Catalogue audit: Sample catalogue

Of 18 readable images:

• 12 name a creator in their metadata (66.7%);
• 11 carry a copyright or rights statement (61.1%);
• 14 carry any attribution, rights or credit field at all.

Fields read: EXIF Artist and Copyright; IPTC By-line, Credit, Source and Copyright Notice; XMP dc:creator, dc:rights, photoshop:Credit and Source, xmpRights:UsageTerms and WebStatement, and the PLUS image creator, copyright owner and licensor names. Credit and Source say who supplied a picture, not who made it, so they are reported but never counted as a creator.

Every image's record in report.json is a leaf of a Merkle tree. Its root commits to all of them at once: change any record, add one or remove one, and the root no longer matches.

Merkle root (SHA-256, tree version 2, 18 leaves):
b706e7f77cff74aed324b11b24175ea9eadf8b0261bd963980865dd748d4da85

Filed through opentimestamps: out\anchors\b706e7f77cff74ae.ots-pending.json (filing saved as anchor.json).

Each asset in report.json carries its leaf hash and an inclusion proof against this root. A leaf is SHA-256 of 0x00 + the asset record as canonical JSON (sorted keys, no spaces, UTF-8), without leaf_sha256, proof, group and relation.

Your images stayed where they were. Each file was read, turned into digital fingerprints in memory, and let go. No image, thumbnail or copy was written, and nothing was sent anywhere except the 32-byte Merkle root, to the timestamping service.

Exact duplicates are files with equal ISCC codes, which include a hash of every byte: the same file, perhaps under another name.

Variants are the same picture in a different file: resized, re-encoded, cropped, rotated, mirrored, given a border or a caption, or re-saved with other metadata. Two methods find them. A perceptual hash of the whole image (or its centre square) within 2 of 64 bits, with a private grid of per-region hashes not contradicting it, catches resized and re-encoded copies. For the rest, a learned copy-detection descriptor (SSCD) proposes pairs that look like copies, and each pair is then checked geometrically: distinctive points are matched between the two images, a single scale-rotation-shift is fitted to them, and once one image is laid over the other, most of the area they share must agree. "How they were matched" under each group gives that evidence. Groups chain: if A matches B and B matches C, all three are one group.

This finds copies, not look-alikes. Two photographs of the same scene are different pictures and are usually not grouped, though two frames of a still scene taken moments apart can be, since they barely differ. Very small crops (under about a sixth of the picture), heavy retouching, perspective changes and collages can be missed. Images with too little detail (a plain backdrop, a blank scan) are matched as exact duplicates only.

Metadata can be wrong. It is copied with files, left over from templates and edited by anyone; this report quotes it as found and checks none of it. "Different creators named" means the names differ once case, punctuation and containment are set aside: two spellings of one name are flagged, and a person should look.

Evidence, not ownership. Nothing here says who owns an image or whether it may be licensed. Missing metadata does not mean an image is free to use, and present metadata does not prove a right. This is not legal advice.