Comparing unused data in -htmldump files

[AL10]

I am comparing a known original image from an iphone 6 to an edited version of the same image. I am comparing the two to see what differences in unused data come up with a non-original image that is edited in an application. These tests are being done to identify structural changes in unused data to determine if an image was opened and edited in another program. I am running -htmldump command to see what unused data differences show up between the two images. *I was recently advised on this forum to run an -htmldump to look at the brown areas (unused data) and compare them with a known original image to compare differences since cameras usually add extra unused data that other applications do not.

However, the edited image appeared to add unused data and not take away unused data. I was expecting for unused data to be taken away, but as you can see in IMG_4112.jpg (the edited image) adds more unused data instead of taking away from the known original IMG_4111.jpg. Was this person wrong and perhaps just phrased there sentence backwards? Do edited images in applications add unused data and instead of take away data?

[StarGeek]

Do edited images in applications add unused data and instead of take away data?

It's going to depend upon the programmer.  There's not just a single way to do do things and different programs are going to do different things.

[Phil Harvey]

Typically firmware adds more unused data than software.  But the iPhone pictures are written by software, not firmware.  ExifTool for example adds no extra spaces (except for 1-byte padding for word alignment).

But there is no hard and fast rule, as StarGeek says.

- Phil

[AL10]

Ok. So point being, if I receive an image from an iphone 6 and it doesnt match that same unused data structure it means it was likely processed by another app?

[Phil Harvey]

Or another version of iOS perhaps.  But yes, likely different software.

- Phil