AuditImage
Guides

XMP and edit history

Adobe's XML metadata. It records the creating tool, document IDs and every edit, and is the main clue to which software a picture has been through.

What XMP is

XMP (Extensible Metadata Platform) was introduced by Adobe in 2001 and later standardised as ISO 16684. It is a block of RDF/XML embedded in a JPEG APP1 segment (starting with http://ns.adobe.com/xap/1.0/), a PNG iTXt chunk (keyword XML:com.adobe.xmp), a WebP XMP chunk, or the equivalent place in TIFF, PDF and PSD.

XMP organises fields by namespace. The common ones:

  • xmp: basics: CreatorTool, CreateDate, ModifyDate, MetadataDate.
  • xmpMM: media management: DocumentID, InstanceID, OriginalDocumentID, DerivedFrom, History.
  • dc: Dublin Core: title, description, creator, rights.
  • photoshop: Photoshop-specific: DateCreated, ColorMode, ICCProfile.
  • Iptc4xmpExt: IPTC extension: DigitalSourceType, where the AI-generated marker lives.
  • exif: and tiff:: XMP mirrors of EXIF fields.

Reading the edit history

xmpMM:History is an ordered list. Each stEvt event records:

<stEvt:action>saved</stEvt:action>
<stEvt:instanceID>xmp.iid:1a2b...</stEvt:instanceID>
<stEvt:when>2026-09-01T10:23:45+08:00</stEvt:when>
<stEvt:softwareAgent>Adobe Photoshop 27.2 (Windows)</stEvt:softwareAgent>
<stEvt:changed>/</stEvt:changed>

Actions include created, saved, converted, derived and edited. Chaining the softwareAgent values gives you the picture's software pipeline, which AuditImage lists directly under findings.

The three IDs

  • OriginalDocumentID: assigned at creation, never changes.
  • DocumentID: changes on every "save as" into a new document.
  • InstanceID: changes on every save.

DerivedFrom records which IDs this document was derived from. A picture genuinely edited in Photoshop has DerivedFrom and History together.

What AuditImage checks

  • CreatorTool names an EXIF-preserving editor such as Photoshop or Lightroom, but the file has no EXIF at all: the classic "strip, then relabel".
  • DerivedFrom without History: a derivation claim with no process.
  • EXIF Software and XMP CreatorTool differ: normal after several edits, shown as information only.
  • Iptc4xmpExt:DigitalSourceType containing trainedAlgorithmicMedia: IPTC's standard AI marker, counted as an AI trace.
  • EXIF capture time and XMP create time more than a minute apart: could be a time zone, could be forgery.

Manual check

exiftool -XMP:all -a -G1 photo.jpg
exiftool -b -XMP photo.jpg > packet.xmp    # dump the raw packet

The "XMP" section on AuditImage expands to the full raw packet at the bottom.