How-to Guides Forensics

How to Detect an Edited Photo

Check a photo for signs of editing: metadata, the embedded preview, JPEG recompression traces, error level analysis, noise and cloned regions.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page
On this page

Steps

  1. Keep the original and record its hash

    Work on the earliest copy you can get, ideally the file as sent rather than a re-shared version. Record its SHA-256 with the File Checksum Calculator so you can later show the file you analysed was not changed.

  2. Read the metadata first

    Drop the photo into Image Forensics and open Metadata. Look at the camera make and model, the Software field, and whether DateTimeOriginal and the modification date differ. A missing EXIF block is itself a clue.

  3. Compare the embedded preview with the pixels

    Open Preview vs Pixels. Many editors rewrite the image but leave the small JPEG preview inside the file untouched, so a mismatch can show the scene before the edit.

  4. Check how the JPEG was saved

    Open Quantization and Double JPEG. Textbook library tables with camera metadata, or a double-compression signature, mean the file was re-saved after leaving the camera.

  5. Look for regions that behave differently

    Step through ELA, Noise, JPEG Ghost and Block Analysis. Compare similar surfaces: a pasted or retouched area often has a different error level, noise texture or JPEG grid from its surroundings.

  6. Run clone detection

    Open Clone Detection and press Run clone detection. Clusters of matching blocks at a fixed offset suggest an area was copied elsewhere in the same picture, for example to hide an object.

  7. Check Content Credentials and export the report

    Open Content Credentials to read any C2PA manifest the creating app embedded. Then open Report to collect every finding and the file hashes in one place.

What you need

The photo file, preferably a JPEG as close to the camera as possible, and some patience. All analysis passes run in your browser and the image is never uploaded. Expect to compare several views rather than rely on one.

Reading the result

Imagine a claim photo of a car door, sent straight from a phone. The tool shows:

  • Metadata: a phone make and model, no Software field, but a modification date a day after DateTimeOriginal.
  • Preview vs Pixels: the finding "The embedded EXIF preview does not match the image pixels". In the small preview, the door has a large dent; in the full image, it does not.
  • ELA: the door panel is noticeably brighter and smoother than the adjacent wing, which has similar paint and lighting.
  • Clone Detection: a cluster linking the door to a patch of the rear panel at a constant offset.

Each of those alone has innocent explanations. Together they tell a consistent story: the photo was retouched after it was taken, and the preview still shows the original. Use this table to weigh what you see:

Signal Suggests Common innocent cause
Editor named in Software Saved by an editor Routine cropping or exposure fixes
Preview differs from pixels Pixels rewritten after capture Rotation or crop that did not refresh the preview
Library quantization tables with camera metadata Re-saved outside the camera Messaging apps that recompress
Bright patch in ELA Area saved differently High-contrast edges and text are always bright
Clone cluster Copy-move edit Repeating textures such as tiles or brick

Common pitfalls

  • Treating one view as a verdict. ELA lights up edges, text and saturated colours in untouched photos too. The tool's own caveat applies: ELA is a comparative indicator only.
  • Analysing a re-shared copy. Social networks and messaging apps resize and recompress, which wipes out fine traces and adds global ones. Ask for the original.
  • Expecting JPEG tests on a PNG. Quantization, Double JPEG and Block Analysis need JPEG data. A PNG or a screenshot has no compression history to read.
  • Reading "no double compression" as "compressed once". A second save at a lower quality can erase the signature.
  • Missing AI-generated images. A picture generated from scratch may have no editing traces at all. AI Upsampling looks for one typical artifact, and natural repeating textures can trigger it too.

Going further

If the location or time in the photo matters, cross-check it as described in How to Find Where a Photo Was Taken. For evidence that may be challenged, keep the original untouched, note its hash and every step you took, in the spirit of a Chain of custody.

Try these tools

Image Forensics

Analyze photos for tampering with ELA, noise analysis, clone detection and EXIF metadata extraction.

File Checksum Calculator

Calculate MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 checksums of one or many files and compare them with a published value.

See also

  • Glossary Error level analysis (ELA)
    Error level analysis (ELA) recompresses a JPEG at a known quality and maps how much each area changes.
  • Glossary Metadata
    Metadata is data about data: the hidden or secondary information a file carries about itself, such as its author, creation date.
  • Glossary Chain of custody
    The chain of custody is the documented record of who handled a piece of evidence, when, where and why, from collection to presentation.
  • Guide How Image Formats and Compression Work
    JPEG, PNG, GIF, WebP, AVIF, HEIC and SVG compared with measured file sizes, lossy versus lossless, aspect ratio and print maths.
  • How-to How to Find Where a Photo Was Taken
    Read the GPS coordinates a phone or camera stored in a photo, check them against the capture time and daylight.

Frequently Asked Questions

No. Each test finds statistical traces that are consistent with editing, and a careful forger can avoid some of them. A clean result means no trace was found, not that the image is authentic. Strong conclusions come from several independent signals pointing the same way.

Technically yes, and the metadata and recompression tests will often notice it. What matters is whether the content was changed: objects added, removed or moved. That is what the local tests such as ELA, noise and clone detection look for.

Back to the how-to guides
AdSense Placeholder
Slot: footer_leaderboard