What Every Investigator Should Check First When Looking at a Shared Image
The first glance is where most mistakes happen.
When someone sends you an image - a screenshot, a photo or a meme - the natural instinct is to look at it, not through it. But in investigative image work, the initial step is less about what the image shows and more about the invisible traces that surround it.
If you rush to interpret the content without examining the fundamentals, you risk missing the very clues that make the difference between a false lead and a breakthrough.
Trust Nothing at Face Value
Every image is a story - but not always the story you’re told. It might have been resized, cropped, filtered, or lifted from a stock site. It might have been stripped of metadata or edited to remove context.
Your job as an investigator is to start neutral. Before asking “What does this picture mean?” ask “Where did it come from?” and “What has been done to it since it was captured?”
This mindset mirrors the approach we used in our article on archiving micro-moments. Just like screenshots need context to make sense, images need an understanding of their chain of custody - what’s original and what’s been tampered with.
Start with the File, Not the Pixels
If possible, get the original file - not just a social media preview. Many modern platforms compress or strip images, which means crucial information (like metadata or original resolution) is often lost.
The first checks should be:
File name: Is it a random string like “IMG_4721.JPG” or something descriptive, like “final_edited_version.png”? Both can be revealing.
File format: JPEG vs. PNG vs. WebP can tell you where it might have been shared or edited.
File size: A 100 KB image with suspiciously high resolution often means aggressive compression - possibly re-shares or edits.
You don’t need complex tools to see these basics. Just checking file properties can reveal discrepancies between what’s claimed and what’s true.
Zoom Into the Small Details
Once you know what file you’re working with, then you look at the pixels.
Are the shadows consistent?
Does the lighting match the supposed time or place?
Are there signs of editing, like blurred edges or mismatched textures?
Are there repeating patterns that might indicate cloning tools?
Small anomalies - a clock in the background, signage in a language that doesn’t match the story, or reflections in a window - often tell you more than the main subject.
OSINT practitioners call this the “quiet layer” of an image. The background, the margins, the elements nobody bothered to edit because they assumed nobody would look.
Check for Stock or Staged Imagery
Fake personas and coordinated disinformation campaigns love using stock photos. A reverse image search across multiple engines (Google Images, Yandex, TinEye) is often the fastest way to confirm if a supposedly “personal” photo is in fact a press asset or a staged model shot.
If you find the image in an online catalogue or a marketing campaign, that’s not just proof of unauthenticity - it’s a clear sign of intent. Someone wanted to pass off a polished, impersonal asset as something real.
Pay Attention to the Chain of Sharing
The path an image took before it reached you is almost as important as the image itself. Was it posted on a social platform, then downloaded and re-uploaded? Has it been screen-shotted multiple times (look for cropping artifacts or interface elements)? Did it come with an attached caption that appears copy-pasted from elsewhere?
Every layer of resharing strips or adds something - metadata, resolution, context. Tracking these layers is part of the investigative work. It’s about seeing the history in the image, not just the image itself.
The First Pass Is About Eliminating Assumptions
Your initial analysis isn’t about proving the story in the photo. It’s about eliminating assumptions:
Is this really original?
Was it captured when and where they say it was?
Does it have traces of prior use online?
Are there inconsistencies between its visual elements and its supposed origin?
These first steps are often enough to separate authentic captures from staged or manipulated ones. They set the tone for deeper investigation - like metadata analysis, geolocation, or content comparison.