In the first hours of the Russian invasion of Ukraine, internet watchdogs pored over images shared on Russian media that claimed Ukraine struck first and Russia merely responded.

The Biden administration has been warning for weeks that, in the days and hours leading up to the invasion of Ukraine that arrived before dawn on Thursday, Russian sources would release “false flag” photos and videos to make it appear that the Ukrainian military attacked Russian forces unprovoked.

To understand how these investigators do their work, you should first understand a few basics.

Everything created on a digital device — whether it is a smartphone, a laptop or tablet — includes a digital fingerprint that rides with the file. That digital fingerprint, called metadata, sticks with the document — whether it is a video, photo, spreadsheet or other document — until somebody or some program removes it.

[…]

It is possible to change metadata. I could pull my photo into Photoshop, for example, and edit the metadata to make it appear that I was anywhere else I could dream of. Think of metadata as a clue and not an ironclad answer. That is why it is important to triangulate metadata with other elements to debunk or confirm an image. — Al Tomkins, Poynter