In e46, What does “Verified” really mean?, the focus was on reading a verification result without confusing technical proof with factual truth. This edition follows the next question: what happens when the evidence is no longer attached to the file?

Imagine a creator publishing a signed photograph. Someone screenshots it, a friend crops the screenshot, and another person reposts the result. The scene still looks familiar, but the original embedded Content Credential has not necessarily travelled with it: a screenshot creates a new image rather than carrying over the source file's C2PA metadata.

Nodle. The Trust Network.

@NodleNetwork

The picture survived. Did the proof?

A screenshot can keep the image while leaving its embedded Content Credential behind.

Crypto 101 e47: “When proof goes missing” explores what happens next.

Missing proof does not mean fake.

Let’s unpack it.

3

6:22 PM • Oct 24, 2026

The challenge is not only keeping the picture available. It is keeping the evidence discoverable, while being honest about what that evidence can still establish.

A Content Credential is a signed record of provenance: information about a digital asset's origin and recorded history. It may be embedded in a file or stored externally, depending on the workflow.

A screenshot captures a displayed image, not the original file's complete structure. The new screenshot does not automatically inherit the original embedded credential, even when the visible image looks almost identical.

Other changes can break the connection too. Platforms and tools that do not preserve C2PA information may strip metadata or create resized and recompressed versions without recording those transformations in a new credential.

Two outcomes need separating: a credential may still be present but fail validation against the changed content, or the verifier may find no credential at all. The first reports a failed check; the second reports unavailable evidence, not a successful integrity check.

A hard binding ties a credential to protected content through cryptographic hashing. It helps a verifier detect changes to the data covered by that binding. A soft binding, such as an invisible watermark or perceptual fingerprint, can help locate a related credential after the embedded record becomes detached.

A cryptographic hash and a perceptual fingerprint are not interchangeable. The former is designed for exact protected-data comparisons; the latter can be designed to recognize similar-looking versions even when their underlying data differs.

This distinction is central to C2PA's implementation guidance: discovery methods complement hard bindings, not replace them.

A recovery workflow needs more than a recognisable picture. A relevant credential must remain available, a supported discovery method must connect the content to it, and the tool must be able to query an appropriate service. C2PA does not operate a universal repository containing every credential.

A useful way to understand the process is:

1. Inspect the available file. Check whether an embedded credential is present before looking elsewhere.

2. Search for related evidence. A compatible service may use a watermark identifier or perceptual fingerprint to locate stored credentials.

3. Compare the candidate. Review the matched image, version, and available history rather than accepting visual similarity as conclusive.

4. Check the evidence. Examine the credential's validation result, signer, timestamps, and relationship to the content being inspected.

A lookup can miss relevant evidence because the record is unavailable, the service is outside the tool's search coverage, or the content no longer produces a usable match. “Nothing found here” should not become “no provenance exists anywhere.”

Adobe's October 2024 announcement described combining signed metadata, invisible watermarking, and fingerprinting to make Content Credentials more durable. Its April 2025 press release subsequently announced the Content Authenticity app's public beta.

For the practical limits, Adobe's recovery instructions are more useful than a broad promise of durability: credentials stored in its Content Credentials cloud can be recoverable from screenshots, while credentials embedded only in a file may be lost if a platform removes them.

Adobe also notes that published cloud credentials can appear as possible matches for visually similar work. That is a discovery result to assess, not evidence that every pixel in the submitted copy matches an earlier signed original.

For a complementary community perspective, Nodle's post about watermarks and signed provenance distinguishes a signal used for detection from a signed record that provides context. The two can support different parts of a verification workflow.

Consider a hypothetical image with a credential recording its creation. It is then cropped using a tool that does not record provenance, reposted, and later matched to the earlier record. The recovered credential can provide evidence about the earlier asset, but it does not automatically document the intervening crop or repost.

C2PA explicitly recognises that provenance histories can be incomplete. A compatible workflow can incorporate recovered earlier provenance into a new manifest and disclose the interruption, but discovery alone does not generate a missing editing history.

There are also two different checks to keep separate: validating the recovered credential's signed information, and establishing how that credential relates to today's transformed copy. A credential can be internally intact without its original hard binding validating the new screenshot.

As in e46, provenance is not a truth detector. A well-documented image can still be shared with a misleading caption, so the source, timing, and wider evidence remain part of the decision.

Nodle ContentSign describes a C2PA-compatible approach that combines a signed content record with a cryptographic fingerprint anchored on the Nodle Chain. Nodle's technology overview presents this anchor as an independent proof record alongside portable C2PA credentials.

That is a different function from perceptual lookup. A cryptographic fingerprint can support comparison with the corresponding protected content, but it is not an image backup, a reconstruction of a missing manifest, or an automatic match for every cropped screenshot.

C2PA itself does not require blockchain; compatible implementations can add ledger-based storage or anchoring. Keeping those roles separate helps readers distinguish an open provenance standard from an additional implementation layer.

For a real-world application, Nodle's post on authenticating official communications describes ContentSign's use for Vivendi press releases. It illustrates why recipients need a way to check official material, rather than depending only on familiar branding.

Making credentials easier to rediscover can also make earlier information easier to find. C2PA's guidance warns that soft-binding searches can reconnect content with older manifests containing information omitted or redacted from a later version.

Before publishing discoverable credentials, review which identity, location, and workflow details are included, who can query them, and what controls the repository offers. C2PA recommends informed participation in discovery workflows, including making users aware when repository queries occur.

Adobe's cloud-credential management guidance provides a product-specific example: users can view and delete credentials stored in Adobe's service. Those controls should not be confused with a promise to remove every previously distributed copy elsewhere.

Use an image you created and are comfortable making public. Avoid private documents, confidential screenshots, or identifiable material that should not be uploaded to an external service.

First, inspect the original with a compatible viewer, such as Content Credentials Verify, and note whether a credential is present, whether it validates, and which signer and history are shown. Verify supports several media formats, but it also cautions that a chosen file may not contain provenance information to display.

Next, make a screenshot and inspect that file separately. If the original credential is absent, a tool with a supported recovery service may let you search for a related record; the Content Authenticity Initiative's technical FAQ explains why screenshots need that separate discovery step.

Record three observations: what stayed visible, what evidence remained attached, and what evidence the recovery service found. If nothing is found, record that outcome too rather than treating recovery as guaranteed.

Finally, compare the versions yourself. What did the screenshot or crop leave out, and does any recovered record actually explain those changes? A match is a reason to inspect the evidence more carefully, not a reason to skip that step.

As a practical publishing habit, keep an original copy and share a source link alongside reposted material when possible. When inspecting someone else's content, ask for the original or an official publication rather than treating a screenshot of a verification badge as the underlying credential.

Nodle's post on proof and judgment offers a useful prompt for this process: inspect identity, history, timing, and context as well as the technical evidence.