Coming soon
FoddoLearn
Chapter 6 of 13 · Field manual · 9 min

Limits, evidence and what to do after a leak

No watermark survives everything. Learn the evidence chain that still gives you options: preserve the file, compare, audit metadata, and only then attribute.

Start the interactive demoAll 13 chapters
Before you start

Your mission in this chapter

  1. Learn

    Preserve enough evidence to make a responsible attribution decision.

  2. Try

    Work the checklist in order: freeze the file, record context, compare, audit, then inspect.

  3. Prove

    You can respond to a leak without destroying the evidence or accusing the wrong person.

Loading the interactive demo for "Limits, evidence and what to do after a leak"… The lesson text below is already here. The hands-on part loads next (requires JavaScript).

Practice kit

Take the lesson outside the sample

Fictional fixtures only · downloads stay on your device

Route-test kit

A fictional original, transformed leak, delivery template, and evidence worksheet.

Look for
  • Similarity can support triage without proving a payload survived.
  • A route test must include the actual export or delivery transformation.
  • The evidence record is useful even when the hidden ID cannot be recovered.

All files and identities are fictional training fixtures; they are not evidence of a real leak.

No watermark survives everything. Screenshots, heavy crops, re-recorded photos of screens: all valid exits. This chapter is what still gives you options when tracing fails.

Work the checklist above in order. Preserve, compare, audit, then attribute. Accusations come last or not at all.

The order that preserves options

Freeze first: file plus URL plus time plus handle. Hashes make later copies comparable and takedown notices credible.

Compare before confronting: similarity tells you whether Inspect is worth the run. Metadata tells you about the file's journey. Neither names a human alone.

After the first hour

File takedowns with evidence attached. Fix the route that leaked: method, format, channel. Tell paying supporters what changed without accusing the innocent.

Then make the next drop one you can trace. That is where this course leads: protected delivery.

Takeaways

  • Save the exact file, never a screenshot, and log URL plus time immediately.
  • Similarity and metadata come before accusations; Inspect comes last.
  • Without a delivery log even a perfect recovery names nobody.

Check yourself

Optional, local, instant. 0/2 answered.

  1. First thing after discovering a leak?
  2. In what order do compare, audit, and Inspect come?
Evidence checkpoint

Prove the evidence chain

Lab first

Freeze the evidence before interpretation or takedown work begins.

  1. Work from copies after the source is preserved.

  2. A screenshot of a post is not a substitute for the downloaded file.

  3. Evidence preservation comes before accusations or irreversible notices.

Complete the interactive lab and reach the takeaways first. This records only a local learning checkpoint; it does not certify a real-world route.

For your niche

Photographers

Client leaks are usually carelessness, not malice. Evidence-first response preserves the business relationship while you fix the route.

Subscription creators

Leaks hit revenue within hours. Freeze evidence before takedowns, or the thread with the fingerprints vanishes with the post.

Illustrators & designers

Repost culture blurs lines between theft and tribute. Timestamps plus delivery logs separate them cleanly.

Demo transcript

Questions creators ask

Keep handyLearn glossary11 recurring terms
Carrier
The image content that offers texture or edges where a watermark can be tested.

A carrier estimate is not a survival result.

Delivery ID
An identifier for one particular delivery event or copy.

Keep it separate from the stable recipient ID.

DCT
A transform that represents image blocks as spatial-frequency coefficients.

The Learn visualization is illustrative.

LSB
Least-significant-bit hiding: changing the smallest binary bit of pixel values.

It is fragile under common re-encodes.

Metadata
Attached file information such as EXIF, GPS, software, color, and creation tags.

Metadata hygiene does not protect pixel payloads.

Payload recovery
Successfully reading the hidden identifier from the exact leaked file.

This is different from visual similarity or carrier capacity.

Re-encode
Decoding and saving an image again, often with a different format or quality setting.

It can change pixels, metadata, dimensions, and color behavior.

Recipient ID
A stable opaque identifier for the person or account receiving a copy.

Never recycle it between recipients or releases.

Release ID
An identifier for a batch, edition, or release of content.

One recipient may receive multiple releases.

Similarity
A visual or perceptual comparison suggesting whether two files resemble each other.

It is triage, not attribution.

Stable map
A validated delivery record connecting a recovered ID to one unambiguous recipient.

Duplicate IDs break attribution.

Workflow Upgrade

Make the next drop traceable

Evidence preserves options; tracing prevents repeats. The readiness hub scores your process across metadata, watermark, license and CSV gates.

Open leak playbookSee pricing
Keep reading

Related guides

View all posts
Leak Protection

What to do in the first hour when your content leaks

Panic burns evidence. Preserve the downloaded file, log where you found it, then branch into comparison, metadata, and Inspect based on what protection you actually used.

June 7, 20267 min read
Read article →
Put it into practice

Related free tools

View all tools

Leak Response Playbook & Incident Checklist

Generate a first-hour incident checklist when content leaks: preserve evidence, check similarity, and recover subscriber IDs.

Open tool →

Image Similarity Checker Online

Compare two images online to check visual similarity with perceptual hashing. Runs locally in your browser.

Open tool →