What Forensically on 29a.ch Can Do for Photo Analysis

Updated

Forensically is a browser-based set of tools on 29a.ch for examining photos, and it now includes support for reading C2PA content credentials alongside its existing forensic analysis features. It is aimed at anyone who wants to inspect an image's metadata, provenance signals, or manipulation traces without installing desktop software. Two caveats matter up front: the C2PA signature information it displays should be treated with caution, and remote manifests are deliberately disabled, so some provenance data that lives off-file will not load.

What Forensically is

Forensically is one of the experiments published on 29a.ch, the personal website of Jonas Wagner. The site describes it as "a set of tools to forensically analyze photos." It runs in the browser, which means you work with an image by loading it into the tool rather than installing a dedicated application.

Core capability: C2PA content credentials

In April 2025, support for reading C2PA metadata was added to Forensically. C2PA stands for the Coalition for Content Provenance and Authenticity, which develops technical standards for certifying the source and history (provenance) of media content. In practice, this means Forensically can surface provenance information embedded in an image file that follows the C2PA standard.

What the signature data actually shows

The C2PA metadata is signed and optionally timestamped using a timestamp authority. When Forensically reads it, the signature information exposed is fairly limited. Based on the site's own description, the C2PA JavaScript library reveals little beyond the organization of the subject. A representative example of the signature info looks like this:

"signatureInfo": {
  "alg": "Es256",
  "issuer": "C2PA Test Signing Cert",
  "cert_serial_number": "640229841392226413189608867977836244731148734950",
  "time": "2025-04-06T20:32:57+00:00"
}

The site notes that contentcredentials.org/verify does not reveal much more. There is a "known certificate list" and an email address for submitting a certificate to be included, but the author states he is not sure what information is validated before a certificate is added.

Why to treat signatures with caution

The site is explicit that digital signatures do not inherently guarantee trustworthiness. Even when a scheme is cryptographically sound, you still need to trust everyone and everything with access to the keys. Because of the limited information exposed and the unclear validation behind the known certificate list, the author recommends taking the signatures displayed in Forensically "with a big pinch of salt." This is a general caution about how provenance signatures work, not a claim that any particular image is untrustworthy.

Privacy: remote manifests are disabled

C2PA includes support for remote manifests, which can be useful in some cases, such as keeping an asset's file size small. However, remote manifests can also be used as beacons to track a person viewing the metadata. In Forensically, support for remote manifests has been deliberately disabled, both through configuration options and by blocking requests using a Content Security Policy. The practical effect for a user is that provenance data stored remotely will not be fetched, which protects against tracking but also means you may see less than the full manifest.

Practical considerations

  • File size and load impact: The c2pa-js library is large. In the site's Vite setup it compiles to roughly 350 kB for the main ES module, 165 kB for a worker, and 5.4 MB for the WebAssembly module. The site mentions mitigating this impact, so expect the C2PA features to carry more weight than the lighter analysis tools.
  • What you can rely on: Use Forensically for reading embedded C2PA metadata and for its broader photo forensic analysis. Treat the signature details as a starting signal to investigate further, not as a final verdict.
  • What you will not get: Remote manifests are blocked by design, so provenance information hosted off-file is intentionally not retrieved.

If your goal is to check whether an image carries C2PA provenance data and to see basic signature details in the browser, Forensically covers that. If your goal is to fully validate a certificate chain or trust a signature as proof of authenticity, the tool's own author cautions that the displayed information is not sufficient on its own.