Alongside the addition of a variable aperture and manual controls, Apple introduced an interesting feature to the iPhone 18 Pro: it’s called Reference Image, and is designed to prove that a photo wasn’t altered at any point after the photons hit the sensor.

This system, which currently only works on the iPhone 18 Pro and Pro Max’s main camera, is a distinct mode in the camera app and is aimed primarily at journalists. It tries to overcome several technical hurdles to ensure that both the data as captured by the sensor and the processed result of that data, can be tied back to a specific device within a narrow period of time. In other words, it tries to authenticate both the Raw and the processing that turns it into a viewable image.

Dale Baskin

Apple isn’t the first company to try to solve this problem. A coalition of companies, including Adobe and several major camera manufacturers, has thrown its weight behind Content Credentials, another system designed to be able to prove that an image is what it claims to be in the age of wholesale AI image generation and assisted editing.

While we’ve written extensively about Content Credentials, Apple has characteristically taken a completely new approach with its own system. So why has it invented its own tech, rather than using the existing standard that some of its competitors have adopted, and how does it work?

What problems is Apple trying to solve?

Apple says it designed the Reference Image system to meet three requirements:

• The resulting image “must faithfully show what the sensor captured,” and you can verify both the Raw capture and the process that turned the raw data captured into a viewable photo
• A false image created via tampering with the sensor, cryptographic software or phone’s OS will fail the verification process. If it’s later discovered that the system verified an image it shouldn’t have, the certificate marking it as authentic must be able to be revoked.
• The images can’t reveal who took them, or whether the same device took any two images. Apple shouldn’t be able to tell what’s in the image when it’s signing it.

The company argues that existing systems like Content Credentials don’t meet these standards. Part of that is because they have different goals; one of the explicit appeals of Content Credentials is that it lets you bake image attribution into the file in a way that’s hard to remove. But Apple also argues that adding a credential after the image is created, as Content Credentials does, leaves space for bad actors to create false images and then sign them as authentic (something that one of our forum members was able to demonstrate with the implementation in the Nikon Z6III).

The system looks to be incredibly robust, which is unsurprising given the level of attacks Apple’s devices have to defend against. (It basically has to assume its systems will be tested by the full capabilities of a hostile government.) It’s built to protect against verifying images made by feeding fake data to the sensor itself through its electrical contacts or by removing it from the phone, and from quantum computers being used to break its encryption, something Apple says no other image provenance systems do. The company says this is to make sure the images are verifiable far into the future; traditional encryption algorithms can withstand most kind of attacks, but because quantum computers work fundamentally differently from the computers they were designed for, they can easily crack them.

What does taking a reference image look like?

The high-level overview is that the phone isn’t always taking Reference Images. You have to purposefully switch to taking them in the camera app, which will reboot the sensor into a special mode. So far, this is only available on the iPhone 18 Pro or Pro Max’s main camera – either in 1x or 2x mode, though not night mode since it appears to only use a single exposure – as it’s a hardware-based feature. Even then, it isn’t available in the EU or China (likely due to its reliance on Apple’s Private Cloud Compute service, which we’ll cover shortly).

Dale Baskin

After you take a reference image, you then have to choose to “develop” it before you’re able to view or share it. You can share the developed HEIC file as a normal photo, viewable by anyone, or as a special reference image that, currently, can only be viewed using an Apple device running its latest software. The person receiving it will be able to see a version with any edits you’ve made, as well as what the camera originally captured, and the interface can even highlight the differences. It will also show verified metadata, such as when the photo was captured. This does, however, rely on them using Apple software on Apple hardware: otherwise, it’ll just render like a normal HEIC.

How does a Reference Image work?

Apple’s document on the technical details of the Reference Image system is, unsurprisingly, pretty complex, so I’ll try to explain it in a way that will make sense to most people.

The process for creating a reference image starts at the factory, when the phone’s sensor and security chip are tied together in a way that Apple can check later, to confirm that the two actually worked together to create and secure the data that it’s interpreting as a photo.

Dale Baskin

When you switch to the camera’s Reference Image mode, it reboots the sensor into a secure mode that basically ignores what the operating system is doing, except for receiving a “digest” that contains a securely computed timestamp range and some identifying information for the device and its security chip. The sensor then collects light and digitizes it into data (as cameras tend to do). It then cryptographically signs it before sending it off the chip. This basically means that the raw data the camera captured can’t be changed by the sensor firmware, phone’s processor, operating system or anything else. Otherwise, the signature created by the sensor won’t match the signature produced by the data, and the system could tell something was wrong. The secure metadata, including what time the photo was taken, is also included in that package, before it’s handed back to the OS for storage

This leaves you with what Apple calls a “secure digital negative,” stored as a DNG Raw file, which you can edit and share like normal if need be. However, to make it a Reference Image, you need to then be able to trust the process that turns that “negative” into a viewable file, as the raw data from the image sensor isn’t actually an image. Even when opening a Raw file on your computer, what you’re actually seeing is that data processed in several ways, like demosaicing to interpret color, lens corrections and the application of a tone curve. You are seeing your program’s interpretation of the Raw, not the data itself (which is why it may look different from program to program).

This is where the second part of the system comes in. After you’ve taken the picture, you can choose to “develop” it into a Reference Image (something that doesn’t happen automatically, and which requires an internet connection). When you do, that “digital negative” is sent to Apple’s Private Cloud Compute servers, which will then recompute the “digest” containing the timestamp and data from the phone and its security chip, ensure the certificate matches the raw data and that it was actually issued by the sensor. It checks a few other things too, making sure that the sensor and the security chip haven’t been altered since they left the factory.

Apple says it takes great pains to ensure that the timestamp attached to the image is accurate. Rather than using on the device’s clock, your phone routinely gets cryptographically-signed timestamps from Apple’s servers, which it uses to create a window of time that the image must’ve been taken in, based on the timestamp it received before it was taken, and the next one it received, after. (Apple says this happens on average every 15 minutes, though it’ll depend on network connectivity; it can also account for phones that are offline for long periods of time).

After the Private Cloud Compute service has checked over all the certificates, it creates what’s called a confidence score for the image, which decides how likely it is that it is a real photograph based on how well the data matches “physical characteristics expected of raw output from our sensors.” It then turns the Raw into a JPEG before “hashing” it, creating a signature that ensures that the rest of the development process won’t change it, and to identify any subsequent changes that occur after the image is returned to the user.

The JPEG’s unique identifier, the hash for its Raw, the confidence score and the sensor’s ID, though not the JPEG itself, are sent to a separate service, which checks a few things. Most importantly, it makes sure the image wasn’t created by a sensor that’s been added to a revocation list for having uploaded fake or suspect data. Apple keeps a running tally of the confidence scores attached to the images submitted by each sensor; if that number gets low enough, indicating that something suspicious is happening with that device’s reference images, the Private Cloud Compute service will never sign pictures from it again.

If everything checks out, though, the service signs the JPEG with Apple’s signature, letting everyone know that it passes the company’s technical checks. Importantly, this replaces the photographer in the chain of trust: the company says the system intentionally doesn’t provide a way to identify who took a reference image, to the point where you can’t even use it to tell if two photos were taken by the same phone. It only tells you that Apple can attest to it being unaltered from the point of capture. The Private Cloud Compute server then sends the JPEG, packaged as a HEIC, back to the phone, and moves the “digital negative” to the trash, for deletion after 30 days (though you can tell it not to delete it within that timespan if you want).

Whenever you go to view that image on a supported device, using supported software, it’ll check to make sure it still has the signature, and that Apple’s system hasn’t retroactively revoked it. From there, you’re able to make edits to it, though the end user will be able to see the original, provided you share the Reference Image HEIC, rather than an exported JPEG.

In Apple we trust?

Apple

As with most security standards, whether or not you believe an Apple Reference Image is a source of truth*will require putting some amount of faith in the company. The company has a relatively solid track record when it comes to security and cryptography, so it’s not implausible that it could implement a system like this, and Apple says the Private Cloud Compute software that turns those into viewable photos is publicly auditable. Of course, if you’re not a security and cryptography expert, you will have to trust researchers to actually do that work and communicate that it is, in fact, safe.

To me, the real act of faith won’t be in deciding whether the pictures Apple certifies are genuine. It’s trusting the company to never revoke a certificate of a legitimately-captured image for any reason, something that it appears to have the power to do. I also have to assume the system will occasionally get it wrong, either signing an image that shouldn’t have been signed, or not signing one that should, and the test will be how Apple reacts in such situations. Or, indeed, whether it bothers to continue operating the service indefinitely, irrespective of profitability and take-up.

The company has a history of standing up to governments – even powerful ones in the US and UK – when ordered to compromise user privacy and security, and offers some of the most comprehensive protection modes you can get on a phone. However, its track record isn’t spotless. It famously handed off control of the iCloud data for its users in China to comply with the country’s laws, a move that Reuters reports will give that government “far easier access to text messages, email and other data.”

Notably, the Reference Image feature isn’t available in China. It’s also not immediately launching in the EU – Apple is currently in a spat with the bloc over how much privilege it gives its own services on iOS – but the company has at least promised that it’ll bring the feature to the EU at some point in the future.

The chicken and the apple

Mitchell Clark

I’d like to leave you with a few parting thoughts. While there is undoubtedly use for pictures that are in some ways verifiable – especially as journalistic institutions change, and as news is increasingly captured on phones, both by professionals and everyday people – it’s also worth considering how much that can actually move the needle.

We live in a relatively low-trust environment, where large groups of people can’t agree on even relatively basic facts. (Calling topics “debated” would be giving too much credit; debate implies people are willing to change their minds based on evidence presented.) While people not being able to trust images is certainly a problem, especially at scale, there are a lot of examples of hard evidence being ignored because it’s inconvenient.

This is, frankly, not really a problem that Apple can even solve, no matter what technical expertise it brings to bear. I also shudder to think of us handing over that responsibility to a private company, more than we already have. But I also think that it’ll be hard to get back to a place where images are trustworthy again, because it’s a chicken and egg problem: you can’t rely on things like Reference Image or Content Credentials as an indicator of whether an image is fake or not until most or all of the real images you see have them attached. Sure, they can “prove” an image is authentic, but with their limited market penetration, they’re currently not very useful in spotting fakes.

Even if you could flip a switch today and have every picture taken on an iPhone be easily verifiable on any platform where they’re displayed (something that’s currently absolutely not true of the much more widely-adopted Content Credentials), it would probably still require sweeping social changes for that to actually matter. Again, though, that’s not really within Apple’s control. But as things stand, there’s at least one more tool that journalists and citizens can use to try to prove that their images are authentic… assuming the viewing public trusts the system, and that those trying to verify the image own enough new Apple products to do so.

* As much as any photograph can be. Pictures can depict what happened in a moment, but you still have to trust that the photographer or person or organization sharing the image are being honest about the context surrounding it.

As a reviewer covering the camera industry, I spend a lot of time in comments sections, forums and subreddits, seeing what people think of the latest releases and the rumors of what’s coming next. While I often see smart, informed discussions happening, this habit also exposes me to some… interesting takes.

As an example. This is more of a problem on other sites and on social media than on DPReview (though it’ll occasionally happen here) I’ve noticed a recent trend under many articles about new or upcoming cameras – even budget models – where there will be a few comments that are something along the lines of “No global shutter?” And then other people will chime in agreeing that the camera is DOA without one, and an example of manufacturers cheaping out or being behind the times.

And I just have to say: what are you all talking about?? Do you even know what a global shutter is, or are you just asking for one because you’ve heard it’s cool?

Thankfully, these comments aren’t common here on DPReview, and I know most of you are familiar with the concept of a global shutter. But for those that aren’t: it’s a sensor design that lets you capture and read out every pixel, simultaneously, as opposed to having to read them out line-by-line like you have to on cameras with a rolling shutter. This essentially instantaneous readout is even faster than a traditional focal plane mechanical shutter, and is much faster than standard e-shutter readout modes.

Richard Butler

It is a genuinely useful technology for certain scenarios. It lets you sync with flash at effectively any shutter speed (though it can take some trial and error), and capture even the fastest-moving subjects without any risk of the skewing that can happen with rolling shutter*. It can also reduce the risk of banding when shooting under LED lights or photographing a subject with an electronic display behind them. There is still the risk of catching a display when its dark or refreshing, depending on your exposure duration and how fast the screen is, but it gets rid of any potential mismatches between refresh and shutter rates. Global shutters are luxurious for video, too, as there’s absolutely no Jell-o effect no matter how fast your pan, or if you point your camera out of a moving car or towards an arriving train.

Mitchell Clark

I get that it can kind of feel like camera technology has stagnated in recent years, and that people are hungry for a big leap forwards in performance. But let’s take a step back and look at the reality of the situation for a second.

There has only been one full-frame hybrid mirrorless camera released with a global shutter: the Sony a9 III. It is aimed at professional sports and action shooters, and is priced accordingly, coming in $6800. The tech is a bit more common in the world of cinema cameras, but doesn’t come for cheap there, either.

The a9 III also has a notable drawback: its complex readout circuitry limits how much light it can tolerate, pushing its base ISO up to 250 and limiting the image quality you can get out of it compared to other full-frame cameras. The best image you can take with it will have up to a stop and a third more noise than the best image out of another full-frame camera with a base ISO of 100. Its peak IQ performance is much closer to that of an APS-C camera, though at the same ISO settings it’ll still out-perform a camera with a smaller sensor.

With a sample size of one, it’s hard to say if this is inherent to modern global shutter designs (some older CCD chips also had global shutters), or is simply an aspect of this particular sensor, but it’s certainly worth noting if you’re advocating that basically every new camera should have a global shutter. They are not an unalloyed upgrade in every way. Instead, current global shutter sensors make trade-offs in order to be better for some niche use-cases.

Which is why I really do not understand why people say that they should be in every camera, from the most budget options on up. Putting aside whether that’s even economically realistic, do we really think beginner photographers absolutely need perfectly parallel lines in action shots using e-shutter, and that it’s so important that it’d be worth giving up some image quality for?

I want to make it clear that I’m not advocating for consumers to just take what they’re giving and not ask for more from companies. It’s totally fine to look critically at cameras and say “I think you could do better.” (I mean, that is essentially my job.) And I understand the desire for there to be at least one or two less expensive options with global shutter for those that would use them for their purpose, but that don’t have the cash for a top-of-the-line pro camera.

But I think that if we’re going to spend energy campaigning for improvements, they should be ones that are actually sensible, and that are good matches for the target market. It’s one thing to recognize that image quality appears to be plateauing, but, to me, it’s hard to say that means every camera should include a more expensive technology that trades some IQ for a behavior that’s only really useful in very specific situations.

*- To be fair: the fastest stacked sensor cameras with rolling shutters, which have readout speeds within the 2-4ms range, have also essentially eliminated that risk.

I’m not sure how it took us so long to get back to this point, but in my head, the launch of the OM System PEN marks the return of a time when keen photographers have some really good choices for travel. 

Not travel photography as in ‘spend thousands of dollars to go to Iceland or Namibia, and drag your medium format setup to painstakingly capture one perfect desktop background,’ but a camera I can carry with me to document my trip.

Between the Fujifilm X100 VI, the Panasonic L10 and the OM System PEN, photographers once again have a choice of conveniently-sized cameras with a good level of control, whether they prefer a prime lens camera, a fixed zoom compact or the lens choices of mirrorless. They’re all pretty small, they’re all fairly pretty, and they’re all usefully totable.

Richard Butler

When I first started at DPReview, the options available were a DSLR, if you wanted decent image quality, or a (literally) compact camera, which you could carry around, but whose images you would probably be disappointed by. In between were the supposed “bridge” cameras, which inexplicably adopted some of the size of a DSLR with the image quality of a compact, rather than offering any sort of useful middle ground between the two.

This is why I’ve always loved larger-sensor enthusiast compacts with bright lenses (LX3, XZ-2, G7X), and why I can remember running to the Olympus stand as Photokina 2008 first opened, so I could share some of the first photos of the original Pen mockup.

Richard Butler

I love a camera that’s easy to always carry with me but also one that delivers sufficient image quality to make that worthwhile. And for a while there, we got close: the Fujifilm X100, the Panasonic GF1 and GX1, amongst others. Then the options started to disappear.

The past few years have seen a lot of camera makers focus on full-frame cameras, but even the best attempts at downsizing those aren’t great. Putting aside that Panasonic S9 and original Sony a7C are among my least favorite cameras of the last few years, my concerns aren’t so much the bodies as the body/lens combinations. Yes it’s easy to cherry-pick one particular lens when trying to make “it’s almost as small” arguments. But, even on the rare occasions where that pancake is a focal length I want to use, and the word “almost” isn’t being tested to breaking point, there’s still little hope of building a usefully small kit.

Richard Butler

I’ve just got back from a short vacation with the PEN and found it to be a very amiable companion. I took the 12mm F2.0, 17mm F1.8 and 14-42mm, which gave me a remarkable degree of flexibility in combinations I could take everywhere with me. Add in a 45mm F1.8 and it would cover an awful lot of my favored photography, in the space of a small shoulder bag.

The PEN makes a very welcome addition to the existing options of a Fujifilm X100 VI, which is built around my preferred single focal length, and the Panasonic L10, whose lens covers a very useful range with a combination of brightness and size that even the PEN would struggle to match. Add to these the Ricoh GR IVs, with a 40mm-equiv. “x” version in the works, and you have some really interesting options.

All of these cameras is imperfect in one way or another: the L10’s lens isn’t everything you might hope for, the PEN’s AF is distinctly quirky and after six iterations, Fujifilm has managed to make the X100 VI that bit more fiddly than it needs to be. But, for all those gripes, it’s lovely to have choices that don’t take over my entire carry-on.

Vamanos! Allonz-y! However you say it; let’s just GO!

Earlier this week, OM System announced the PEN, a small, interchangeable lens camera with a Four Thirds sensor. Our initial review mainly focuses on it versus the higher-end range-finder style cameras that it descends from and competes against, but it’s worth also looking at how it compares to the other cameras at the $1000 price point. Because while it’s true that you can get a larger sensor for the same money, it’s also worth considering what you give up for that additional light-gathering capability.

Meet the contenders

The PEN joins the now-rarified halls of cameras that retail for under $1000 (body only, you’ll still need to add a lens), while still offering a good level of manual control. Nowadays, that list includes some very capable APS-C cameras, such as the Canon EOS R10, Nikon Z50II and Fujifilm X-T30 III. They all boast similar spec sheets, with sensors that range from 20-26MP, relatively fast burst rates and strong video features.

But given that they use larger and therefore presumably slightly more expensive sensors, surely there’s a catch somewhere…

IBIS

OM System’s forebear, Olympus, was a pioneer when it came to including in-body image stabilization in its cameras, and the PEN continues in that tradition. And it’s an undoubtedly useful feature to have, letting you use slower shutter speeds while still shooting handheld, provided you’re shooting a stationary subject.

While Nikon, Canon and Fujifilm offer kit lenses that have optical image stabilization, giving you a similar benefit (at least in stills, not so much in video), the PEN’s stabilized sensor works with any lens, including the primes many photographers will want to pick up. However, it’s worth keeping in mind that primes are typically faster, giving you the option to raise your shutter speed by opening up the aperture, and are often in easier-to-hand-hold focal lengths. Plus, the PEN’s IBIS system is less powerful than what we’re used to, providing only 5.5EV of correction in the center, compared to the up to 7.5 that’s typical in other models (including the OM-5 II, which can achieve it by synchronizing with a lens’s optical stabilization, something the PEN can’t do).

To get an APS-C camera with IBIS, you’re looking at spending several hundred dollars more – the price of one of those fun prime lenses – likely thanks in part to the fact that the system has to be more robust to move around a larger sensor. So while it’s not the end-all be-all, it is a clear point in the PEN’s favor.

Weather sealing

OM System has leaned into its reputation for making rugged, weather-sealed cameras, and the PEN is no exception. It comes with an IPX1 rating, and while the “X” indicates that it hasn’t been tested for dust resistance, OM says it has that, too. That’s a relatively light rating – it means the camera can survive dripping water for 10 minutes, when fitted with a similarly sealed lens (don’t worry, OM System has plenty) – but it’s more than you’ll get with any of the other $1000 cameras we’re looking at today. 

Whether that’s because OM System is able to include it (or pay the licensing fees for an IP rating) because of the lower component costs on its sensors, or that it’s just something the company prioritizes more than the others is hard to say, but it’s peace of mind that’s unusual at this price point.

Computation

Richard Butler

Micro Four Thirds cameras were some of the first attainable ILCs to make use of computational photography, taking multiple shots and stitching them together to produce a higher resolution version, simulate an ND filter and more. Some of these features are enabled in part by IBIS, but it’s also possible thanks to clever algorithms and relatively fast sensor readout speeds, something you won’t get with all of the APS-C options.

Even if the hardware were capable of it, the fact is that Nikon, Canon and Fujifilm haven’t put in the work to replicate these features, so their respective cameras don’t offer anything of the sort. You have to step all the way up to a Panasonic full-frame camera to get anything similar with a larger sensor (even then it’s mainly just the ability to shoot handheld high-resolution multishot), which is a very different size, weight and price point indeed.

Size

A Four Thirds sensor is physically smaller than an APS-C one, which means you can theoretically build a smaller, lighter body around it. However, while the OM System PEN is small, it’s not unbelievably so; there have been other Micro Four Thirds cameras that are appreciably more compact, including other models in the PEN line and the venerable GM1 and GM5 from Panasonic. And, indeed, the APS-C Fujifilm X-M5 manages to be a bit smaller, though it doesn’t have an EVF or sensor stabilization. There are even some full-frame cameras that aren’t too much bigger, such as the Panasonic S9 and Sony a7C II.

Richard Butler

However, the PEN is a fair bit smaller than the cameras we’re comparing today, largely thanks to the prominent grips and SLR-style humps on the EOS R10, X-T30 III and Z50II (though the X-T30 III actually manages to be a touch lighter).

The real size benefit comes from the lenses, though. While there are some size-comparable APS-C lenses on the market, it’ll be easier to gather a collection of Micro Four Thirds lenses that are smaller and lighter than their APS-C counterparts without having to pick and choose focal lengths too carefully to optimize for size. That’s even more true for full-frame options.

Size isn’t the biggest win for the PEN, but it’s definitely still worth considering.

Trade-offs go both ways

Of course, none of this is to say that the OM System is better in every way than its price-comparable competitors with larger sensors. Besides the image quality benefits, Nikon, Canon and, to a lesser extent, Fujifilm, have more modern autofocus systems, and all of them are substantially better options if you wish to shoot video relatively seriously. The APS-C cameras also all have built-in flashes, which some people will appreciate, and most of them manage to match the PEN when it comes to burst rates and pre-capture (not that OM System is pitching this as anything like an action camera).

There are absolutely reasons why some people would go with one of $1000 APS-C camera over the $1000 PEN. Perhaps they’re looking for a camera that’s a bit more capable for sports and wildlife, or are more serious about video. But it’s worth acknowledging that you will be giving up some nice-to-haves in the process, or having to pay way more to get them.