Section: Justice & law Author: V Reading Length: ~27 min Sources and further reading: 22 items Topics: photography, evidence, criminal proceedings, EXIF, metadata, rekognice, expert, optics SEO / Working Title: Is a photograph evidence? When an image can deceive even without editing
Is a photograph evidence? The question sounds simple only until we notice that we are not comparing one thing. An image can be unedited and still deceive by angle. A hash can confirm a file and say nothing about the scene. EXIF can carry a date that is only the device clock. And identification from a photograph has legal safeguards that a viral “I recognise the perpetrator” does not. The following text is about deception without pixel edits. Generative forgery is a different dispute.
1. Three people over one photograph, three different conclusions
Imagine three people over one JPEG in a case file. The prosecutor says: the file is unedited, so it shows what happened. Defence counsel says: the crop is tight, the wide angle enlarges the foreground, and the camera clock is an hour off. The expert says: the copy matches, the metadata are readable, but I do not comment on guilt. A journalist on the network writes: “you can see it.”
Each is a little right. No one, however, is comparing the same layer. The prosecutor compares the admissibility of a means of evidence with the weight of a conclusion. Defence counsel compares geometry, frame and time with the caption. The expert compares file integrity and technical questions with a legal assessment that is not theirs to make [3][6]. The journalist compares the impression of the scene with the process of proof.
At first glance this is a dispute over whether a photograph is evidence. In fact it is a dispute over which question the photograph is to carry. Does it prove that the file exists? That it was unchanged after a certain moment? That a person was at the place? That they stood at a certain distance? That they did something intentionally? Each sentence needs a different support.
That is why they can all be partly right and a shared verdict still wrong. A photograph can be admissible and weak. It can be unedited and misleading. It can have the right hash and the wrong caption. It can have an EXIF time that does not match the civil time of the event. The first rule is therefore not: believe or do not believe the photo. It is: write one sentence that the image is supposed to prove.
2. An unedited photograph has at least six layers
One image looks like one thing. It is not. It is a chain of optics, frame selection, moment, metadata, compression and legal use. If we mix these layers, a false certainty appears: the pixels are unedited, so the caption is true; the metadata contain coordinates, so we know who stood there; the copy has the same hash, so the scene happened.
Six layers of an unedited photograph:
- Optics and geometry. Focal length, wide-angle distortion, space compressed by a telephoto lens, height of the standpoint and direction of view. Distance and size in the image are not a measuring tape.
- Frame selection. Crop, the boundary of the shot and what remained outside the field. A genuine fragment can support a different event from the one the caption claims.
- Time. The moment of the shutter, the device clock, the time zone, the GPS date and the file-system time. One date need not be the time of the act [8].
- Staging and choice of moment. Posing, rearranging objects and a decisive moment without a frame before and after. SWGDE separates staging from pixel manipulation [10].
- File chain. Original, export, JPEG compression, social network, downloaded copy and attachment in the file. Each step can change something else [9][11].
- Procedural use. An object or a document, an attachment to an inspection, identification from a photograph, expert examination or an investigative experiment [1][2][4][5].
This layering is not verbal ornament. It determines where the error arose and who can check it. If the time does not fit, we do not turn first to Photoshop. If the distance does not fit, we do not turn first to EXIF. If someone identifies a person from a photograph, we do not deal only with the sharpness of the face, but also with the procedure, the selection of comparison persons and whether the identifying person saw them in advance [2][18].
Illustrative scheme: The same JPEG can, in one layer, confirm a bit-for-bit match of a copy, in a second open a question of angle, and in a third serve only as an aid to inspection. None of these sentences, by itself, says what happened in the world.
3. The best evidence is the one whose deception you will see in time
With a photograph, authenticity is often what is sought. That is reasonable, but incomplete. Equally important is what deception the image can produce, whether it can be recognised, how much it costs to correct it and whether the conclusion can be taken back. A bad caption on an internal note is a cheaper error than publicly labelling a person as a perpetrator. A badly estimated distance at an inspection can change the whole meaning of a scene.
| Type of failure | What it looks like | How to test | What limits the harm |
|---|---|---|---|
| Angle and perspective | A genuine image enlarges the foreground, shrinks the background or distorts distance | Inspection sketch, scale, investigative experiment under § 104c | More standpoints, measurement on the spot, an expert [4][5][12] |
| Crop and moment | The event before, after or outside the field is missing | Original against crop, a series of images, a description of the source | Do not rewrite the caption into proof of the event |
| Metadata as the event | DateTimeOriginal or GPS are read as a certain time and place of the act | Compare OffsetTime, GPSDateStamp, the device clock and the file chain | Treat EXIF as a hypothesis, not as a judgment [8][10][13] |
| Staging | The scene was physically altered before exposure | Comparison with the scene, further shots, witnesses, an expert | Separate staging from pixel manipulation [10][14] |
| Compression and chain | An 8×8 artefact or missing EXIF is read as tampering or as purity | The original from the camera against a copy from the network | Keep the original file and describe the path [9][11] |
A photograph’s ability to show something is one axis. The second is the observability of the deception, the third the reversibility of the conclusion and the fourth the impact. Where the harm is low, a careful wording may suffice. Where guilt, identity or an interference with reputation is at stake, the question must be slowed down and split.
A hash verifies the file. It does not verify the scene.
— Jiný Kontext
4. A means of evidence is not a verdict
The Code of Criminal Procedure in § 89 paragraph 2 works with an open list: anything that can contribute to clarifying the matter may serve as evidence [1]. That sentence opens the door to a photograph. It does not say what weight a particular photograph has. It does not say that one JPEG is enough. Nor does it say that the court is to take over the caption with which the image arrived.
This is exactly where admissibility is confused with persuasiveness. A photograph can be a means of evidence because it can contribute to clarification. It does not follow that it has itself clarified the matter. It can show the position of an object, the state of a place, a person’s face, damage to an item or the sequence of events. Each of these conclusions, however, must be read together with the other evidence and with the question the photograph is meant to answer.
The Charter of Fundamental Rights and Freedoms holds the frame of a fair trial [7]. It is not a slogan that automatically wins for one side. It is a reminder that evidence is assessed in a process where the other side may object, an expert may explain the limits and the court must not mistake an impression for reasons.
The right sentence is therefore not: a photograph is, or is not, evidence. It is: a photograph is a possible means of evidence and its weight depends on what we infer from it, how it was made, how it was kept and how it fits the other findings.
That sentence matters outside the courtroom as well. Public debate often jumps from admissibility to a verdict in one movement. “It is in the file” is translated as “it is true”. “It is in the photo” is translated as “there is nothing to discuss”. Yet a file can also contain weak evidence that still has to be assessed. And a photograph can be the right beginning of proof, not its end.
Free evaluation of evidence is not free storytelling. It means that each means is read according to its content, origin, context and relation to the other evidence. An image without a scale can be strong for the colour of a car and weak for distance. An image with an exact time in the metadata can be strong for the file chain and weak for the time of the act if we do not know the device clock. This unevenness is why a photograph should not carry more sentences than it can actually bear.
5. A hash verifies the file. It does not verify the scene
A hash is useful because it holds a very narrow question. If we have the original file and a copy of it, a hash can show whether they are bit-for-bit the same. In forensic work that is an important foundation of integrity. It is not, however, proof that the scene in the world occurred as the caption claims.
SWGDE in the document Best Practices for Image Authentication version 2.0 of 20 November 2024, marked as a draft on the title page, distinguishes file integrity, image authentication and content analysis [10]. Integrity of a copy is the question whether particular data have changed. Image authentication examines whether the image shows signs of manipulation or of a virtual origin. Content analysis asks what the image captures. Those are three different jobs.
The same distinction is helped by C2PA and Content Credentials. They can carry claims about the origin and edits of a file. They are not proof of the truth of the scene. This technology belongs, in a broader sense, to the origin of the file, not to a verdict about the event [22]. For generative images that is an important contrast, but the core of this text is narrower: even a genuine file can carry a wrong conclusion.
So when someone says “the hash matches”, we hear a valuable sentence. We must not translate it as “it happened that way”. The correct translation is: this copy corresponds to this file. Only then do we ask whether the file arose from the given scene, whether the caption fits and whether the image can bear a legal conclusion.
The file chain therefore needs to be described in ordinary terms. Who had the original? When was the copy made? Did it pass through an application that changes resolution or metadata? Is the file in the case an original file, an export, a screenshot, or a version downloaded from the network? Each answer changes only a certain part of the certainty. A screenshot can be faithful to what someone saw on a display. It is not, however, the same as a file from the camera.
Here the difference between technical cleanliness and evidential meaning appears. Forensic work can say very precisely that a particular copy was not changed after it was secured. That is a firm step. It must not be used as a shortcut to a conclusion about the origin of the whole event. Integrity is the floor, not the ceiling.
6. A crop is a selection. It is not the whole event
A crop needs no manipulation of the truth of the pixel. It is enough to move the boundary of the shot. A genuine fragment remains, but it can show a different event from the whole. A hand in mid-movement can look like an attack. A group outside the frame can explain why a person is stepping back. An object on a table can matter precisely because a scale sits next to it, which the crop removed.
The published Jiný Kontext text on a genuine recording and a false conclusion treats a similar problem in video: a genuine clip can deceive when it is cut out of a wider context [21]. This is not a repeat of that article. This is a still image. With a photograph the crop is even harder, because we often do not see even a second before and after. We see only the boundary someone chose.
Pixel non-editing is therefore not completeness. If a photograph is to prove the presence of an object, a crop may suffice. If it is to prove an attack, intent or a sequence of events, one frame may be too narrow. The decisive question is: what remained outside the image and could change the meaning of what remained inside.
This is not a call to distrust every image. It is a call to precision. A photograph can be strong evidence of damage to a door. Weaker evidence of a motive. And very weak evidence of what happened two seconds before the exposure.
7. Angle and focal length are not a measuring tape
Optics has no morals. A wide angle from close up enlarges the foreground and widens the space. A telephoto lens flattens distance and brings the background closer. A camera at eye height creates a different relation between figures than a camera low to the ground. None of this is fraud. It is the way a lens turns space into a plane.
That is why it is dangerous to measure distance, the size of a crowd or the position of a hand from a single image without a scale. Hany Farid, in his work on photo forensics, describes that the geometry of an image can help, but needs support in a camera model, the scene and other data [12]. One photograph can open a question. It need not close it by itself.
The Code of Criminal Procedure knows inspection and the investigative experiment. A photograph at an inspection is, together with sketches and aids, to help produce a complete and faithful picture of the object of the inspection [4]. An investigative experiment under § 104c can test whether an event could have happened under certain conditions [5]. That is not editing the photo. It is a way to check angle, distance and the possibility of observation.
The practical question is therefore not whether the photograph “looks clear”. It is: do we know the focal length, the camera position, the height, the scale, the distances and the possibility of repeating the shot under comparable conditions? Without that, a metre-long conclusion from a photograph is more impression than evidence.
A simple illustration is enough. A person in the foreground of a wide-angle photograph can appear larger and closer than a person a step further away. Two people photographed with a telephoto lens can look as if they stood close together, even if there was open space between them. Both images can be genuine. Both can deceive if metres are inferred from them without more evidence.
That is why, in procedural use, a scale, a sketch and the possibility of returning to the place are valuable. Not because the photograph is suspect. Because the plane of the image itself does not contain all the information about the space. Where the point is only to document a damaged lock, a photograph may suffice. Where the point is the distance of a hand from an object or the visibility of a person from a certain place, space has to be brought back into play.
8. The camera clock is not the civil time of the act
EXIF can carry data about the file and the taking of the image. That is useful. It is not an independent time seal of the event. The DateTimeOriginal field refers to the time on the device. If the camera clock was wrong, the reading will be wrong too. If the time zone is missing, the figure can look more precise than it is.
CIPA gives the history of the Exif standard, including version 2.32 from 2019 and the newer version 3.1 in a 2026 translation [8]. These numbers measure versions of the specification, not the truth of a particular image. Newer metadata can work with fields for a time offset. Older files need not have them. And even with a new file, metadata are a record of a device, not a witness with a memory.
The difference between DateTime, DateTimeOriginal, GPSDateStamp, GPSTimeStamp and file-system time can be unpleasant for a layperson. But that is often where the meaning breaks. The civil time of the act is a question of the event. EXIF time is a question of the device. File-system time can arise during copying. GPS time may relate to a different record than the date visible to the user.
When these times diverge, that is not automatically proof of fraud. It is a reason to ask a question. The right sentence is: metadata support a hypothesis about the time of capture if we know the device clock, the zone, the origin of the file and the path of the copy.
9. GPS in EXIF is not proof of who stood at the lens
GPS in EXIF looks solid because it has numbers and a map. Here too the sentence needs to be narrowed. GPS coordinates in the metadata can say where the device, according to its own record, was located. They do not, by themselves, say who held the device, who is in the image, whether the coordinates were affected by the surroundings and whether the file was original.
GPS.gov states for GPS-enabled smartphones a typical accuracy of 4.9 metres in radius under open sky [13]. This number measures the horizontal accuracy of smartphones under good conditions. Accuracy worsens near buildings, bridges, trees, indoors and underground; the figure does not measure the truth of an EXIF record. GPS.gov also expressly distinguishes device accuracy from signal-in-space error, so the number cannot be transferred to an ordinary photograph without knowing the conditions and the receiver [13].
Three tests of metadata
The first test is temporal: does DateTimeOriginal fit OffsetTime and any GPS time? The second is of origin: is this an original from the device, or a downloaded copy from the network that may have stripped EXIF? The third is of meaning: even if the coordinate fits, which sentence is it supposed to prove? The presence of a device is not the same as the presence of a particular person in front of the lens.
SWGDE expressly notes that metadata can be limited, missing or altered [10]. Absence of EXIF is therefore not proof of purity or of fraud. Presence of EXIF is not the truth of the scene. It is a trace to be read with other traces.
The map impression in particular must be handled with care. Coordinates look like a pin stuck into reality. In fact they are a figure written into a file at a certain moment by a certain device. If a photograph circulates as a copy, it may not be clear whether the metadata come from the original, from an export or from later processing. If it was taken in poorer reception, accuracy can worsen. If the question is the identity of a person, even ideal coordinates do not settle it.
In practice, then, GPS helps mainly as a direction for verification. It shows a place to which an inspection, a witness or another record should look. It can support a conclusion if it fits the surroundings, the time and the other evidence. It is not itself to take over the role of the person who will explain who held the phone and why the image was taken.
10. Staging is not Photoshop
Deception can arise before the shutter. Someone rearranges objects, asks a person to repeat a gesture, moves a sign, removes a scale or chooses a moment that turns the whole situation into a different story. The pixels can then be unedited. The scene, however, is no longer a spontaneous record of the event.
SWGDE calls staging a physical alteration of the scene before exposure and distinguishes it from digital manipulation of the image [10]. That is essential. Detection of pixel interventions need not say anything about staging. Error Level Analysis or similar popular shortcuts can look for traces of file edits. They will not say who moved the glass before the image was taken.
News ethics has known this boundary for a long time. The NPPA code forbids the staging of news photographs and the alteration of events that are to be documented [14]. It is not a criminal norm for a Czech case file. It is a useful analogy: a journalistic photograph can deceive with a genuine image if the scene was created for the shot.
It does not follow that every pose is fraud. A wedding portrait is staged and no one presents it as proof of a brawl. The problem begins where a staged or selected moment is offered as a spontaneous proof of the event. Then it is not enough to examine pixels. The scene has to be examined.
11. Compression changes the file even without intent to deceive
JPEG is practical precisely because it makes the file smaller. Lossy compression, however, is not neutral. The ITU-T T.81 / ISO/IEC 10918-1 standard works, for baseline JPEG among other things, with blocks of 8×8 samples [9]. This number measures the technical block of compression, not proof of editing. Artefacts at edges, loss of detail or blocking can arise from an ordinary path of the file.
A social network, a messenger or a newsroom system can resample the image. It can discard metadata. It can change the resolution. It can compress again a file that is already compressed. When someone then sees a strange artefact, they cannot automatically make Photoshop of it. And when metadata are missing, they cannot automatically make that proof that someone tried to hide something.
ENFSI, in its 2017 manual for forensic enhancement of image and video, treats among other things how adjustments of brightness, contrast or gamma affect what an observer sees [11]. Enhancement can help read a detail. It does not itself mean a conclusion of guilt. A laboratory-improved image is a working output that must describe the method and the limit.
The right question is therefore not whether the file “looks compressed”. It is: do we have the original, do we know the path of the file and can we distinguish ordinary compression from a decisive change of content? Without that, a technical artefact becomes too fast a story.
The same holds for ordinary enhancement. Brightening a dark image can help read a registration plate or the outline of an object. It can at the same time change the impression of contrast, shadow or colour. If such an output is used procedurally, it must be clear what was done and why. An enhanced image is not a new witness. It is an aid that is to be returned to the original and to the method.
12. Identification from a photograph is not a search on the internet
Recognising a person from a photograph is a sensitive matter. The Code of Criminal Procedure in § 104b provides for identification and, for identification from a photograph, sets safeguards. The person to be identified is not to be shown in isolation, but among at least three other photographs of persons who do not differ from them markedly. The person carrying out the identification is to be heard in advance about the circumstances in which they perceived the person. The law also addresses the ban on showing the person to be identified in advance [2].
Three further images are a procedural minimum in Czech criminal proceedings, not a statistical certainty of a correct identification. This number measures the construction of the act, not the probability of error. If the selection of persons is bad, if the witness saw the photograph on the internet in advance, or if a feed becomes an informal “identification”, the procedural value falls.
Before identification from a photograph
Is the person among at least three other similar images? Was the identifying person heard in advance? Did they not see the person in the media, on a social network or in police material before the act? Is this not a situation in which comments on the internet first created a name and the photograph then only confirmed it?
The Supreme Administrative Court, in case law on identification in administrative-offence proceedings, works with an analogy to the safeguards under the Code of Criminal Procedure [18]. That is not a figure about error rates. It is a reminder that recognition from a photograph is not a free vote of an audience. It is a procedural act with rules, because human certainty can look solid even when it arose from a bad selection.
13. An expert clarifies expertise. They do not assess guilt
An expert is needed precisely where a lay view is not enough: authenticity of the image, metadata, compression, the possibility of a montage, geometry, light, scale or the file chain. The Code of Criminal Procedure in § 105 to 107 works with an expert and an expert opinion. An expert, however, is not to evaluate evidence or resolve legal questions [3]. The Act on Experts regulates their status and responsibility [6].
This is an important brake on both sides. When an expert says they found no signs of digital manipulation, that does not automatically mean that the act occurred. When an expert says the metadata are not reliable, that does not automatically mean that the photograph is a lie. The expert answers technical questions within the scope of the assignment. The court assesses the evidence as a whole.
Viral culture dislikes this boundary. It wants one authority that will say “genuine” or “fake”. Forensic work is often less spectacular. It will say: the copy matches, the EXIF is incomplete, the compression fits a path through a platform, the geometry from one image is not enough, staging cannot be addressed without a comparison with the scene.
That is its strength. Expertise is not to replace the judge. It is to narrow uncertainty, name the limits and prevent a lay impression of a straight line, a shadow or an angle from carrying more than it can bear.
14. An attachment to an inspection is not viral evidence
A photograph in a record of inspection has a different value from an image in a comment thread. The Code of Criminal Procedure in § 113 provides that photographs, sketches and other aids are attached to the record of inspection if that is needed for a complete and faithful picture of the object of the inspection [4]. Here the photograph is not a lonely image. It is part of an act.
Police and criminalistic literature on digital traces stresses documentation, securing and evaluation in a process, not only the visual impression of one copy [19]. At a scene it can matter what the order of the images was, the scale, the orientation, the description, who took the image, when, with what and in what connection. Without that, the same image can lose part of its meaning.
The same JPEG therefore proves a different thing in a different context. As an attachment to an inspection it can help towards a picture of the place. As an isolated screenshot on the network it can show only that someone shared a fragment. As a downloaded copy without metadata it can be a useful clue, but a weaker carrier of origin.
The point is not that an internet photograph is always worthless. The point is that the procedural frame adds information that the image itself does not carry. When the frame is missing, the viewer must not paint it in with certainty.
15. Generative forgery is a different article. Here a genuine angle is enough
After the arrival of image models it is tempting to turn every debate about a photograph into the question whether AI created it. This text stands elsewhere. The published Jiný Kontext article on the fact that a photograph is no longer enough on its own treats synthetic images, C2PA, detectors, watermarks and legal labelling [20]. Here the case is that the image was made by a camera and the pixels were not substantially changed.
This boundary matters. A deepfake detector will not verify that an unedited image correctly expresses distance. Content Credentials will not say that a crop left out a decisive person. A hash will not notice that the scene was arranged before exposure. Generative forgery is a hard problem. It is not, however, the only way an image deceives.
That also changes the editorial and legal reflex. On a suspicion of a synthetic image we ask about origin, manifest, model and labelling. On a genuine but deceptive image we ask about angle, time, frame, scene and process. Mixing these two questions means using the right tool on the wrong layer.
It does not follow that a generative image is not a risk. It follows that sometimes a much older problem is enough: the photographer stood close, the lens was wide, the surroundings stayed out of shot and the viewer completed the story.
16. A question of one sentence will carry more than a viral JPEG
The practical test is to be simple and safe. It does not teach how to edit EXIF, how to prepare a staging or how to circumvent identification. It teaches how to split the question.
What needs to be tested
First write one sentence: what is the photograph supposed to prove? The identity of a person, the presence of an object, a distance, a time, an intent and a sequence of events are different questions. One photograph can carry the first and not carry the second.
Then ask for the whole image, not only a crop. If a series of images exists, read it as a series, not as one pulled-out moment. For your own file compare the metadata: DateTimeOriginal, OffsetTime, GPSDateStamp and GPSTimeStamp. Treat them as a hypothesis and write down where the file comes from [8][10][15][16][17].
Then comes geometry. If distance, size or position is inferred from a photograph, look for a scale, focal length, standpoint and a possibility of verification on the spot. If identity is at stake, do not confuse recognition from a feed with identification under § 104b [2]. If it is a technical question, it belongs to an expert and to other evidence, not to a vote in the comments [3][6].
The result of the test is not to read “genuine” or “fake”. It is to read: the image supports this narrow sentence, it does not support this other sentence, and for this third one further support is needed.
This way of writing a conclusion is less attractive than a viral caption, but it better protects the sense of the evidence. “The photograph shows that the object was on the table” is a different sentence from “the photograph proves who put it there”. “The metadata correspond to the evening hours of the device” is a different sentence from “the act occurred at the given civil time”. “A witness identified the person in an identification procedure” is a different sentence from “the internet recognised the person”. When the sentences are not merged, a photograph can be useful without becoming a switch of truth.
17. The question is not whether the photo is genuine. It is what may follow from it
The most comfortable answer would be: an unedited photograph shows the truth. It would be short. And it would be dangerously wide. A photograph is strong precisely because it acts as a direct piece of the world. Yet between the world and the conclusion stand optics, frame, time, metadata, compression, scene and process.
The hidden cost is not Photoshop. It is a conclusion that an unedited fragment cannot bear. A person sees a gesture and supplies an intent. They see a GPS coordinate and supply a person. They see three faces in a selection and supply certainty. They see a block artefact and supply tampering. They see a hash and supply the truth of the scene.
An unedited image can deceive by angle, crop and time. Pixel cleanliness is not the truth of the event.
— Jiný Kontext
The question is therefore not whether the photo is genuine. It is: which one sentence is this image supposed to prove — and which layer, optics, crop, time, staging, file or process, that conclusion cannot bear.
Related texts in this series
- On the site: A photograph is no longer enough on its own — generative forgery. A genuine recording, a false conclusion — cropping of context in genuine video. This text is deception without edits.
- Deepfake: How to recognise a fake video or photograph?
- What to do when someone misuses your photograph…