XMP (Extensible Metadata Platform)
Definition
An Adobe-defined metadata format stored as an XML packet embedded in image files. XMP carries a software history field (xmpMM:History) that editing applications append to when they process a file. A populated XMP history block is direct structural evidence of post-capture software processing.
- Field
- Image and multimedia metadata forensics
- Defined by
- Adobe
- Storage format
- XML packet embedded in the image file
- Key forensic field
- xmpMM:History, appended by editing software
- Significance
- Populated history block is structural evidence of post-capture processing
Common questions
Can XMP history data be stripped to hide that an image was edited?+
Yes, resaving through a tool that does not preserve XMP, or deliberately stripping metadata, can remove the history block, which is why the absence of XMP history is not proof an image is unedited, only that this particular evidence trail is gone.
How does XMP metadata differ from EXIF for forensic purposes?+
EXIF is typically written by the capturing camera and covers settings like exposure and GPS at capture time, while XMP is written and appended to by editing software afterward, making XMP history more directly useful for tracing the post-capture processing chain.
What does an examiner check beyond the mere presence of an XMP history block?+
They look at the specific software agents and actions logged, such as which application opened and saved the file and when, and cross-reference those timestamps and tool names against the file's other metadata for consistency.
Related terms
- EXIF (Exchangeable Image File Format)
- A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
- C2PA (Coalition for Content Provenance and Authenticity)
- An open technical standard that embeds cryptographically signed provenance assertions into media files at the point of capture or editing. A C2PA...
- Container Atom / Box
- The structural metadata units inside video container formats (MP4, MOV, MKV). Atoms such as mvhd (movie header) carry creation and modification timestamps;...
- File Signature (Magic Bytes)
- The fixed byte sequence at the start of a file that identifies its format. JPEG files begin with FF D8 FF; PNG...
- IPTC IIM
- International Press Telecommunications Council Information Interchange Model: a legacy binary metadata standard embedded in JPEG APP13. Carries caption, credit, copyright, and editorial...
- JPEG Quantisation Table
- A matrix of 64 values embedded in a JPEG file that controls the precision with which each frequency component of the image...
- Makernote
- A proprietary EXIF sub-block written by the camera manufacturer to record device-specific data not covered by the EXIF standard. Canon, Nikon, Sony,...
- PNG Chunk
- The basic structural unit of a PNG file. Each chunk has a four-character type code, a length field, a data payload, and...
- Thumbnail Inconsistency
- Many cameras embed a reduced-resolution preview image inside the EXIF header of a JPEG. If the main image has been cropped or...
Explained in these topics
- EXIF and Container Metadata ForensicsAn Adobe-defined XML metadata format embedded in or sidecar to image and video files. Written primarily by editing software (Photoshop, Lightroom, Premiere), X...
- Image File Format and Integrity Checks