Probatioby AcquisizioniForensi
IT EN
Download
Home / Guides / Image analysis

When the EXIF thumbnail betrays the photo

Image analysis 10 July 2026

Inside almost every photograph taken with a camera or a smartphone there is a second image: a thumbnail of a few dozen kilobytes, embedded in the EXIF metadata at the moment of capture. Many editors ignore it when they save. If the thumbnail no longer resembles the photo it travels with, someone modified that photo after the shutter closed — and forgot to tell the thumbnail.

What the EXIF thumbnail is

When a camera writes a JPEG, it embeds a block of EXIF metadata. Among the dates, the lens model and the exposure times, that block often contains a miniature copy of the image: typically 160×120 pixels, itself saved as a JPEG. Its purpose was to show a preview on the camera's display without decoding the whole file.

The thumbnail is generated from the original image, at the instant of capture. It is, in a sense, a photograph of the photograph, taken before anyone could lay hands on it.

Why it is evidence

An image editor that modifies the photo should regenerate the thumbnail too. Many do. Many others — hurried tools, mobile retouching apps, automated scripts — rewrite the pixels of the main image and leave the EXIF block untouched, thumbnail included.

The result is a photograph carrying its own previous version. If the person in the main image was erased, they may still be in the thumbnail. If the face was replaced, the thumbnail shows the original face.

The thumbnail is not proof of tampering. It is a witness: it says the image and its preview tell different stories. Why they do must be established by looking at them.

How Probatio compares the two images

Comparing them with a cryptographic hash is meaningless: they are two images of different resolution, their bytes bear no relation. What is needed is a perceptual comparison, one that ignores resolution and compression and looks at structure.

photo.jpg EXIF block thumbnail 160×120 main image dHash 8×8 pHash 8×8 distance dd distance dp consensus rule dd ≥ 18 AND dp ≥ 16 → mismatch anything else → coherent Both thresholds must be exceeded. One alone is not enough. Over 64 bits, dd ≥ 18 means similarity ≤ 71.9%; dp ≥ 16 means similarity ≤ 75.0%. The thresholds are conservative: a coherent thumbnail stays far below both. aHash takes no part in this check: the thumbnail is compressed differently, and its mean luminance is not comparable.
The check uses two independent algorithms and requires both to report a high distance. A conservative choice: it would rather miss a forgery than allege one that isn't there.

Probatio extracts the thumbnail from the EXIF block, decodes it, and computes on both images — thumbnail and main image — the dHash and pHash fingerprints at 8×8, that is 64 bits. It then measures the two Hamming distances.

The verdict comes by consensus: mismatch is declared only if the dHash distance is at least 18 and the pHash distance is at least 16. Translated into similarity, that means below 71.9% on the first and below 75.0% on the second.

Why two algorithms and not one? Because they have different blind spots, as we have seen. A local retouch sends dHash soaring while pHash stays calm; a crop does the opposite. Demanding that both shout means discarding the cases where only one of them is sensitive to an innocent operation.

How to read a mismatch

A mismatch does not say what changed, or when, or by whose hand. It says one thing only, but a heavy one: the embedded thumbnail and the visible image do not depict the same scene, within the tolerance of two independent perceptual algorithms.

From there the work begins, it does not end:

  1. Look at the thumbnail. Probatio extracts and displays it. Very often the difference is visible to the naked eye, and that is the evidence, not the distance in bits.
  2. Compare the metadata. The processing-software field, the modification dates, the presence of non-standard quantization tables tell the same story from another angle.
  3. Check the internal consistency of the EXIF block: impossible dates, absent GPS in a smartphone photo, a camera model that does not match the shooting parameters.

When a mismatch is innocent

There are perfectly lawful reasons for a thumbnail not to match. They must be excluded before writing anything in a report.

Crop or rotation Lawful operations that change the composition. The thumbnail keeps the original framing. By far the most frequent cause. Non-conforming thumbnail Some cameras write previews that are already cropped, or apply a colour profile only to the large image. Testable on other shots from the same body. Declared editing An image lawfully edited and presented as such does not become false because its thumbnail is old. The mismatch is consistent with the declaration. A mismatch is a question to put to the image, not an answer the image has already given. The absence of a mismatch, conversely, proves nothing: the thumbnail may have been regenerated.
Cropping is the most common benign cause. It is also the reason the check demands the consensus of two algorithms: pHash alone would flag it almost every time.

The decisive limitation

It must be said plainly, because it is where a badly written report breaks: the absence of a mismatch does not prove the image is authentic.

An editor that regenerates the thumbnail correctly — and professional software does — produces a modified image with a perfectly coherent thumbnail. Better still: anyone can delete the EXIF block entirely, and then there is no check to run at all.

The thumbnail check is asymmetric. When it finds something, it has found something. When it finds nothing, it has said nothing. That is exactly the asymmetry of many forensic indicators, and it belongs in a report in those words and no others.

In practice

  • The check runs automatically in Probatio's image analysis, alongside EXIF, GPS, DQT, ICC, C2PA and ELA.
  • The extracted thumbnail is displayed: always look at it before reading any number.
  • If there is a mismatch, seek corroboration elsewhere: software metadata, quantization tables, Error Level Analysis. One indicator does not make an expert report.
  • If there is no mismatch, do not write that the image is intact. Write that the thumbnail check found no divergence — which is a different sentence.

Keep reading