Truth is an evidence graph.

How it works

Every item passes through the same thirteen stages. The first twelve are automatic and recorded; the last belongs to a person.

1. Source and acquisition: who supplied the item, when, and how.
2. Hash: SHA-256 of the exact bytes, fixed at intake. The original is never modified; any transformation produces a new item with its own hash and a recorded parent.
3. Provenance: an append-only ledger in which each record includes the hash of the one before it.
4. Metadata: EXIF, PNG text and time chunks, MP4 movie headers, RIFF INFO tags. Read, reported, and never trusted.
5. Content analysis: JPEG and PNG structure, quantization tables, CRCs, copy-move block matching; WAV digital silence, splice-like steps and room-tone shifts.
6. Temporal analysis: the frame-interval table from the container, turned into a NORMAL / REVIEW / ANOMALY / SUPPORTED timeline.
7. Cross-source correlation: copies, derivatives, shared upstream sources and near-duplicate images collapse into one independence group before anything is counted.
8. Manipulation indicators: each one states what was found, how, on what evidence, with what confidence, what else could explain it, and what the system cannot determine.
9. Confidence assessment: rule-based. HIGH needs three independent agreeing groups with no anomalies; one source is never more than PARTIALLY SUPPORTED.
10. Evidence graph: facts the engine recorded are solid edges; everything read from metadata or an analyst is a dashed inference.
11. Audit record: every analyzer run records its input and output hashes.
12. Human review: accept, reject, escalate, mark inconclusive, annotate, comment or request a second review. The analyst cannot decide their own analysis, and nothing becomes VERIFIED without a human ACCEPT.

Evidence vs inference

Chain of custody

A hash proves the bytes have not changed since the hash was taken. It proves nothing about the event the bytes depict. That is why the console separates CRYPTOGRAPHICALLY VERIFIED (the hash matches an earlier custody receipt) from VERIFIED (integrity verified and accepted by a human reviewer), and why neither is a statement about what happened.

Canadian law draws the same line. Under sections 31.1 and 31.2 of the Canada Evidence Act, a party must show an electronic document is what it purports to be, and the best evidence rule is met by proof of the integrity of the system that recorded or stored it. Section 34.1 of Ontario's Evidence Act sets out comparable rules for electronic records. The provenance ledger is designed to make system integrity something you can show, not assert.

Synthetic media: what detection can and cannot do

Generative tools leave some traces: a generator name in a software tag, generation settings in a PNG text chunk, a Content Credentials manifest. They also leave many traces nobody can see without a trained model, and strip or rewrite most of the ones anybody can. NIST's AI 100-4 (November 2024) surveys provenance, labelling and detection approaches and treats them as complementary layers, not a single test.

This console does not bundle or call a synthetic-media classifier. It reports metadata signals as metadata signals, detects Content Credentials (C2PA) manifest presence without validating the signature, and records the classifier as an adapter boundary that is not implemented. The absence of an indicator is never reported as evidence of authenticity.

Bifocal evidence verification

A single media stream is one lens. ClearGlass Bifocal Verification holds it against channels that did not come through the same pipeline: an independent sensor that observed the same place, a reference clock for the capture device, and a custody record that fixed the file's hash earlier. Each applicable check agrees or conflicts, and a channel in the same independence group as the primary is excluded from scoring.

The result is a consistency score out of 100, shown only when two or more channels are present, and always with the statement: This score is an analytical heuristic and is not proof of authenticity. Camera telemetry, RFC 3161 timestamps, detached signatures, device attestation, live sensor feeds and C2PA validation are listed as adapter boundaries. They are not implemented, and the console says so.

AI governance

Every analyzer run is recorded with its provider, model, version, input hash, output hash, time, analyst, highest indicator confidence, limitations and human-review state. Here the provider is always clearglass-local and the model a deterministic rule set. No external AI provider is configured or called. An adapter would have to be enabled explicitly, and every call would be recorded the same way.

Analysis output is never promoted to fact on its own. The final status is always analysis plus human review, and demonstration data stays SIMULATED whatever a reviewer does.

Limitations

• No lighting, shadow, edge or compositing-boundary analysis; no double-JPEG-compression statistics; no optical-flow, face or object tracking. These are listed as not performed in every result.
• Copy-move matching finds exact or near-exact duplicated regions. It misses scaled, rotated or recompressed clones, and repetitive textures can produce false positives.
• The video timeline reads the container's timing table. Remuxing rewrites that table, and fragmented MP4 timing (trun) is not read.
• Audio tests flag places to listen, not edits. Knocks, plosives, noise gates and codecs produce the same signals.
• Metadata is unsigned. Every metadata observation describes the file, not the event.
• Claim decomposition is pattern-based. It is a starting point for an analyst, not language understanding.
• Content Credentials manifests are detected, not validated.
• Browser-decoded pixels and audio can differ slightly between browsers and codecs; the offline Python engine is the reference.

Standards and sources

• Secure Hash Standard, FIPS 180-4 (SHA-256).
• ISO/IEC 27037:2012, guidelines for identification, collection, acquisition and preservation of digital evidence.
• NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response.
• NIST AI 100-4, Reducing Risks Posed by Synthetic Content (2024): doi.org/10.6028/NIST.AI.100-4.
• C2PA Technical Specification (Content Credentials; JUMBF in JPEG APP11, caBX chunk in PNG): spec.c2pa.org.
• ITU-T T.81 (JPEG), Annex K quantization tables; W3C PNG specification; ISO/IEC 14496-12 (ISO base media file format); RFC 3161 (time-stamp protocol, listed as an adapter boundary).
• Canada Evidence Act, ss. 31.1–31.8; Ontario Evidence Act, s. 34.1.

Engine source, tests and methodology: truth_forensics/, assets/js/truth-forensics-engine.js and docs/TRUTH_FORENSICS.md in the ClearGlass repository. The Python and browser engines are held to byte-identical output by a parity test.