Metadata is the record a file keeps about itself. For a photo it can say which device took it, when and where, and which program saved it. It is also easy to strip and easy to change, so read what remains and what is missing together.
EXIF holds the device make and model, capture time, exposure settings and GPS location; XMP can hold the editing software and edit history. AI generators sometimes leave the prompt or the tool's name. Origma reads these fields and records in the evidence ledger which way each of them points.
Most messengers and social networks remove location and device data and recompress photos on upload, to protect privacy. Email attachments and original downloads from cloud storage often keep metadata. So the same photo can carry very different evidence depending on how it reached you.
A capture time that does not match the file's save time or time zone, or an editing program that does not fit the camera, gives you something to examine. A location different from the claimed place needs checking too. A wrong device clock or ordinary retouching can create the same traces, though.
Anyone can edit metadata with a tool, so its presence does not prove a photo real and its absence does not prove it fake. Origma never calls a file AI just because metadata is missing. Results are probabilistic assessments, not certified forensic reports or legal proof — read them with provenance signatures and pixel analysis.
This is general guidance, not legal advice. A scan result is a probabilistic assessment, not proof.