Skip to main content
Encypher Logo

Recover provenance after metadata is stripped

When a site strips the label from a file, a hidden watermarkWatermark: A mark placed in the content itself, visible or hidden, so it can be found again after the file is copied. can still lead back to the signed record. The check calls that recovery and says so. It only works if the mark was added before the file went out.

Start signing freeCheck a file
A file signed with a label and a watermark loses its label when a site strips metadata; a checker finds the watermark, which points back to the signed record, shown as recovered.
If a site strips the label, a supported watermark can lead back to the signed record. The result says it was recovered.
The label
Sits in the file. A hard bindingHard binding: A hash of the content's signed bytes stored in the label, so a change to those bytes makes the check fail. ties it to the exact content.
The way back
A soft bindingSoft binding: A watermark or fingerprint that can find a content label again after the file was copied or its metadata stripped.: a mark in the content itself that points to the record.
What it needs
A supported mark and a resolverResolver: A lookup service that takes an ID found in a watermark or fingerprint and returns the matching provenance record. that can look up the record.
The result
Marked as recovered, never as an intact label.

How recovery works

Hard binding is a fingerprint of the exact file, so a re-encode breaks it. Soft binding is a watermark in the picture that still leads back to the label after a re-encode.
The fingerprint proves the file is unchanged. The watermark finds the label again when the file has changed or lost it.

  1. The file goes out with two links.

    A signed label inside the file, and a hidden watermark in the content.

  2. A site strips the label.

    The copy no longer carries it. The check reports that first.

  3. The check finds the mark.

    It names the mark, who issued it, and the limits it was tested under.

  4. The resolver finds the record.

    The check shows the signed record, marked as recovered.

What recovery can and cannot show

What a recovered record tells you.
Recovery can showRecovery cannot show
The markA supported mark was found.That every mark survives every crop, edit or attack.
The recordThe linked record, with its own signer and time.That this copy still holds the original label.
The scopeWho issued the mark and the limits it was tested under.Anything about a mark it does not support.

Plan it before you publish

Recovery is not a trick applied later. The mark must go in at signing, and the record must stay where the resolver can reach it. Without that, the honest result is: no label, and nothing to recover.

For engineers

Show the technical detail
Hard binding
A hash (c2pa.hash.data, c2pa.hash.boxes, or the BMFF variants) over the asset, inside the manifest.
Soft binding
A c2pa.soft-binding assertion naming the watermark or fingerprint algorithm and its value.
Resolution
The detected identifier is sent to the soft-binding resolver, which returns the manifest store for that record.
Result
The verifier reports embedded provenance absent and recovered provenance present as separate fields, each with its own validation status.

Keep reading

Create. Mark. Endure.

Add the label and the mark when you sign. Then a stripped copy can still lead home.

Start signing freeCheck a file