Photo-forensics: detecting fakes in photos

Detecting Image Manipulation: Photo-Forensics Tools Explained

The photo-forensics service analyzes images for signs of editing—even when metadata has been stripped. Upload a file and run Clone Detection to spot duplicated regions—this tool highlights copied or stamped areas in pink. Error Level Analysis (ELA) compares JPEG compression levels: modified sections appear brighter or darker than the original.

ELA works best with JPEGs, where the entire image should have uniform compression. Smooth areas like skies are typically darker than textured ones. Deviations from this pattern suggest insertion or retouching.

Deep Dive into ELA Tools

• Edges: High-contrast edges are brighter than low-contrast ones in the original. Discrepancies indicate tampering.
• Textures: Similar surfaces show consistent ELA levels. Detailed areas appear brighter than smooth ones.
• Surfaces: Flat regions remain uniform regardless of color. Re-saving JPEGs equalizes differences, while Adobe software often sharpens edges.

Re-compression reduces high-frequency details, making ELA darker. Scaling increases edge contrast.

Additional Analysis Methods

Noise Analysis applies a median filter to reverse noise reduction. It detects airbrushing, distortions, and perspective-based cloning—most effective on high-quality images.

Level Sweep scans the histogram: scroll your mouse wheel to boost contrast across brightness levels, revealing gaps caused by copy-paste edits.

Gradient analysis examines changes along X and Y axes: checks lighting consistency and edge integrity. Sudden gradients on isolated edges point to insertions. Also effective at catching noise and compression artifacts.

PCA and Basic Checks

Principal Component Analysis (PCA) identifies anomalies in color and compression artifacts across 2–3 components. No need to dive into math—use it as a confirmation tool.

Other useful checks:

• Metadata — EXIF data, if still present.
• Geotagging — GPS coordinates.
• Thumbnail inspection — hidden previews that differ from the main image.
• JPEG analysis — structure, quantization tables. Progressive JPEG, IPTC, SOS/DHT markers reveal editing tools and optimizations.
• Text extraction — scans ASCII content: look for strings like 'Photoshop 3.0' or 'bFBMD' from Facebook.

Key Takeaways

• Clone Detection and ELA cover 80% of cases right away.
• Inconsistencies in compression, gradients, or noise confirm manipulation.
• JPEG analysis and text scanning uncover traces from editors like Photoshop.
• A full forensic check takes just 1–2 minutes for mid-level verification.

Practicing on real files builds intuition: every pixel holds clues. Combining tools minimizes false positives.

— Editorial Team