Why a photo from WhatsApp or Facebook shows signs of processing (and why that isn't proof of editing)

Someone sends you a photo on WhatsApp, or you save one from Facebook, and a photo-checking tool says it shows signs of processing. That can sound like an accusation. Usually it isn't.

Most messaging and social apps change every photo that passes through them. This page explains what they do, why it leaves traces, and why those traces say nothing on their own about whether someone edited the picture.

What sharing apps do to a photo

To save bandwidth and storage, apps like WhatsApp, Facebook, Messenger and Instagram typically:

• Re-encode the image. They decode your photo and save it again as a new JPEG, usually at a lower quality setting.
• Resize it. Large phone photos are often scaled down to a smaller size.
• Strip metadata. Camera make and model, capture time, location and other EXIF fields are usually removed.
• Drop Content Credentials. If the original carried a signed C2PA record, it is usually lost, and even if kept it would no longer match the re-encoded file.
• Convert formats. An iPhone HEIC photo usually arrives as a JPEG.

Exact behavior varies by app, version, settings (for example a "send in HD" option) and platform, and it changes over time. Treat any specific number you read about a given app as a snapshot, not a rule.

What that leaves behind

Each of those steps can leave measurable signs:

• JPEG compression tables and settings that don't match what the camera would have written.
• Evidence of double compression, where an image was compressed once by the camera and again by the app.
• A file with no camera metadata at all, or with a structure typical of a particular app.
• Image dimensions that match an app's standard sizes rather than a camera sensor.

A forensic tool sees these and correctly concludes that the file was processed after it was created. That is a true statement about the file.

Processing is not content modification

Here is the key distinction. There are three different questions:

1. Was the file processed? Re-saved, recompressed, resized, converted.
2. Was the picture's content changed? Something added, removed or altered in what the image shows.
3. Was a specific part changed? This dent, this face, this receipt total.

A WhatsApp re-encode answers yes to the first question and nothing at all about the second and third. Every photo shared through the app goes through the same steps, whether or not anyone touched the content.

That is why PIT keeps processing and content modification as separate answers. For a typical re-encoded file, PIT's Alteration answer reads SIGNS OF PROCESSING AFTER CREATION, and the explanation names re-encoding as the likely reason, not editing. PIT does not report that the content was modified unless it has evidence for that specifically.

What you lose, and what is still possible

Re-encoding also removes evidence that could have helped. Once metadata and Content Credentials are gone, it is much harder to establish where a photo came from or whether it is the camera's original. So for a re-shared file, several of PIT's answers will often be unknown. That is honest, not a failure: the evidence simply isn't in the file anymore.

Missing metadata is not a sign of fakery. Missing processing evidence is not proof that nothing changed. Both are limits of what one file can show.

If the photo matters, get a better copy

If you are relying on a photo for an insurance claim, a deposit dispute, a loan file, a legal matter, or a story, the shared copy is the weakest version you can have. Better options:

• Ask for the original file, sent as a document or file rather than as a photo, so the app doesn't re-encode it.
• Ask for it by email or a file-sharing link instead of a chat app.
• Use a secure request link. With PIT you can send a link by email or text; the person uploads the original or takes the photo live with their camera, and PIT records the chain of custody.

FAQ

Does "signs of processing" mean the photo was edited?

No. It means the file was changed as a file, for example re-saved or resized. Sharing apps do this to every photo.

Why did the metadata disappear?

Most sharing apps remove it, partly for privacy. Its absence doesn't suggest anything about the content.

Can PIT tell if a WhatsApp photo was also edited before it was sent?

Sometimes evidence survives, but often it doesn't. Where the evidence can't support a conclusion, PIT says "unknown" rather than guessing.

Is a screenshot better or worse?

Usually worse. A screenshot is a new image of the screen and keeps almost none of the original evidence.

Does PIT store my photo?

No. Photos are analyzed in an encrypted, isolated environment and not stored.