Within No Files
Why the Original File Matters More
An original file can preserve metadata, dimensions and editing traces that a screenshot may flatten or lose.
On this page
- What metadata can show
- What screenshots strip away
- Why provenance beats appearance
Page outline Jump by section
Introduction
In the Gary McKinnon story, even a screenshot would have been more useful than a verbal recollection. Yet the strongest possible evidence would not have been a screenshot at all. It would have been the original NASA image file that McKinnon claimed to have viewed. The difference matters because investigators do not evaluate digital images solely by what they appear to show. They also examine the information attached to the file, the way it was created, where it was stored, and whether it can be linked to a documented chain of custody. In digital forensics, those details are often as important as the visible picture itself. [NIST+2NIST]nist.govosac 2021 s 0036standard guide image authenticationdraft osac proposed28. 1.6 This document is not intended to be used as a step-by-step practice…Read more…
Within the debate over McKinnon’s UFO-related claims, the absence of the original image means that no one can test the strongest version of his account. The issue is not simply whether the object he described looked unusual. The issue is that the underlying file—the thing that could potentially be examined, authenticated, compared and contextualised—was never preserved. [WIRED]wired.comufo hacker tells what he foundWIRED'UFO Hacker' Tells What He Found21 Jun 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of troub…
What Metadata Can Show
An original image file often contains information beyond the pixels visible on screen. Depending on the file type and workflow, metadata can reveal creation times, modification times, image dimensions, compression history, software involved in processing, and other clues about how the file moved through a system. Digital-forensics standards treat such information as potentially significant evidence because it can help establish provenance, authenticity and chronology. [NIST+2NIST]nist.govdigital forensicsDigital Forensics | NISTMay 10, 2018 — Digital evidence includes data on computers and mobile devices, including audio, video, and im…
In the specific context of McKinnon’s claim, an original NASA image could potentially have answered questions that a screenshot cannot:
- Was the file part of a recognised imaging workflow?
- Did its timestamps match the surrounding archive?
- Did the filename fit known NASA naming conventions?
- Was there evidence of editing or reprocessing?
- Did related files exist in the same directory?
- Could the image be matched against archived public imagery?
These questions concern context rather than appearance. A photograph of a screen might show an object. The original file might show where that object came from and how it entered the system. Provenance research and forensic-image authentication place heavy emphasis on exactly these kinds of relationships between a file and its history. [arXiv+2SWGDE - SWGDE]arxiv.orgarXiv Beyond Pixels: Image Provenance Analysis Leveraging MetadataarXiv Beyond Pixels: Image Provenance Analysis Leveraging Metadata
Another important point is that metadata is rarely decisive on its own. Metadata can be altered or removed. However, investigators can compare multiple sources of information—file structure, directory records, timestamps, hashes, logs and surrounding artefacts—to build a broader picture. The original file provides opportunities for that analysis; a screenshot provides far fewer. TrueScreen - Trust as a Service+2sciepublish.com [truescreen.io]truescreen.ioTrue ScreenEXIF data (Exchangeable Image File Format) record information such as date, time, GPS…Read more…
What Screenshots Strip Away
A screenshot captures what was displayed on a screen at a particular moment. In doing so, it usually creates an entirely new file. That new file often discards much of the information associated with the source image and replaces it with metadata generated by the screenshot process itself. Forensic specialists therefore distinguish between original digital evidence and derivative copies. [Primeau Forensics+2hackerfactor.com]primeauforensics.comPrimeau ForensicsAuthentication of Screenshots for DefenseDigital image authentication helps determine the authenticity of images used as…
Imagine that McKinnon had captured a screenshot before losing his connection. Researchers could have examined the visible object, the screen layout, window titles, interface elements and image quality. That would have been valuable. Yet many potentially important details would still have been missing:
- The source file’s original metadata.
- The exact file format and compression settings.
- Directory relationships and associated files.
- Evidence of prior editing operations.
- Links to system logs and storage locations.
A screenshot can preserve appearance while flattening context. That distinction is central to digital-evidence analysis. Investigators frequently seek original files because screenshots and re-saved images can obscure the very clues needed to determine authenticity. [SWGDE - SWGDE+2Primeau Forensics]swgde.orgBest Practices for Image AuthenticationFor the purposes of this…Read more…
This is why discussions of the McKinnon case often focus on the missed capture opportunity. Even if a screenshot would not have proved the existence of an extraordinary craft, it would at least have supplied a shared object for examination. Without either a screenshot or an original file, analysts are left with a verbal description alone. [WIRED]wired.comufo hacker tells what he foundWIRED'UFO Hacker' Tells What He Found21 Jun 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of troub…
Why Provenance Beats Appearance
One of the most common misunderstandings in UFO-related evidence debates is the assumption that the visual image is the entire evidence package. In practice, provenance—the documented origin and history of a file—is often more important than the image’s appearance.
A striking image can be interpreted in many ways. It might depict an unusual craft, a satellite component, an imaging artefact, a rendering, a test object or something entirely mundane. Determining which explanation is most plausible requires context. Provenance provides that context by linking the image to a verifiable history. [NIST+2SWGDE - SWGDE]nist.govosac 2021 s 0036standard guide image authenticationdraft osac proposed28. 1.6 This document is not intended to be used as a step-by-step practice…Read more…
In McKinnon’s account, the strongest evidential scenario would have looked something like this:
- The original file is preserved.
- The file’s metadata and directory context are documented.
- Related files and logs can be examined.
- Independent experts analyse the image.
- Other researchers attempt to reproduce or verify the findings.
That process would not automatically validate the UFO interpretation. It would, however, create a testable claim. The absence of the original file prevents that process from beginning. [NIST+2NIST]nist.govdigital forensicsDigital Forensics | NISTMay 10, 2018 — Digital evidence includes data on computers and mobile devices, including audio, video, and im…
The result is that the debate remains centred on testimony rather than evidence. McKinnon may genuinely believe he saw something extraordinary, but the original image file—the item that could potentially support, weaken or contextualise that belief—was never preserved. From an evidential perspective, that missing file is more significant than the appearance of the alleged object itself. [WIRED+2Wikipedia]wired.comufo hacker tells what he foundWIRED'UFO Hacker' Tells What He Found21 Jun 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of troub…
Amazon book picks
Further Reading
Books and field guides related to Why the Original File Matters More. Use these as the next step if you want deeper reading beyond the article.
Guide to Computer Forensics and Investigations
Explains why original files and metadata matter.
eBay marketplace picks
Marketplace Samples
Example marketplace items related to this page. Use the search link to explore similar finds on eBay.
Endnotes
-
Source: nist.gov
Title: osac 2021 s 0036standard guide image authenticationdraft osac proposed
Link: https://www.nist.gov/document/osac-2021-s-0036standard-guide-image-authenticationdraft-osac-proposedSource snippet
28. 1.6 This document is not intended to be used as a step-by-step practice...Read more...
-
Source: nist.gov
Title: digital forensics
Link: https://www.nist.gov/programs-projects/digital-forensicsSource snippet
Digital Forensics | NISTMay 10, 2018 — Digital evidence includes data on computers and mobile devices, including audio, video, and im...
Published: May 10, 2018
-
Source: arxiv.org
Title: arXiv Beyond Pixels: Image Provenance Analysis Leveraging Metadata
Link: https://arxiv.org/abs/1807.03376 -
Source: wired.com
Title: ufo hacker tells what he found
Link: https://www.wired.com/2006/06/ufo-hacker-tells-what-he-found/Source snippet
WIRED'UFO Hacker' Tells What He Found21 Jun 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of troub...
-
Source: Wikipedia
Title: Gary [Mc Kinnon]({{ ‘mc-kinnon/’ | relative_url }})
Link: https://en.wikipedia.org/wiki/Gary_McKinnonSource snippet
Gary McKinnon" He said he investigated a NASA photographic expert's claim that at the Johnson Space Center's [Building 8]({{ 'building-8/' | relative_url }}), images were r...
-
Source: nist.gov
Title: osac 2024 n 0011 standard guide forensic digital image management version 10
Link: https://www.nist.gov/document/osac-2024-n-0011-standard-guide-forensic-digital-image-management-version-10Source snippet
54. 55. 1. Scope. 56. 57... written notes, electronic recording, image metadata, automated logging. 187.Read more...
-
Source: swgde.org
Title: Best Practices for Image Authentication
Link: https://www.swgde.org/documents/published-complete-listing/18-i-001-best-practices-for-image-authentication/Source snippet
For the purposes of this...Read more...
-
Source: nist.gov
Link: https://www.nist.gov/publications/media-forensics-challenge-image-provenance-evaluation-and-state-art-analysis-largeSource snippet
Media Forensics Challenge Image Provenance Evaluation...by X Jin · 2020 · Cited by 1 — Media Forensics Challenge Image Provenance Ev...
-
Source: truescreen.io
Title: True Screen
Link: https://truescreen.io/articles/certify-photos-legal-value/Source snippet
EXIF data (Exchangeable Image File Format) record information such as date, time, GPS...Read more...
-
Source: sciepublish.com
Link: https://www.sciepublish.com/article/pii/567Source snippet
Forensic Value of Exif Data: An Analytical Evaluation...by N Soni · 2025 · Cited by 6 — ABSTRACT: Exif metadata contained in digital pho...
-
Source: hackerfactor.com
Title: Say No to Screenshots
Link: https://www.hackerfactor.com/blog/index.php?%2Farchives%2F946-Say-No-to-Screenshots.html=Source snippet
This effectively removes any pixel-related [artifacts]({{ 'artifacts/' | relative_url }}). none of the metadata will reflect...
-
Source: wired.com
Title: terrorist or ufo truth seeker
Link: https://www.wired.com/2006/04/terrorist-or-ufo-truth-seeker/Source snippet
?28 Apr 2006 — But Briton Gary McKinnon says he is just an ordinary computer nerd who wanted to find out whether aliens and UFOs exist. D...
-
Source: truescreen.io
Title: evidence preservation guide
Link: https://truescreen.io/articles/evidence-preservation-guide/Source snippet
How to Preserve Digital Evidence for CourtMar 29, 2026 — A printed email or a screenshot of an inbox does not meet evidentiary standards...
-
Source: truescreen.io
Title: photo verification
Link: https://truescreen.io/articles/photo-verification/Source snippet
How to Verify Image Authenticity30 Mar 2026 — Social media platforms like Instagram and WhatsApp automatically strip EXIF metadata from s...
-
Source: primeauforensics.com
Link: https://www.primeauforensics.com/digital-image-authentication-of-screenshot-evidence-in-criminal-defense/Source snippet
Primeau ForensicsAuthentication of Screenshots for DefenseDigital image authentication helps determine the authenticity of images used as...
Additional References
-
Source: crime-scene-investigator.net
Link: https://www.crime-scene-investigator.net/best-practices-for-image-authentication.htmlSource snippet
Best Practices for Image AuthenticationThe objective of this document is to provide personnel with guidance regarding practices appropria...
-
Source: cybereason.com
Link: https://www.cybereason.com/blog/malicious-life-podcast-the-u.s-vs.-gary-mckinnonSource snippet
Malicious Life Podcast: The U.S. vs. Gary McKinnonGary McKinnon, a British hacker with Asperger's, broke into NASA and US Army networks t...
-
Source: reddit.com
Link: https://www.reddit.com/r/UFOs/comments/16in31n/reminder_gary_mckinnon_caught_nasa_editing_uap/Source snippet
Reminder: Gary McKinnon caught NASA editing UAP out of...Reminder: Gary McKinnon caught NASA editing UAP out of their images two decades...
-
Source: malicious.life
Link: https://malicious.life/episode/us_vs_gary_mckinnon/Source snippet
The US vs. Gary McKinnonGary McKinnon, a British hacker with Asperger's, broke into NASA & US Army networks - to find evidence of UFO cov...
-
Source: youtube.com
Link: https://www.youtube.com/watch?v=WFd7XzTf6_kSource snippet
David Grusch & NASA Hacker Gary McKinnonThe story of how a hacker breached NASA security with the intention of proving that NASA is hidin...
-
Source: researchgate.net
Title: Forensic Metadata Analysis in Detecting Digital Image Manipulation
Link: https://www.researchgate.net/publication/396982706_Forensic_Metadata_Analysis_in_Detecting_Digital_Image_Manipulation/fulltext/6900c97e4baee165918ddc11/Forensic-Metadata-Analysis-in-Detecting-Digital-Image-Manipulation.pdfSource snippet
5, 2025 — In the field of research, digital image forensics has emerged as...
-
Source: blog.ampedsoftware.com
Title: add screenshots to forensic image reports in amped authenticate
Link: https://blog.ampedsoftware.com/2019/12/03/add-screenshots-to-forensic-image-reports-in-amped-authenticateSource snippet
Screenshots to Forensic Image Reports in Amped...Dec 3, 2019 — Learn how to add screenshots to forensic image analysis reports in Amped...
-
Source: hackers-arise.com
Link: https://hackers-arise.com/digital-forensics-part-9-extracting-exif-data-from-graphics-files/Source snippet
nstall ExifReader · Step 2: Open a Picture File · Step 3: Extract EXIF from Another...Read more...
-
Source: isaca.org
Title: what to know about exif data a more subtle cybersecurity risk
Link: https://www.isaca.org/resources/news-and-trends/industry-news/2025/what-to-know-about-exif-data-a-more-subtle-cybersecurity-riskSource snippet
What to Know About EXIF Data, a More Subtle...6 Feb 2025 — EXIF metadata can serve as a critical forensic artifact, with some studies su...
-
Source: researchgate.net
Link: https://www.researchgate.net/publication/392920789_Forensic_Value_of_Exif_Data_An_Analytical_Evaluation_of_Metadata_Integrity_across_Image_Transfer_MethodsSource snippet
a variety of details, including: Timestamps: Date and time when the image was...Read more...
Topic Tree