Format and size
Format from magic bytes and real dimensions, including HEIF/HEIC images (from the ispe box).
Analysis
Image analysis
The Image analysis module breaks a photo down into its technical details: JPEG structure, quantization tables, ICC profile, complete metadata and C2PA Content Credentials, in a PDF report that embeds the image.
What it does
What the Image analysis module does
Container structure
Structure and parameters for JPEG (encoding, subsampling), HEIF/HEIC (iPhone photos), WebP, TIFF (pages/compression) and GIF (with animation: frames, loop, duration).
Image authenticity (anti-deepfake)
Forensic heuristics ELA and multi-quality JPEG Ghost, metadata coherence (editing software, impossible dates) and EXIF thumbnail vs image comparison: signs of retouching or splicing.
Quantization tables
DQT tables de-zigzagged in natural 8×8 order — useful to estimate compression and provenance.
ICC and Photoshop
ICC color profile (class, space, description) and Photoshop IRB blocks (resolution, copyright, URL).
Composite fields
Derived exiftool-style values: Light Value, 35 mm equivalent, field of view, hyperfocal, depth of field.
Metadata, C2PA and PDF
All EXIF/GPS/IPTC/XMP metadata, full C2PA and a PDF report with the embedded image.
Altitudes, with their reference
Every altitude declared in the file, each with its reference: sea level, ellipsoid, the drone's take-off point (DJI, Parrot). If the file does not declare the reference, that is said instead of making it up.
Coordinates in degrees and indicative place
Coordinates also in degrees, minutes and seconds and, next to them, the place name from OpenStreetMap, labelled as indicative, not from the file. To get it, and the map, the coordinates (not the image) are sent to OpenStreetMap; offline they simply do not appear.
C2PA: signature and binding to the file
The manifest is also checked for its binding to the image bytes; fixed a false “invalid signature” on C2PA 2.x manifests, such as Lightroom's.
Windows metafiles (EMF/WMF)
EMF and WMF, .emz and .wmz included, open here, also from “Open in” on email attachments. Records are read one by one in the isolated helper, without letting the system draw them, looking for the spots attacks use: WMF SETABORTPROC (CVE-2005-4560), printer escapes, colour profiles and colour spaces on network paths (NTLM credential leak), EMF+ and GDI comments, malformed records. Then the rebuilt image from the embedded bitmaps with its hash, the header, record types, texts and a clear outcome: no findings, medium findings, high findings.
Step by step
How it works
- Load an image: Probatio reads its header for structure, DQT, ICC and dimensions.
- It extracts all metadata, computes the Composite fields and analyses C2PA.
- It generates a PDF report with the image, per-section metadata and the quantization tables.
FAQ
Frequently asked questions
Which metadata does it extract from an image?
All EXIF, GPS, IPTC and XMP metadata, the ICC profile, Photoshop blocks and derived Composite fields (Light Value, 35 mm equivalent, depth of field).
Does it support HEIC and RAW formats?
Yes: besides JPEG/PNG/TIFF/WebP it handles HEIC/HEIF/AVIF, JXL and the main RAW formats (DNG, CR2, NEF, ARW).
What are the quantization tables for?
They reveal the level and "style" of JPEG compression, useful to estimate an image's provenance and spot recompressions.
Related modules