# E14. Image-provenance examination

## Examined material

The ECHOES poster, identified in the case as `Post.png`, was examined through PNG metadata and embedded provenance structures. The recorded method used metadata extraction and manual JUMBF, CBOR and certificate parsing. This report reviews the saved examination; it does not perform a new cryptographic validation. [S1]

## Recorded provenance fields

The record identifies a C2PA structure in the PNG caBX chunk. Reported values include claim generator ChatGPT, software agent GPT-4o, source type `trainedAlgorithmicMedia`, and certificate subject fields referring to an OpenAI/Sora signing pipeline. Creation, conversion and ingredient-opening actions are reported across two manifests. These are descriptions of embedded assertions, without independent authentication established by this exhibit set. [S1]

The later manifest (B), which references manifest A as an ingredient, contains an empty redacted-assertions array; that field is absent from A. The note reports no prompt and no user identifier. Absence of those fields is not evidence that they were deliberately stripped. The embedded thumbnail was described as a lower-resolution version of the same poster; no appended payload was found after the PNG end marker in the recorded examination.

## Timestamp and signature limitations

The recorded leaf certificate has a validity interval from 15 April 2025 to 15 April 2026. The analysis also reports no trusted timestamp token. Certificate validity alone therefore cannot establish the actual generation or signing date. The earlier inference that the image must have been generated within that interval is not adopted here. [S1]

The source states that the signature validated, but no independent verifier output, certificate-status check or trust-list result is retained. An embedded ingredient validation assertion about manifest A is not independent verification and does not validate manifest B. Provider identifiers and manifest instance values are omitted. Readers should distinguish a reported validation result from independently reproduced verification.

## Assessment

The recorded metadata supports use of an AI-image generation pipeline in preparation of the lure artwork. It does not identify the person who generated, obtained or deployed the image. Other portraits lacking C2PA metadata could have been re-encoded, but absence alone does not prove intentional provenance removal. Image metadata also cannot establish nationality, account ownership or responsibility for the intrusion.