
- Does not upload your file, and the page is served so that it cannot transmit one
- Computes file hashes locally
- Reports field names and values as they are written, with the segment each came from
- Records parser version, limitations and warnings alongside the output
- Is a triage and orientation aid
WHAT METADATA CANNOT SHOW
The limits are the useful part.
Every field below is routinely read as proof of something it does not establish. We publish the limits of our own output because an examiner who cannot state them is not an examiner.
Capture and modification timestamps
“This proves when the photograph was taken.”
What it actually shows: A value a device or an application wrote into a field.
Many timestamp fields carry no time zone at all, so the same value means different moments depending on where the device was set. Device clocks drift, are set wrong, and are often never set. A file commonly carries several date fields that are not interchangeable and that software updates independently. And the profile date inside a colour profile is not a capture date, though it is frequently read as one.
GPS coordinates
“This proves where the photograph was taken.”
What it actually shows: A position the device recorded at some point in its handling of the file.
The coordinate describes where the camera believed it was, not where the subject was — a photograph of a building taken from across the road records the road. Satellite fixes indoors and in dense areas can be substantially wrong, and a device may write a last-known position rather than a current one. The field is also trivially editable.
Missing metadata
“The metadata was stripped, so someone is hiding something.”
What it actually shows: That the file as received does not carry those fields.
Absence is the normal result of ordinary handling. Messaging apps, social platforms, email clients and content management systems routinely strip or rewrite metadata on upload or send. A screenshot carries the screenshotting device's metadata, not the original's. Resaving in almost any editor discards most of it. Absence is weak evidence of ordinary transmission, not of concealment.
Any metadata field
“The metadata confirms the file is what it claims to be.”
What it actually shows: What is currently written in the file.
Metadata is editable with freely available tools, and an edit made competently leaves nothing in the metadata itself to find. What can sometimes be noticed is incompetent editing — internal inconsistency between fields, implausible software strings, structure that does not match the declared type. That is a reason to look harder, not a finding.
Software, creator tool and processing history
“This shows the image was edited in a particular program.”
What it actually shows: A string an application chose to write.
Many applications write nothing. Some write the name of a library rather than the application. Some preserve a prior tool's string through a later edit. The presence of an editing tool does not establish that image content was altered, and its absence does not establish that it was not.
Provenance credentials and AI declarations
“No credential means it is not AI generated. A credential means it is genuine.”
What it actually shows: Whether a declaration is present, and what it says.
Most capture devices and most applications do not write provenance credentials at all, so their absence says almost nothing about origin. Where a credential is present it attests to a signed history, not to the truth of what the picture depicts — a credentialed photograph of a staged scene is a credentialed photograph. Declarations can also be removed by ordinary handling, exactly like other metadata.
File hashes
“The hash proves the image is authentic.”
What it actually shows: That a specific sequence of bytes produces a specific digest.
A hash is an integrity check on the bytes that were handed to this page. It says nothing about where those bytes came from, whether they were altered before they arrived, or whether the depicted scene is real. It is useful for showing that two files are or are not the same, and for showing that a file did not change after a known point — not before one.
Structural observations and entropy
“The structure shows the file was manipulated.”
What it actually shows: Measurable properties of the container.
Unusual structure has mundane causes far more often than deliberate ones — an unfamiliar encoder, a truncated download, a format conversion, a device quirk. Structural anomalies indicate where an examiner should look. They are not a finding about content.
Files selected on a phone
“This is what is on my device.”
What it actually shows: What the browser handed this page.
Mobile browsers, and Safari on iOS in particular, may recompress, convert or strip a file before a web page ever sees it. The output may therefore describe a derived copy rather than the file as it exists on the device. For anything that matters, the file should be transferred off the device without re-encoding and examined from the transferred copy.
This lab's output
“I ran it through the lab, so it is documented.”
What it actually shows: What this page observed in a file at one moment, in your browser.
No custody is created here. The page receives a copy of unknown history from an unverified source, holds it only in your browser, and cannot attest to anything that happened before you selected it. Nobody at MODLAN saw the file, handled it, or can speak to it. That gap is the file's entire history, and no amount of engineering closes it.
TRIAGE VERSUS EXAMINATION
The difference is not tooling. It is custody and a person. A field value read from a file of unknown history is a starting point; an examiner working from controlled media under a documented method is a position that can be defended. We publish the first for free precisely because it is not the second.
- Runs in your browser on a copy you selected
- Sees field values and container structure
- Creates no custody and no record on our side
- Produces orientation, not findings
- Free, anonymous, and unsupervised
- Runs on media acquired under documented authority
- Includes content analysis, not only metadata
- Carries an acquisition record, hashing at acquisition and a custody log
- Is performed and signed by a named examiner
- Produces a documented method, stated limitations, and a witness who will explain it