File and metadata forensics in Barcelona
I analyse documents, photos, videos and audio to establish when they were created, with what, and whether they have been modified, and I explain clearly how far that conclusion goes.
Member of AEPEJU (no. 1556). Barcelona and across Spain.
Indicative fee: from €290. See prices
What do metadata say, and why are they not enough on their own?
Metadata are data about a file: creation and modification dates, the software used, author, device, coordinates or versions. They are very useful, but they can be changed in seconds with free tools.
That is why a good analysis never stops at reading one field. It compares several sources that should be consistent with each other: the file's internal metadata, the file system timestamps, the internal structure of the format and the context in which it appeared. Where they do not match is where manipulation shows up.
Documents and PDFs: versions, dates and software
A PDF or an Office document keeps more than you can see: the software and version that produced it, successive saves, objects added later or remnants of an earlier version. That makes it possible to detect, for example, an amount or a date changed on an original document, or a contract that claims to be old but was produced with software that did not exist at the time.
In Spanish civil proceedings, if the authenticity of an electronic document is challenged, whoever submitted it can request an expert comparison or any other useful evidence (article 326 of the Spanish Civil Procedure Act, LEC). That is the job.
Photos, video and audio: editing and recompression
Every time an image, a video or an audio file is edited and saved again it leaves traces: changes in compression, in the file structure, in the noise or in the camera or recorder metadata. I compare the file with what the device that supposedly produced it should generate.
I also analyse photos of sites or places to date and locate them, and WhatsApp voice notes against the record kept by the app itself.
Deepfakes: what can be said today
You can look for technical signs of manipulation or AI generation, but no tool gives an infallible answer today. Be wary of anyone promising a percentage of certainty without explaining how they got it.
What I do is combine analysis of the file, consistency of the content and provenance, and state the conclusion with the degree of certainty the data actually allow. An honest report with clear limits holds up better against the opposing expert than a categorical but fragile one.
Comparison with the original and chain of custody
The key question is usually whether the original exists: the file as it came out of the device, not a copy forwarded on WhatsApp or downloaded from social media, which has already lost much of its metadata. Whenever possible I work on the original or on a forensic copy with a SHA-256 hash and an RFC 3161 timestamp, following UNE 71506, ISO/IEC 27037 and RFC 3227.
What you receive
- A signed expert report with the technical tests carried out, what they show and what they do not.
- A hash table of the files analysed and the chain of custody record.
- Testimony in court if needed, quoted from day one.
Frequently asked questions
Common questions about this kind of report.
Can a file's creation dates be altered?
Yes, and easily. That is why I do not rely on a single field: I compare internal metadata, the file system and the format structure, which should be consistent with each other.
How do you prove a PDF was tampered with?
By looking for inconsistencies between its content, its internal structure, the software that produced it and its successive saves. Sometimes remnants of the earlier version appear beneath the modified one.
Can a deepfake be detected?
Sometimes, through technical indications, but no tool is infallible. The report states the conclusion with the degree of certainty the data allow.
Is a copy enough, or is the original needed?
The original is always better. A forwarded copy or one downloaded from social media loses metadata and limits what can be said, although it is sometimes still useful.
What happens if a document I submitted is challenged?
You have to prove its authenticity, usually with an expert report (article 326 LEC). The sooner the original is preserved with its chain of custody, the better.
Do you analyse WhatsApp photos or audio?
Yes. I compare the file with the record kept by the app on the phone, which shows whether it is the one that was actually sent or received.
Tell me about your case
Free 30-minute consultation and a free quote within 24 working hours.