Skip to content

ForensicLens v1.1.0 — Cross-Field Metadata Checks

Choose a tag to compare

View all tags
@Deipedra34 Deipedra34 released this 23 Aug 20:01
· 11 commits to main since this release
v1.1.0
7d56b6c

ForensicLens v1.1.0

Extends the metadata analyzer with cross-field consistency checks — comparing related EXIF fields against each other instead of flagging anomalies field-by-field, since inconsistencies between fields are a stronger tampering signal than any single field alone.

New checks

  • GPS timestamp vs. DateTimeOriginal — flags a mismatch beyond a configurable tolerance
  • DateTimeOriginal / DateTimeDigitized / ModifyDate ordering — flags a ModifyDate earlier than DateTimeOriginal, or a significant gap between DateTimeOriginal and DateTimeDigitized
  • Partial metadata stripping — flags GPS data present without camera Make/Model (or vice versa)
  • GPS altitude consistency — flags a negative altitude without a matching "below sea level" reference
  • Editing-software conflict — flags known editing-software signatures co-occurring with an otherwise "untouched" camera-original metadata set

Configuration

All new thresholds are configurable via forensiclens.yaml — no hardcoded values.

Notes

Each rule produces its own named anomaly with a human-readable explanation, so the suspicion score and report can attribute findings to the specific rule that fired.

See the README for the full configuration reference.

Assets 2
Loading