Purpose and when to use it
Use this method when an origin claim, Content Credential, source-system record, or transformation history matters to the question. State whether the claim concerns capture, generation, editing, publication, or custody.
Evidence required
Retain the exact object, embedded and external manifests, certificates or keys, ingredient references, validator version, and trust policy. Collect source records independently where access permits.
Principles and procedure
- Write the origin proposition in concrete terms and identify its claimant.
- Extract provenance without replacing the original object. Identify bindings and missing ingredients.
- Validate under a documented specification, tool version, and trust configuration; retain errors as well as successes.
- Compare asserted activities and times with independent records, then mark confirmed, conflicting, and unresolved links.
What to document
Record assertion identifiers, object hashes, validation output, trust-store details, and inaccessible resources. Separate signature validity, identity trust, and substantive claim assessment.
Failure modes
Using the current default trust store without recording it can make later validation hard to reproduce. Interpreting absent credentials as proof of deception ignores normal exports and unsupported production systems.
Limits on the conclusion
Provenance can be incomplete, selectively asserted, or unavailable after transformations. No origin record replaces assessment of the underlying content and the claim being made about it.
Independent checks and corroboration
Seek capture or generation records, retained earlier versions, and custody records that do not simply repeat the manifest. Explain when two sources share the same upstream assertion.
How to report the result
Report which claims validated under which policy, which failed, and which could not be tested. Avoid an unqualified authentic label when only a narrower technical check succeeded.
Related glossary terms
How do you examine a signed editing history?
Preserve the asset and manifest, identify the assertions, and run the relevant validation under a recorded trust policy. Inspect ingredient and transformation relationships and compare them with separately acquired source or project records.
State the exact checks that passed and the history they cover. Keep factual assertions, signer identity, and cryptographic integrity distinct so a valid signature does not silently become proof of the depicted scene.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- C2PA Specifications 2.4
Content Credentials technical specification and supporting documents. Claims and identity trust need separate evaluation.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
- FIPS 180-4: Secure Hash Standard
Cryptographic digest algorithms, including SHA-256. The official page records a planned revision; a digest alone does not authenticate an origin.
Canonical reference: https://syntheticforensics.org/methods/provenance/
Report a technical correction