filegrail v0.40.3 · investigation report

target
/tmp/filegrail-example/case
profile
/tmp/filegrail-example/home · external
scanned
2026-09-19 07:50 CEST · 11 files · 4.3 KB
options
--pivots
report
/tmp/filegrail-example/example-report.html

Summary

11files scanned6 types · 4.3 KB1with originXDG attribute9with metadataOOXML properties · EXIF · PDF Info14pivots4 in more than one file · 3 in both corpora42relationshipsevidence-backed graph edges1need review1 conflicts · 3 fields2no evidence foundsee coverage before reading as absence2/9trace stores foundhistory begins 2026-04-03
origin · how it got heremetadata · what it says about itselfactivity · what happened to it here! needs review

Key findings

7
F01
Declared AI-generated source
generated
#005 render_final.png
Evidence
Content Credentials
Generator
OpenAI Media Service API
Software agent
gpt-image 2.0
Source type
generated by an AI model
Signature
not verified
F02
Conflicting evidence
conflicts
Files
1
#001 invoice_2214.pdf
See conflicts.
F03
Same-second creation cluster
same second
Timestamp
2026-03-30 14:05:00 UTC
Files
3
Bytes
identical
#002 annex_a.docx #003 annex_b.docx #004 survey_report.docx
F04
Shared author
author
Author
R. Mazur
Files
3
Evidence
OOXML properties · creator
3 files
#002 annex_a.docx #003 annex_b.docx #004 survey_report.docx
F05
Shared author
author
Author
k.dabrowa
Files
3
Evidence
OOXML properties · lastModifiedBy
3 files
#002 annex_a.docx #003 annex_b.docx #004 survey_report.docx
F06
Shared camera body
camera
Serial
JX41-0099231
Files
3
Evidence
EXIF · BodySerialNumber
3 files
#006 harbour_01.jpg #007 harbour_02.jpg #008 harbour_03.jpg
F07
No supporting trace found
no trace
Files
2 / 11
2 files
#010 contacts.csv #011 notes.txt
This does not mean the files were never downloaded or transferred. Available trace history begins on 2026-04-03.
See evidence coverage.

Evidence coverage

2 of 9 trace stores
sourcestatecoverageearliest record
Chromium family downloadsfound2 records across 1 of 1 profile2026-04-03
Firefox downloadsnot foundno profile found·
XDG origin attributereadablewritten by KDE tools and wget --xattr, but not by Firefox·
Mounted Zone.Identifierreadableuser.Zone.Identifier on an NTFS mount·
Shell historynot foundno history file found·
Recent documentsfound3 files in recently-used.xbel2026-04-09
macOS quarantine databasenot foundno database in this profile·
Deleted filesnot foundno trash directory·
Windows Recent shortcutsnot foundno Recent folder in this profile·
Torrent client storesnot foundno client store found·
Sync client foldersnot foundno client configuration found·

Observable trace history begins on 2026-04-03.

Timeline

10 · dated records in 9 files
  1. Monday
  2. written#001 invoice_2214.pdfXMP embeddedAdobe Illustrator 27.2
  3. 3 months later
  4. Wednesday
  5. written#001 invoice_2214.pdfPDF Info embeddedLibreOffice 7.6 (created in Writer)
  6. 47 days later
  7. Monday
  8. written#002 annex_a.docxOOXML properties embeddedMicrosoft Office Word 16.0000
  9. written#003 annex_b.docxOOXML properties embeddedMicrosoft Office Word 16.0000
  10. written#004 survey_report.docxOOXML properties embeddedMicrosoft Office Word 16.0000
  11. Wednesday
  12. written#009 press_brief.pdfPDF Info embeddedSkia/PDF m124
  13. Sunday
  14. captured#006 harbour_01.jpgEXIF embeddedNIKON CORPORATION COOLPIX P950
  15. captured#007 harbour_02.jpgEXIF embeddedNIKON CORPORATION COOLPIX P950
  16. Monday
  17. captured#008 harbour_03.jpgEXIF embeddedNIKON CORPORATION COOLPIX P950
  18. 3 months later
  19. Wednesday
  20. produced#005 render_final.pngContent Credentials embeddedOpenAI Media Service API (gpt-image 2.0)

Files

11 · showing 11
#pathtypesizemodifiedevidenceoriginfindings & pivots
#001!documents/invoice_2214.pdfPDF600 B2026-02-11 17:40:02·F02 C01
#002documents/annex_a.docxDOCX854 B2026-04-07 11:20:04·F03 F04 F05 Organisations · People
#003documents/annex_b.docxDOCX854 B2026-04-07 11:20:04·F03 F04 F05 Organisations · People
#004documents/survey_report.docxDOCX854 B2026-04-07 11:20:04·F03 F04 F05 Organisations · People
#005photos/render_final.pngPNG406 B2026-04-09 22:07:19·F01
#006photos/harbour_01.jpgJPEG140 B2026-04-07 11:20:04·F06
#007photos/harbour_02.jpgJPEG140 B2026-04-07 11:20:04·F06
#008photos/harbour_03.jpgJPEG140 B2026-04-08 09:02:11·F06
#009downloads/press_brief.pdfPDF81 B2026-04-01 09:15:00XDG attribute file-attributeDomains · URLs
#010documents/contacts.csvCSV300 B2026-04-02 12:00:00·Domains · Emails · Organisations · URLs
#011downloads/notes.txtTXT38 B2026-03-01 08:00:00·

Relationships

42 · graph edges
100%
has identifierhas identifierhas identifierhas identifierhas identifierhas identifierhas identifierhas identifierhas identifierhas identifierhas identifierhas identifierreferrerhas identifierhas identifierorigin URLhas identifierauthorhas identifierhas identifierauthorauthorhas identifierhas identifierauthorauthorhas identifierhas identifierauthorURL hostURL hostcamera modelcamera bodycamera modelcamera bodycamera modelcamera bodyemail domainemail domainemail domainURL hostURL host#010 contacts.csvfile · /tmp/filegrail-example/case/documents/contacts.csv · 11 relationships#009 press_brief.pdffile · /tmp/filegrail-example/case/downloads/press_brief.pdf · 6 relationshipsk.dabrowaperson · k.dabrowa · 6 relationships#002 annex_a.docxfile · /tmp/filegrail-example/case/documents/annex_a.docx · 4 relationships#003 annex_b.docxfile · /tmp/filegrail-example/case/documents/annex_b.docx · 4 relationships#004 survey_report.docxfile · /tmp/filegrail-example/case/documents/survey_report.docx · 4 relationshipsNorthwind Survey Ltdorg · Northwind Survey Ltd · 4 relationshipshttps://portal.example.org/…URL · https://portal.example.org/press/ · 4 relationshipsNIKON CORPORATION COOLPIX P…camera model · NIKON CORPORATION COOLPIX P950 · 3 relationshipsJX41-0099231camera body · JX41-0099231 · 3 relationshipsR. Mazurperson · R. Mazur · 3 relationshipsexample.orgdomain · example.org · 3 relationshipsportal.example.orgdomain · portal.example.org · 3 relationshipssocial.example.netdomain · social.example.net · 3 relationshipshttps://files.example.org/p…URL · https://files.example.org/press/brief.pdf · 3 relationships#006 harbour_01.jpgfile · /tmp/filegrail-example/case/photos/harbour_01.jpg · 2 relationships#007 harbour_02.jpgfile · /tmp/filegrail-example/case/photos/harbour_02.jpg · 2 relationships#008 harbour_03.jpgfile · /tmp/filegrail-example/case/photos/harbour_03.jpg · 2 relationshipsexample.comdomain · example.com · 2 relationshipsfiles.example.orgdomain · files.example.org · 2 relationshipsk.dabrowa@example.orgemail · k.dabrowa@example.org · 2 relationshipsoffice@example.comemail · office@example.com · 2 relationshipspress@example.orgemail · press@example.org · 2 relationshipshttps://social.example.net/…URL · https://social.example.net/@kdabrowa · 2 relationshipshttps://social.example.net/…URL · https://social.example.net/@rmazur · 2 relationships

Relationship evidence

fromrelationtoevidence
file#002 annex_a.docx
author1 occurrence
personk.dabrowa
1 evidence item
source
document-metadata
place
OOXML properties · lastModifiedBy
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#002 annex_a.docx
author1 occurrence
personR. Mazur
1 evidence item
source
document-metadata
place
OOXML properties · creator
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#003 annex_b.docx
author1 occurrence
personk.dabrowa
1 evidence item
source
document-metadata
place
OOXML properties · lastModifiedBy
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#003 annex_b.docx
author1 occurrence
personR. Mazur
1 evidence item
source
document-metadata
place
OOXML properties · creator
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#004 survey_report.docx
author1 occurrence
personk.dabrowa
1 evidence item
source
document-metadata
place
OOXML properties · lastModifiedBy
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#004 survey_report.docx
author1 occurrence
personR. Mazur
1 evidence item
source
document-metadata
place
OOXML properties · creator
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#006 harbour_01.jpg
camera body1 occurrence
camera bodyJX41-0099231
1 evidence item
source
device-metadata
place
EXIF · BodySerialNumber
corpus
metadata
category
metadata
match
embedded
time
2026-04-05T08:12:44Z
file#007 harbour_02.jpg
camera body1 occurrence
camera bodyJX41-0099231
1 evidence item
source
device-metadata
place
EXIF · BodySerialNumber
corpus
metadata
category
metadata
match
embedded
time
2026-04-05T08:13:01Z
file#008 harbour_03.jpg
camera body1 occurrence
camera bodyJX41-0099231
1 evidence item
source
device-metadata
place
EXIF · BodySerialNumber
corpus
metadata
category
metadata
match
embedded
time
2026-04-06T17:41:09Z
file#006 harbour_01.jpg
camera model1 occurrence
camera modelNIKON CORPORATION COOLPIX P950
1 evidence item
source
device-metadata
place
EXIF · Make + Model
corpus
metadata
category
metadata
match
embedded
time
2026-04-05T08:12:44Z
file#007 harbour_02.jpg
camera model1 occurrence
camera modelNIKON CORPORATION COOLPIX P950
1 evidence item
source
device-metadata
place
EXIF · Make + Model
corpus
metadata
category
metadata
match
embedded
time
2026-04-05T08:13:01Z
file#008 harbour_03.jpg
camera model1 occurrence
camera modelNIKON CORPORATION COOLPIX P950
1 evidence item
source
device-metadata
place
EXIF · Make + Model
corpus
metadata
category
metadata
match
embedded
time
2026-04-06T17:41:09Z
emailk.dabrowa@example.org
email domain1 occurrence
domainexample.org
1 evidence item
source
derived
place
email host
corpus
derived
emailoffice@example.com
email domain1 occurrence
domainexample.com
1 evidence item
source
derived
place
email host
corpus
derived
emailpress@example.org
email domain1 occurrence
domainexample.org
1 evidence item
source
derived
place
email host
corpus
derived
file#002 annex_a.docx
has identifier3 occurrences
orgNorthwind Survey Ltd
2 evidence items
source
document-metadata
place
OOXML properties · Company
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
occurrences
2
source
document-metadata
place
OOXML properties · note
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#002 annex_a.docx
has identifier1 occurrence
personk.dabrowa
1 evidence item
source
document-metadata
place
OOXML properties · lastModifiedBy
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#003 annex_b.docx
has identifier3 occurrences
orgNorthwind Survey Ltd
2 evidence items
source
document-metadata
place
OOXML properties · Company
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
occurrences
2
source
document-metadata
place
OOXML properties · note
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#003 annex_b.docx
has identifier1 occurrence
personk.dabrowa
1 evidence item
source
document-metadata
place
OOXML properties · lastModifiedBy
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#010 contacts.csv
has identifier1 occurrence
domainexample.com
1 evidence item
source
content
place
content · row 4 · column 2
corpus
content
file#010 contacts.csv
has identifier2 occurrences
domainexample.org
2 evidence items
source
content
place
content · row 2 · column 2
corpus
content
source
content
place
content · row 3 · column 2
corpus
content
file#010 contacts.csv
has identifier1 occurrence
domainportal.example.org
1 evidence item
source
content
place
content · row 4 · column 3
corpus
content
file#010 contacts.csv
has identifier2 occurrences
domainsocial.example.net
2 evidence items
source
content
place
content · row 2 · column 3
corpus
content
source
content
place
content · row 3 · column 3
corpus
content
file#010 contacts.csv
has identifier1 occurrence
emailk.dabrowa@example.org
1 evidence item
source
content
place
content · row 3 · column 2
corpus
content
file#010 contacts.csv
has identifier1 occurrence
emailoffice@example.com
1 evidence item
source
content
place
content · row 4 · column 2
corpus
content
file#010 contacts.csv
has identifier1 occurrence
emailpress@example.org
1 evidence item
source
content
place
content · row 2 · column 2
corpus
content
file#010 contacts.csv
has identifier1 occurrence
orgNorthwind Survey Ltd
1 evidence item
source
content
place
content · row 4 · column 1
corpus
content
file#010 contacts.csv
has identifier1 occurrence
URLhttps://portal.example.org/press/
1 evidence item
source
content
place
content · row 4 · column 3
corpus
content
file#010 contacts.csv
has identifier1 occurrence
URLhttps://social.example.net/@kdabrowa
1 evidence item
source
content
place
content · row 3 · column 3
corpus
content
file#010 contacts.csv
has identifier1 occurrence
URLhttps://social.example.net/@rmazur
1 evidence item
source
content
place
content · row 2 · column 3
corpus
content
file#004 survey_report.docx
has identifier3 occurrences
orgNorthwind Survey Ltd
2 evidence items
source
document-metadata
place
OOXML properties · Company
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
occurrences
2
source
document-metadata
place
OOXML properties · note
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#004 survey_report.docx
has identifier1 occurrence
personk.dabrowa
1 evidence item
source
document-metadata
place
OOXML properties · lastModifiedBy
corpus
metadata
category
metadata
match
embedded
time
2026-03-30T14:05:00Z
file#009 press_brief.pdf
has identifier1 occurrence
domainfiles.example.org
1 evidence item
source
xdg-xattr
place
XDG attribute · url
corpus
metadata
category
origin
match
file-attribute
file#009 press_brief.pdf
has identifier1 occurrence
domainportal.example.org
1 evidence item
source
xdg-xattr
place
XDG attribute · referrer
corpus
metadata
category
origin
match
file-attribute
file#009 press_brief.pdf
has identifier1 occurrence
URLhttps://files.example.org/press/brief.pdf
1 evidence item
source
xdg-xattr
place
XDG attribute · url
corpus
metadata
category
origin
match
file-attribute
file#009 press_brief.pdf
has identifier1 occurrence
URLhttps://portal.example.org/press/
1 evidence item
source
xdg-xattr
place
XDG attribute · referrer
corpus
metadata
category
origin
match
file-attribute
file#009 press_brief.pdf
origin URL1 occurrence
URLhttps://files.example.org/press/brief.pdf
1 evidence item
source
xdg-xattr
place
XDG attribute · url
corpus
metadata
category
origin
match
file-attribute
file#009 press_brief.pdf
referrer1 occurrence
URLhttps://portal.example.org/press/
1 evidence item
source
xdg-xattr
place
XDG attribute · referrer
corpus
metadata
category
origin
match
file-attribute
URLhttps://files.example.org/press/brief.pdf
URL host1 occurrence
domainfiles.example.org
1 evidence item
source
derived
place
URL host
corpus
derived
URLhttps://portal.example.org/press/
URL host1 occurrence
domainportal.example.org
1 evidence item
source
derived
place
URL host
corpus
derived
URLhttps://social.example.net/@kdabrowa
URL host1 occurrence
domainsocial.example.net
1 evidence item
source
derived
place
URL host
corpus
derived
URLhttps://social.example.net/@rmazur
URL host1 occurrence
domainsocial.example.net
1 evidence item
source
derived
place
URL host
corpus
derived

Investigative pivots

14 · 4 in more than one file
#typevaluecorpusfilestimeswhere (sample)found in
P01OrganisationsNorthwind Survey Ltdboth410annex_a.docx · OOXML properties · note, Company
annex_b.docx · OOXML properties · note, Company
contacts.csv · content · row 4 · column 1
survey_report.docx · OOXML properties · note, Company		#002 annex_a.docx ×3 #003 annex_b.docx ×3 #004 survey_report.docx ×3 #010 contacts.csv
P02Peoplek.dabrowametadata33annex_a.docx · OOXML properties · lastModifiedBy
annex_b.docx · OOXML properties · lastModifiedBy
survey_report.docx · OOXML properties · lastModifiedBy		#002 annex_a.docx #003 annex_b.docx #004 survey_report.docx
P03Domainsportal.example.orgboth22contacts.csv · content · row 4 · column 3
press_brief.pdf · XDG attribute · referrer		#009 press_brief.pdf #010 contacts.csv
P04URLshttps://portal.example.org/press/both22contacts.csv · content · row 4 · column 3
press_brief.pdf · XDG attribute · referrer		#009 press_brief.pdf #010 contacts.csv
valuecorpusfilestimeswhere (sample)found in
example.orgcontent12contacts.csv · content · row 2 · column 2, row 3 · column 2#010 contacts.csv ×2
portal.example.orgboth22contacts.csv · content · row 4 · column 3
press_brief.pdf · XDG attribute · referrer		#009 press_brief.pdf #010 contacts.csv
social.example.netcontent12contacts.csv · content · row 2 · column 3, row 3 · column 3#010 contacts.csv ×2
example.comcontent11contacts.csv · content · row 4 · column 2#010 contacts.csv
files.example.orgmetadata11press_brief.pdf · XDG attribute · url#009 press_brief.pdf
valuecorpusfilestimeswhere (sample)found in
https://portal.example.org/press/both22contacts.csv · content · row 4 · column 3
press_brief.pdf · XDG attribute · referrer		#009 press_brief.pdf #010 contacts.csv
https://files.example.org/press/brief.pdfmetadata11press_brief.pdf · XDG attribute · url#009 press_brief.pdf
https://social.example.net/@kdabrowacontent11contacts.csv · content · row 3 · column 3#010 contacts.csv
https://social.example.net/@rmazurcontent11contacts.csv · content · row 2 · column 3#010 contacts.csv
valuecorpusfilestimeswhere (sample)found in
k.dabrowa@example.orgcontent11contacts.csv · content · row 3 · column 2#010 contacts.csv
office@example.comcontent11contacts.csv · content · row 4 · column 2#010 contacts.csv
press@example.orgcontent11contacts.csv · content · row 2 · column 2#010 contacts.csv
valuecorpusfilestimeswhere (sample)found in
Northwind Survey Ltdboth410annex_a.docx · OOXML properties · note, Company
annex_b.docx · OOXML properties · note, Company
contacts.csv · content · row 4 · column 1
survey_report.docx · OOXML properties · note, Company		#002 annex_a.docx ×3 #003 annex_b.docx ×3 #004 survey_report.docx ×3 #010 contacts.csv
valuecorpusfilestimeswhere (sample)found in
k.dabrowametadata33annex_a.docx · OOXML properties · lastModifiedBy
annex_b.docx · OOXML properties · lastModifiedBy
survey_report.docx · OOXML properties · lastModifiedBy		#002 annex_a.docx #003 annex_b.docx #004 survey_report.docx

Conflicts

1
C01
#001 invoice_2214.pdf · PDF Info and XMP disagree on CreationDate / ModDate · Creator · CreationDate detail
CreationDate / ModDate
CreationDate
2026-02-11 17:40:02 UTC
ModDate
2026-02-11 15:33:15 UTC
ModDate is 2 hours earlier than CreationDate
Creator
PDF Info
Writer
XMP
Adobe Illustrator 27.2
CreationDate
PDF Info
2026-02-11 17:40:02 UTC
XMP
2025-11-03 09:22:00 UTC
XMP is 100 days earlier than PDF Info

File detail

9 · files with evidence
#001documents/invoice_2214.pdf !600 B · PDF F02 C01
origin
No origin trace found in the evidence sources available for this scan.
metadata
PDF Info embedded
Software
LibreOffice 7.6 (created in Writer)
Created
2026-02-11 17:40:02 UTC
Producer
LibreOffice 7.6
Creator
Writer
CreationDate
D:20260211184002+01'00'
ModDate
D:20260211163315+01'00'
metadata
XMP embedded
Software
Adobe Illustrator 27.2
Created
2025-11-03 09:22:00 UTC
xmp:CreatorTool
Adobe Illustrator 27.2
xmp:CreateDate
2025-11-03T10:22:00+01:00
activity
No local activity trace found.
related
  • PDF Info and XMP disagree on CreationDate / ModDate · Creator · CreationDate C01
#002documents/annex_a.docx854 B · DOCX F03 F04 F05
origin
No origin trace found in the evidence sources available for this scan.
metadata
OOXML properties embedded
author R. Mazur; last edited by k.dabrowa; company Northwind Survey Ltd
read from member docProps/core.xml, docProps/app.xml
Software
Microsoft Office Word 16.0000
Author
R. Mazur
Created
2026-03-30 14:05:00 UTC
Note
author R. Mazur; last edited by k.dabrowa; company Northwind Survey Ltd
creator
R. Mazur
lastModifiedBy
k.dabrowa
created
2026-03-30T14:05:00Z
Application
Microsoft Office Word
AppVersion
16.0000
Company
Northwind Survey Ltd
activity
No local activity trace found.
related
#003documents/annex_b.docx854 B · DOCX F03 F04 F05
origin
No origin trace found in the evidence sources available for this scan.
metadata
OOXML properties embedded
author R. Mazur; last edited by k.dabrowa; company Northwind Survey Ltd
read from member docProps/core.xml, docProps/app.xml
Software
Microsoft Office Word 16.0000
Author
R. Mazur
Created
2026-03-30 14:05:00 UTC
Note
author R. Mazur; last edited by k.dabrowa; company Northwind Survey Ltd
creator
R. Mazur
lastModifiedBy
k.dabrowa
created
2026-03-30T14:05:00Z
Application
Microsoft Office Word
AppVersion
16.0000
Company
Northwind Survey Ltd
activity
No local activity trace found.
related
#004documents/survey_report.docx854 B · DOCX F03 F04 F05
origin
No origin trace found in the evidence sources available for this scan.
metadata
OOXML properties embedded
author R. Mazur; last edited by k.dabrowa; company Northwind Survey Ltd
read from member docProps/core.xml, docProps/app.xml
Software
Microsoft Office Word 16.0000
Author
R. Mazur
Created
2026-03-30 14:05:00 UTC
Note
author R. Mazur; last edited by k.dabrowa; company Northwind Survey Ltd
creator
R. Mazur
lastModifiedBy
k.dabrowa
created
2026-03-30T14:05:00Z
Application
Microsoft Office Word
AppVersion
16.0000
Company
Northwind Survey Ltd
activity
No local activity trace found.
related
#005photos/render_final.png406 B · PNG F01
origin
No origin trace found in the evidence sources available for this scan.
metadata
Content Credentials embedded
generated by an AI model; signature not verified
read from object caBX chunk
Software
OpenAI Media Service API (gpt-image 2.0)
Created
2026-07-15 00:00:00 UTC
Note
generated by an AI model; signature not verified
claim_generator
OpenAI Media Service API
softwareAgent
gpt-image 2.0
digitalSourceType
http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia
actions
c2pa.created
activity
No local activity trace found.
related
  • Declared AI-generated source F01
#006photos/harbour_01.jpg140 B · JPEG F06
origin
No origin trace found in the evidence sources available for this scan.
metadata
EXIF embedded
Software
NIKON CORPORATION COOLPIX P950
Created
2026-04-05 08:12:44 UTC
Make
NIKON CORPORATION
Model
COOLPIX P950
DateTimeOriginal
2026:04:05 08:12:44
BodySerialNumber
JX41-0099231
activity
No local activity trace found.
related
#007photos/harbour_02.jpg140 B · JPEG F06
origin
No origin trace found in the evidence sources available for this scan.
metadata
EXIF embedded
Software
NIKON CORPORATION COOLPIX P950
Created
2026-04-05 08:13:01 UTC
Make
NIKON CORPORATION
Model
COOLPIX P950
DateTimeOriginal
2026:04:05 08:13:01
BodySerialNumber
JX41-0099231
activity
No local activity trace found.
related
#008photos/harbour_03.jpg140 B · JPEG F06
origin
No origin trace found in the evidence sources available for this scan.
metadata
EXIF embedded
Software
NIKON CORPORATION COOLPIX P950
Created
2026-04-06 17:41:09 UTC
Make
NIKON CORPORATION
Model
COOLPIX P950
DateTimeOriginal
2026:04:06 17:41:09
BodySerialNumber
JX41-0099231
activity
No local activity trace found.
related
#009downloads/press_brief.pdf81 B · PDF
origin
XDG attribute file-attribute
URL
https://files.example.org/press/brief.pdf
Referrer
https://portal.example.org/press/
metadata
PDF Info embedded
Software
Skia/PDF m124
Created
2026-04-01 09:15:00 UTC
Producer
Skia/PDF m124
CreationDate
D:20260401091500+00'00'
activity
No local activity trace found.

Report notes

Categories

origin
how it arrived here
metadata
what the file says about itself
activity
what happened to it here

Match basis

embedded
file bytes
file-attribute
filesystem metadata for this file