Sherlock Forensics · Metadata Inspector
The thumbnail remembers what the picture forgot
Cameras write a small preview into the EXIF. Editors are supposed to redraw it when they save. A great many of them do not, which leaves a picture of the image as it was before somebody changed it, sitting inside the file.
Embedded thumbnail · 160 × 120
Full-size image · the picture you see
Thumbnail hash
Image hash
Bits that disagree
Both pictures reduced to sixty-four bits
Comparing two images pixel by pixel is useless here: the thumbnail is tiny and heavily compressed, so it never matches exactly. What is compared instead is shape.
Each image is squashed to a nine-by-eight grid of grey values. Then, across each row, every pixel is compared with the one to its right: brighter or darker. Sixty-four comparisons, sixty-four bits. That is a difference hash, and it survives the size gap and the compression because it records relationships between areas rather than absolute values.
Count how many of those sixty-four bits disagree, and you have a number.
0 to 10
The same picture. Compression noise accounts for a handful of bits.
11 to 19
Inconclusive. Heavy thumbnail compression can reach here on its own.
20 to 64
Different pictures. Something changed after the thumbnail was written.
Tick an orientation tag rotated one of them above and watch the distance jump without anything having been edited. That is why the comparison is run against all four rotations of the thumbnail and the closest is taken, an orientation tag applied to one image and not the other must not be allowed to manufacture a finding.
The evidence points one way only
A thumbnail that disagrees with the image is strong: it is a picture of the file's earlier state, still inside the file.
A thumbnail that agrees proves almost nothing. Any editor that redraws the thumbnail produces agreement, and most modern ones do.
This asymmetry has to be stated every time the result is reported. "The thumbnail matches" is not a clean bill of health, and an examiner who presents it as one will be taken apart on it. The tool's own wording says so on the face of the finding rather than leaving it to be remembered.
A finding about the technique itself
While building this, a dozen camera photographs and scans on a working machine were checked for an embedded thumbnail by walking the TIFF structure directly. Every one of them had none: the pointer to a second image directory was zero in all cases, including recent iPhone photographs.
So the technique is worth running and worth understanding, but on a modern corpus it will frequently have nothing to work with. That is not a failure of the check. It is a fact about the files, and it is more useful to know it in advance than to discover it in the middle of a matter.
What to reach for instead
When there is no thumbnail, the encoder fingerprints answer the neighbouring question , whether a file was re-encoded and by what, from the compression tables, which every JPEG must carry.