Your Photo Edits Can Leave a Trail. A Royal Photo Showed How

On 10 March 2024, Mother’s Day in the UK, Kensington Palace released the first official photograph of Catherine, Princess of Wales, since her surgery in January: a picture of her with her three children, taken by Prince William. Within hours, the Associated Press, Reuters and AFP issued “kill notices” telling the newsrooms they supply to stop using it. “At closer inspection, it appears that the source has manipulated the image,” the AP notice said.

The pixels raised the alarm. An AP spokesperson pointed to “an inconsistency in the alignment of Princess Charlotte’s left hand”, and Reuters picture editors said part of her sleeve did not line up. The file backed them up. BBC Verify found that the image’s metadata recorded two saves in Adobe Photoshop on an Apple Mac, the first on 8 March at 21:54 GMT and the second on 9 March at 09:39. The next day Catherine apologised: “Like many amateur photographers, I do occasionally experiment with editing.”

The case holds two lessons for checking any photo. Edits leave traces in two places, the file and the picture, so read both. And neither trace is guaranteed: the metadata in the Reuters copy of the same photo held no information about Photoshop saves, and said that version was created at 11:34 on 10 March. Which copy you examine decides what you can see.

1. Step 1Get the most original copy you canMetadata lives inside the file, and social platforms usually strip it on upload, so a screenshot or a copy saved from a feed has often lost it. Ask for the original file, or download it rather than screenshotting it. Why shared photos lose their metadata explains the mechanism.
2. Step 2Read the Software fieldThe EXIF standard’s Software tag names the software or firmware used to generate the image, and Adobe’s XMP format adds CreatorTool, the first tool known to have created the file. A name such as Adobe Photoshop shows the file went through an editor. A bare version number is often the camera’s own firmware, which proves nothing.
3. Step 3Compare the datesDateTimeOriginal records when the picture was taken, while the tag the standard calls DateTime records when the file was last changed. A later change date means the file was saved again after capture. That can be an innocent rotation or export, so treat it as a question, not an answer. Which date is which has its own guide.
4. Step 4Look for an edit history or a labelAdobe’s XMP standard includes a History list: actions such as “saved”, each with a time and the software that did it. Google Photos marks AI edits with IPTC metadata, and phones that support Content Credentials attach a signed record of how the image was made.
5. Step 5Find other copiesA reverse image search can surface an earlier, larger or less edited version. TinEye can sort matches by “most changed”, which it says is usually the most heavily edited copy, and by biggest image. Google’s About this image shows when Google first saw a version and, where known, how the image was made or edited.
6. Step 6Inspect the pixelsZoom in on edges, hands, hair, text and straight lines. Look for things that should line up and do not, patterns that repeat exactly, and shadows that disagree. The sections below show what to look for and where each method misleads.

Adobe’s own specification is frank about the history field: it is meant to describe the steps “at an abstract level”, and it “is not intended to be an exhaustive keystroke or other detailed history.” A history that lists two saves tells you the file was worked on twice, not what changed.

The camera fields once embarrassed a phone maker. In 2016 Huawei posted a sunrise portrait to promote the dual Leica cameras of its P9 phone, with a caption saying they made taking photos in low light “a pleasure”. The EXIF data, which Google+ kept, named a Canon EOS 5D Mark III with a 70–200 mm lens, a setup Android Police priced at about 4,500 dollars. Huawei removed the image and said it had been “professionally taken while filming a Huawei P9 advert”, adding: “It was never our intention to mislead.”

To read these fields yourself, the built-in viewers on Windows and Mac cover the basics but not an edit history. ExifTool, a free command-line tool, shows everything: exiftool -Software -CreatorTool -ModifyDate -DateTimeOriginal -HistoryAction -HistoryWhen -HistorySoftwareAgent photo.jpg prints the editing traces in one go. The best EXIF viewers compares the other options.

Every EXIF field can be rewritten, and removing all of them takes one command. Google, which labels AI edits in metadata, warns on its own help page that credit and digital source type details “can be modified with image generation and editing tools, so it may not be accurate.” A photo with a spotless file may simply have been cleaned. The wider method is in how to verify if a photo is real.

Not every glitch is an edit, either. Hany Farid, an image-analysis expert, told BBC Verify the royal photo could be a “bad job of photoshopping”, but that the flaws also fitted a camera feature that takes a rapid series of group shots and composites them, which “sometimes makes mistakes”. Google’s Best Take and Add Me blend photos taken close together in time, and Google says it marks such blends in the file’s IPTC metadata.

And edited does not mean fake. AP’s standards allow minor edits such as cropping, toning and colour adjustment “when necessary for clear and accurate reproduction”, as long as they “maintain the authentic nature of the photograph”. The useful question is what changed, not whether anything did.

• Edges that break. The cuff of Charlotte’s jumper was incomplete, and the base of a wooden door near Louis’s legs had what looked like a jagged edge, BBC Verify found.
• Smudges and halos. There was a blur on Catherine’s right hand and in the hair on the right of her face.
• Things out of line. The zip on Catherine’s jumper did not line up, and neither did parts of her hair.
• Colours in the wrong place. A green blur around Charlotte’s right knee did not match the grey paving behind it.
• Repeats and shadows. A clone tool copies pixels, so a cloned patch repeats exactly, and a pasted object can cast a shadow that disagrees with the rest of the scene. Reading shadows is a skill of its own.

Forensic tools can help, with care. Error level analysis, offered by the FotoForensics site, re-saves a JPEG and shows which areas change most, and an edited region can stand out. FotoForensics itself notes that scaling a picture down, or saving it from an Adobe product, brightens edges on its own, so the result needs interpretation. Treat it as a pointer to where to look, not proof.

Comparing two versions beats inspecting one, because differences stand out side by side. TinEye’s “most changed” and “biggest image” sorts are built for this, and the TinEye alternatives guide covers where other engines do better. Away from a computer, you can also run a reverse image search on your phone.

Apple’s iPhone guide puts it plainly: All Photos Data, available with AirDrop only, shares “the original file with edit history and metadata”, and the recipient can view and modify the current version. That is handy between your own devices and risky with anyone else, because the original file still contains whatever you cropped or cleaned up. Even without it, Apple notes, a shared photo carries metadata such as the date and time, location, device and captions.

Apple’s newest verification mode has a similar catch. Apple warns that sharing a Reference mode photo before its reference image has been developed “may include sensitive information about your device, such as the serial number, and the full image frame regardless of the zoom setting at capture.” Before posting anything you edited to hide something, remove the metadata and check the result.

Apple Reference Image, introduced with the iPhone 18 Pro in September 2026, keeps what Apple calls a secure digital negative alongside the normal photo. Once it is developed, you can tap between the two, and Apple says any edits, such as a crop, a colour adjustment or a change made with generative AI, will be visible in the comparison. It is off by default, works only with the Main camera, cannot capture in the EU, and costs storage: about 35 to 40 MB extra for an undeveloped 48 MP photo.

Google took a different route. Its Pixel 10 phones, announced in 2025, were the first to build Content Credentials, the C2PA industry standard, into every photo from the Pixel Camera app. Google Photos adds credentials when such a photo is edited, and to any image edited with its AI tools, and shows them in the About panel. Apple’s security team argues that systems based on C2PA certify edits only from the point the credentials are attached, which is why its own design signs the pixels on the sensor.

For everything else, and that is still most photos, the six checks above are what you have. Missing credentials prove nothing: most photos in circulation were never given any.

Photo analysis on geospys.com comes with GeoSpy Premium, a subscription of 7.99 US dollars a week or 29.99 US dollars a year (₺389 or ₺1,460 in Türkiye), unlimited under fair use and cancellable at any time. See the yearly plan. It estimates a place, not whether a photo was edited, and the GeoSpy iPhone app has a free trial.