Short answer
Establishing that an image is synthetic is a technical question. Tracing ai image origin is a different one, and it usually cannot be answered from the file. It is answered from the distribution record: who first posted it, when, on which platform, and what account changes followed. Reviewers who conflate the two end up with a confident fabrication finding and no answer to the question the audience is actually asking.
The case that shows why this matters
In October 2026, CBC reported on a set of fake images depicting a Canadian political leader circulating on X. The images were quickly established as synthetic. What took longer was the attribution question: which accounts posted them first, whether those accounts were coordinated, and who was behind them. That second question is where most of the editorial value sat, and where the technical tools offered the least help.
Why the file cannot answer the origin question
Metadata is the first place people look, and it is usually the weakest. Generative tools commonly strip or overwrite capture metadata, and platforms strip it again on upload. A provenance record, where present, identifies the signing party rather than the person operating the tool. Neither tells you who pressed publish.
What the distribution record can show
- First appearance: the earliest timestamped post you can verify, with the URL preserved. Later reposts are downstream evidence, not origin evidence.
- Account history: creation date, posting cadence, prior content, and whether the account changed behaviour around the posting. A new account posting only one viral image is a pattern worth recording.
- Cross-platform order: which platform carried it first. Timestamps differ by timezone and sometimes by minutes; record them as observed rather than normalised.
- Coordination signals: identical phrasing, simultaneous posting, or shared unusual cropping across accounts.
Where attribution breaks down
Most of the chain is unverifiable after the fact. Deleted posts, private groups, and direct messages leave no public record, and a platform's internal logs are not available to outside reviewers. Where the earliest post is gone, the honest position is that the origin is unknown. A cluster of suspicious accounts is not proof of a coordinated campaign, and reverse image search returning no earlier copy does not establish that a given account was first. When the available evidence stops at "several accounts posted this within an hour", escalate to human review rather than naming a source.
What to record so the finding survives scrutiny
- Archive each post you cite, with a timestamp, before it disappears.
- Separate what you verified from what you inferred, in the published copy.
- State the platform and the timezone you used. Sloppy timestamps are the most common reason an attribution story gets challenged.
- Where the chain is incomplete, say so explicitly rather than implying certainty.
Read the methodology for how provenance and metadata layers are combined, or check sample reports to see how an incomplete evidence chain is documented.
If you need to compare provenance, metadata, and detector output on a file you already hold before drawing a conclusion, start a free review and read all three first.