Why Metadata Alone Is Not Enough for File Authenticity

Metadata is useful, but it is not a complete authenticity strategy.

Filenames, timestamps, EXIF fields, camera details, creator names, and platform records can help explain where a file came from. They can also be stripped, rewritten, lost during export, or separated from the file.

When the question is whether an image or PDF has changed since signing, metadata alone is too fragile.

What metadata can tell you

Metadata can describe:

• when a file was created
• which device or software produced it
• image dimensions
• camera settings
• location fields, if present
• author or document fields
• platform processing history

This context can be valuable. But it is not the same as verifying that a signed visual file still matches its signed state.

How metadata breaks down

Metadata often changes during normal workflows:

• messaging apps strip EXIF fields
• websites recompress images
• PDF tools rewrite document properties
• export workflows change timestamps
• privacy tools remove location data
• screenshots create new files with new metadata

None of these events necessarily proves fraud. They simply show why metadata is not a stable authenticity layer by itself.

WaveSign's verification package

WaveSign uses a different model. It embeds an invisible signal into the signed media and creates a separate sig.json verification file.

Later verification requires:

1. signed media
2. matching sig.json
3. same secret key

This package is stronger than relying on metadata alone because the verification check is tied to the signed output, not just descriptive fields around it.

Metadata and WaveSign can work together

This does not mean metadata is useless. A strong evidence workflow can preserve both:

• original file metadata
• signed WaveSign output
• matching sig.json
• storage logs
• access logs
• case or claim identifiers

WaveSign adds a file-authentication layer. It does not replace all recordkeeping.

What to say publicly

Safe claim:

"WaveSign helps verify whether a signed image or PDF still matches its signed state using an invisible signal, verification metadata, and the same key."

Avoid:

"WaveSign makes metadata unnecessary."

Also avoid:

"The proof is fully inside the file."

That is not accurate for the current wrapper flow because sig.json is required.

Bottom line

Metadata is context. Verification is a check. For visual authenticity workflows, keep metadata when it helps, but use a tamper-evident verification package when file integrity matters.