Provenance is data, not a picture
A C2PA manifest can record the creating tool, edits and source materials, with a digital signature. It may be embedded in a file or stored externally. Not every file includes the same information.
MetadataRemover.cc removes supported embedded metadata blocks from a copy. It does not rewrite a signed history or delete records held elsewhere. Removing a local manifest is not proof that the file has no other provenance.
Where each format keeps the manifest
The C2PA specification defines a carrier per container family, which is why an inspector can name the exact block rather than guessing.
- JPEG stores it in an APP11 segment holding JUMBF boxes.
- PNG uses a caBX chunk, sometimes alongside text chunks carrying the same markers.
- WebP adds a C2PA RIFF chunk next to the EXIF and XMP chunks.
- AVIF, HEIC, MP4, MOV and M4A use a top-level uuid box whose user type identifies a content-provenance manifest.
- WAV uses a C2PA RIFF chunk; FLAC and MP3 use an ID3v2 GEOB frame with the application/c2pa MIME type.
What removal actually achieves
Removing the manifest removes the file's own signed account of how it was made: which tool, when, and sometimes from which ingredients. For someone publishing a personal photo, that is often the same decision as removing GPS coordinates or the name of their editing software.
It does not alter a single pixel, and it does not remove a durable watermark or a fingerprint. The C2PA specification pairs manifests with those precisely because metadata is easy to lose in normal use — a screenshot, a re-upload, a messaging app that re-encodes. If a durable mark is present, cleaning leaves it exactly where it was.
Verify rather than trust
MetadataRemover.cc inspects the cleaned copy again for the items it supports. A separate Content Credentials verifier may still discover externally stored records through a watermark or fingerprint. Review the remaining findings and keep the original; no findings here is not a guarantee of no provenance anywhere.