How is digital forensics different from AI detection?

AI detection answers one part of "who made this". Digital forensics also weighs provenance signatures, metadata, recompression and local edits, and hashes and chain of custody. Origma judges these separately and puts them in one report.

Can the report be used as evidence in court?

Whether it can be submitted and how much weight it carries depends on the procedure and the people judging it. The report is reproducible material for that judgement, not legal advice or a certified expert opinion.

Can it analyse a file I received through a messenger?

Yes, but with far less to go on. Messengers and social networks strip metadata and signatures and recompress the file, so whenever possible get the original from the person who made it.

Is the file kept on the server?

File bytes are deleted as soon as the analysis finishes; only the hash and the report remain. If a file must not leave your computer, use the Windows app for Pro and higher paid members, which analyses everything on the PC.

Digital forensics: forgery, tampering and evidence analysis for files

Digital forensics asks, with evidence, when and how a file was made and whether it has been touched since. Now that AI-made photos and voices turn up as evidence too, what matters is not whether something looks real but which signals say so — checked one by one and written down.

What gets examined: provenance, metadata, pixels, hashes

First, whether there is a C2PA provenance signature, whether it is valid, and whether its issuer is on a trust list. Next, the metadata such as EXIF and XMP, the capture device and any marks a generator left behind. On the pixel side, JPEG quantization tables, recompression traces (ELA), noise and frequency patterns reveal re-saving and local edits. Finally the file hash is recorded so anyone can later confirm it is the same file.

Origma's three questions and the evidence ledger

Origma splits the work into three questions: how likely AI made the file, whether its origin can be proven, and whether it shows tampering or editing. The three are judged separately, never blended, and every signal behind a verdict goes into the evidence ledger with its direction (towards AI or human), strength, analysis level and raw location. Evidence that cuts against the verdict is kept too, so you can see exactly what could be disputed.

Handling it as evidence

Keep the file exactly as you received it and avoid copies that came back through a messenger: those lose metadata and signatures and are recompressed, which removes most of the evidence. The report records the file hash, the analysis time and the engine and signature-database versions, so the same versions reproduce the same result. Exporting a signed PDF also shows whether the report was changed afterwards.

What it is not: not a certified lab report, not proof

Origma's results are probabilistic assessments, not legal proof, and they do not replace a report from a certified forensic laboratory. When evidence is thin it returns "inconclusive" as a real result, and it states its weak spots openly, such as AI fills that remove part of a photo. For court cases, disciplinary decisions or anything with similar weight, treat the report as material for judgement and get expert and legal review.

Frequently asked

How is digital forensics different from AI detection?: AI detection answers one part of "who made this". Digital forensics also weighs provenance signatures, metadata, recompression and local edits, and hashes and chain of custody. Origma judges these separately and puts them in one report.
Can the report be used as evidence in court?: Whether it can be submitted and how much weight it carries depends on the procedure and the people judging it. The report is reproducible material for that judgement, not legal advice or a certified expert opinion.
Can it analyse a file I received through a messenger?: Yes, but with far less to go on. Messengers and social networks strip metadata and signatures and recompress the file, so whenever possible get the original from the person who made it.
Is the file kept on the server?: File bytes are deleted as soon as the analysis finishes; only the hash and the report remain. If a file must not leave your computer, use the Windows app for Pro and higher paid members, which analyses everything on the PC.