Vajba: Client-Side Image Forensics

Vajba is a specialized tool designed to scrutinize photographs for evidence of manipulation, AI synthesis, hidden metadata, and compression anomalies. It is important to note that the tool identifies clues for further investigation rather than providing absolute ~~proof~~ of authenticity or forgery.

🛠️ How to Analyze an Image

Users can initiate a forensic scan through several methods:

Direct Upload: Drag and drop a file or use the "Select Image" button.
Clipboard: Paste an image directly using Cmd+V or Ctrl+V.
URL: Input a direct link to an image.

[!IMPORTANT] Privacy Note: When using a URL, the image is fetched directly to your browser. Vajba never receives the file; however, the hosting server will log your browser's request.

Supported Formats

The tool handles a wide array of modern image types:

JPEG
PNG
WebP
HEIC
AVIF

🔍 Understanding the Analysis

The tool provides an "Overall Read," which is a synthesized verdict based exclusively on "Hard" and "Supportive" evidence.

Interpretation Guide

What it MEANS	What it DOES NOT mean
Findings are derived from the file's own bytes, parsed locally in the browser.	"No findings" $\neq$ a guarantee of authenticity.
Analysis includes metadata, encoder signatures, pixel stats, and structural clues.	AI detection is not foolproof, especially after re-compression or resizing.
Cryptographic claims are verified against known trust lists.	Metadata is easily forged or stripped entirely.

Pro Tip: For the most reliable authenticity check, a reverse image search is typically superior to algorithmic detection.

The Logic of Findings

To prevent "verdict inflation," Vajba employs a weighting system:

Hard Evidence: Objective facts extracted from the file.
Correlated Findings: If multiple clues stem from a single cause, they are down-weighted so they don't unfairly stack the result.

🔐 Deep Dive: Content Credentials (C2PA)

The gold standard for provenance is cryptographic signing (C2PA). When tools like Leica, Sony, DALL-E, or Photoshop sign an image, Vajba performs a rigorous verification process.

The Verification Pipeline

The app utilizes the WebCrypto API to perform the following:

Signature Validation: Verifies the COSE_Sign1 signature using $\text{ECDSA (P-256/P-384/P-521)}$ or $\text{RSA-PSS}$ .
Integrity Check: Ensures every assertion hashes to the value in the signed claim.
Asset Binding: Confirms the file's bytes match the signed hash: $\text{Hash}_{\text{file}} = \text{SHA-256}(\text{bytes})$
Trust Chain: Walks the certificate chain back to the official C2PA trust list (sourced from c2pa-org/conformance-public).

What is omitted: The tool does not check certificate revocation, signing-time timestamps, key-usage policies, or ingredient manifests. For a full audit, use contentcredentials.org.

🤖 AI Detection & External Tools

AI detection is inherently unstable. Processing steps like resizing can erase the tell-tale signs of generative AI. Therefore, Vajba's internal checks cannot definitively prove if an image is AI-generated.

For a second opinion, you can use external services (which require uploading your image to their servers):

Content Credential Hive (Verification)
AI or Not (Detection)
Sightengine (Detection)

🧰 Additional Features & Output

Beyond the main analysis, Vajba offers a suite of utility tools:

EXIF Viewer: Inspect raw metadata.
Remove EXIF: Strip metadata for privacy.
File X-Ray: Deep dive into file structure.
Hide Message: Embed hidden data in images.

Export Options

Once an analysis is complete, you can:

Print/Save as PDF for documentation.
Download JSON for programmatic use.
Compare the current image against another.

Example JSON Output Structure:

{
  "analysis_id": "vj-99283",
  "verdict": "suspicious",
  "evidence": {
    "hard": ["cloned_pixels_detected"],
    "supportive": ["non_standard_encoder"]
  },
  "c2pa_verified": false
}