Case Study 2 — Consistent With Everything, Proof of Nothing

The mirror image of Case Study 1: not a recovery that gave a family back its photos, but a forensic opinion that should never have been written. An examiner declared a claimant's photograph fraudulent on the strength of a vivid ELA map and an EXIF GPS coordinate, and presented both as proof. On review, the "proof" dissolved — and the overstatement, not the underlying suspicion, is what failed.

Background

A homeowner files an insurance claim for storm damage to a roof, supporting it with several photographs. The carrier, suspecting the damage predates the policy or occurred elsewhere, retains an examiner to assess the photos. The examiner is competent with tools but in a hurry and has never been cross-examined. Working from the images as received by email, they run them through a free web ELA service, see bright regions in the result, read an EXIF GPS coordinate from one file, and write a confident report concluding two things: that the key photograph "has been digitally manipulated," and that its EXIF GPS shows it was "taken at a different property, in another county." On the strength of that report the carrier denies the claim. The homeowner's counsel retains an independent examiner, and the report comes apart along exactly the fault lines the chapter warns about.

What the review found

The suspicion was not unreasonable; the analysis was. Four overstatements did the damage.

Overstatement 1 — A glowing ELA map read as proof of editing. The report reproduced an ELA image with bright areas along the roofline, around a timestamp the homeowner's camera had burned into the corner, and across the high-contrast edges of the shingles, captioning it "regions of manipulation." On review, the independent examiner established what those bright regions actually were: high-contrast edges, overlaid text, and inherently sharp detail — all of which produce high error levels in a perfectly untouched image. Worse, the photo had been emailed and recompressed at least twice before the carrier received it, which raises the ELA floor everywhere and can mask real edits while creating the appearance of suspicious texture. ELA is a direction-finder; the report had treated it as a verdict.

WHAT THE REPORT SAID            WHAT ELA ACTUALLY SUPPORTS
"bright ELA regions      ->     "regions of high contrast, overlaid text, and edges
 prove manipulation"            show elevated error in ANY image; recompression in
                                transit raises the floor; ELA is a LEAD, not proof"

Overstatement 2 — An EXIF GPS coordinate asserted as the place of the photograph. The report quoted a latitude/longitude from the file's EXIF and stated flatly that the photo was taken at an address in another county. Two problems surfaced. First, EXIF GPS is "the location the device wrote into the file" — subject to a poor or assisted-GPS fix off by tens or hundreds of meters, to a stale last-known position, and to outright editing — never "where the subject stood." Second, and more damaging: the original camera file the homeowner produced from the phone had no GPS at all; the coordinate in the carrier's copy had appeared only after the image passed through a photo-sharing app, and could not be tied to the moment of capture. The report had built a geographic accusation on a field that the source image did not even contain.

Overstatement 3 — Timestamps never reconciled, sub-seconds never read. The report cited DateTimeOriginal as the capture time without noting it is a local clock with no zone, never compared it to GPSDateStamp/GPSTimeStamp (UTC) to check internal consistency, and never looked at SubSecTimeOriginal. Had it done so, it would have found the timestamps either consistent (undercutting the fraud theory) or inconsistent in a way that pointed at the in-transit re-encoding rather than at the homeowner — but it would have been a finding either way, instead of an assumption.

Overstatement 4 — The cheap, decisive checks skipped entirely. The examiner never ran exiftool -validate (which would have reported whether the file was structurally clean or showed edit anomalies), never compared the IFD1 thumbnail against the visible image (the single most direct manipulation tell, and the very artifact that did the work in Case Study 1), never examined the quantization tables to see whether they matched a camera pipeline or a desktop editor, and never sought any corroboration — no second photo in the series, no file-system times, no carrier metadata. A manipulation finding requires convergence across independent methods plus a plausible account of how the edit was produced; this report had one over-read test and a borrowed coordinate.

A fifth, quieter failure compounded the rest: the examiner worked from the images as emailed, never imaging the homeowner's phone, never hashing a working copy, and never establishing a chain of custody — so even the metadata they did cite could not be tied to a known source. The independent review's conclusion was deliberately modest and therefore unshakable: the available copies show no reliable evidence of manipulation; ELA responses are explained by edges, overlaid text, and in-transit recompression; the EXIF GPS is absent from the source image and cannot establish location; and the evidence is insufficient to determine the photograph's authenticity or place of capture either way. The carrier's denial — built entirely on the first report — was overturned, and the matter resolved against the carrier.

The bitter part is that a disciplined examination might have reached a defensible adverse finding, or at least a genuinely neutral one. The phone was available to image; the camera-original files, hashed and parsed with their timestamps reconciled and thumbnails compared, might have told a real story. Instead the examiner spent the case's credibility on a glowing picture and a coordinate that was not theirs to cite. The suspicion may even have been right — but a forensic opinion is not paid to be privately suspicious; it is paid to be defensible in public, and this one was not.

The analysis

  1. ELA is a direction-finder, never a verdict. Bright regions mark high contrast, overlaid text, and differing compression history — including innocent recompression in transit. "ELA proves this was edited" is a credibility-ending sentence; "ELA indicates regions warranting closer analysis" is the honest one.
  2. EXIF GPS is a recorded location, not a place a person stood — and may not even belong to the source file. It can be imprecise, stale, edited, or, as here, added downstream by an app and absent from the original. Assert it only with corroboration and only as "the location the device recorded."
  3. Reconcile the timestamps before you cite one. DateTimeOriginal is a local clock with no zone; compared against the UTC GPSDateStamp/GPSTimeStamp (and sub-seconds) it either corroborates or contradicts — but skipping the comparison turns a possible finding into an unsupported assumption.
  4. A manipulation finding requires convergence plus a mechanism. No single test — ELA, quantization, thumbnail, validate — proves a forgery. Agreement among independent tests and a plausible account of how the edit was made is the standard; one over-read test is not.
  5. Provenance and custody are not optional, even in a civil claim. Working from emailed copies, with no imaging, no hash, and no chain of custody, means even correct observations cannot be tied to a known source. A right suspicion, reported without discipline, is worth nothing.

Discussion questions

  1. Rewrite the report's two central claims — "the photograph has been digitally manipulated" and "it was taken at a different property" — into findings the independent examiner could not have impeached, preserving any genuine investigative value while stating the limits of ELA and EXIF GPS.
  2. The bright ELA regions fell on the shingle edges, a burned-in timestamp, and recompression noise. For each, explain in one sentence why it produces elevated error in a completely untouched image.
  3. The GPS coordinate was absent from the homeowner's source file and present only in a copy that had passed through a sharing app. Walk through how you would establish that fact — what you would acquire, hash, and compare — and why it is fatal to the report's location claim.
  4. ⭐ Contrast this case with Case Study 1: both examiners worked with photographs and their metadata, but one outcome was sound and the other collapsed. Identify the single habit most responsible for the difference, and draft a five-line pre-report checklist (drawn from this chapter) that would have caught all four overstatements here.
  5. Suppose a disciplined re-examination of the imaged phone did show genuine manipulation — a spliced-in region with a matching Software editor tag, a thumbnail mismatch, and double-compression statistics. Write the finding that convergence would support, and the sentence you would add stating what still cannot be concluded (for example, who made the edit, or intent).