⚠️ Limitations of Automated Analysis
CERTIF is a powerful preliminary triage tool, but it has important technical limitations. This page documents cases where human expertise is required.
⚖️ For court-admissible analysis
If digital evidence is contested or central to litigation, a complete forensic expertise with defensible methodology is required. CERTIF is a triage tool, not a substitute for human expertise.
🖼️ Photos and Images (EXIF)
Known limitations:
- Missing metadata: Some budget cameras or older models don't record all EXIF metadata.
- Falsified metadata: EXIF metadata can be easily modified with tools like ExifTool.
- Exotic RAW formats: RAW formats from rare cameras may have incomplete EXIF.
- No GPS: If location is disabled during capture, no GPS coordinates will be present.
- Sophisticated manipulations: Professional retouching rarely leaves automatically detectable traces.
📄 PDF Documents
Known limitations:
- Encrypted PDFs: Password-protected PDFs cannot be analyzed without the password.
- Revision history: CERTIF detects signatures and dates but cannot reconstruct complete modification history.
- Scanned PDFs: Scanned documents (images in PDF) have no exploitable text metadata.
- Complex signatures: Some complex certificate chains require manual validation.
📧 Emails (Headers)
Known limitations:
- Sophisticated spoofing: Some advanced spoofing techniques are not detectable without in-depth network analysis.
- Incomplete headers: If the email was forwarded or modified, some headers may be lost.
- Non-standard servers: Custom mail servers may produce non-compliant headers.
🎵 Audio and 🎥 Video
Known limitations:
- Corrupted files: Damaged files may produce incomplete or incorrect metadata.
- Proprietary formats: Some rare or proprietary codecs are not supported.
- Audio/video manipulation: Sophisticated editing (deepfakes, lossless editing) is not detectable without in-depth spectral analysis.
- Large files: Files >500 MB cannot be analyzed (technical limitation of free service).
📝 Office Documents (DOCX, XLSX, PPTX)
Known limitations:
- Incomplete revision history: Office keeps limited revision history, not the entirety.
- Erasable metadata: Authors and dates can be intentionally removed before distribution.
- Legacy formats: Old formats (.DOC, .XLS) have less metadata than modern formats (.DOCX, .XLSX).
✅ Electronic Signatures
Known limitations:
- Legal validity: CERTIF detects the signature but cannot determine if it has legal value in your jurisdiction.
- Trust chains: Self-signed or expired certificates require manual validation.
- Timestamping: Timestamp may be missing or unreliable if the time server is not certified.
💡 When to escalate to full expertise?
Consult an H2E forensic expert if:
- Evidence authenticity is contested
- Financial stakes exceed $50,000
- Digital evidence is central to litigation
- You detected inconsistencies with CERTIF
- Opposing party announced a counter-expertise
- Case will likely go to trial
Need a full expertise?
CERTIF limitations do not apply to our complete forensic expertises. Defensible methodology, court-admissible reports, expert testimony.
Request an expertise