Recover provenance after metadata is stripped.
Hard binding and soft binding do different jobs
A C2PA hard binding cryptographically binds a manifest to the asset that carries it. It can show whether the signed content still matches the signed record. If a social platform, message service, or export tool removes that manifest, the redistributed copy no longer carries the embedded credential.
A C2PA soft binding provides a way back to linked provenance. A watermark, fingerprint, or other content-derived identifier can help a resolver locate a record outside the stripped file. That is recovery, not proof that the embedded manifest survived.
How recovery works
The published asset carries two bindings
An embedded C2PA hard binding travels with the file. A qualified content-level watermark can carry or resolve an identifier independently of the metadata container.
A platform removes the metadata
The embedded manifest is no longer present in the redistributed copy. The verifier must report that fact rather than treating the original hard binding as intact.
The watermark detector finds a supported mark
The result records the provider, algorithm, confidence or status, and the transformation limits under which detection was tested.
The resolver locates the linked record
When the applicable watermark and resolver are present, the verifier can retrieve the provenance record associated with the detected identifier.
The result labels recovery as recovery
Recovered provenance remains different from an embedded manifest that validates against the current file. The user sees which path produced the evidence.
What recovery can establish
- A supported content-level mark was detected.
- The applicable resolver returned a linked provenance record.
- The recovered record has its own signer, timestamp, claims, and validation status.
- The result can name the provider and tested limits of the recovery path.
What recovery cannot establish by itself
- That the redistributed file still contains the original embedded manifest.
- That every watermark survives every edit, crop, transcode, or adversarial attack.
- That an unsupported or absent mark belongs to a known provenance record.
- That a technical result settles the organization's legal obligations.
Design the fallback before distribution
Recovery is not a forensic trick applied after the fact. The publisher or AI provider must create a supported soft binding, retain or register the linked record, and use a resolver that the verification layer can reach. Without that chain, the honest result is embedded provenance absent and recovery unavailable.
Encypher brings embedded C2PA validation, supported watermark detection, and conditional recovery into one endpoint. Each step stays visible, so product, legal, and audit can tell which evidence survived.