Which forensic technique should I use first?

Start with an automated authenticity check — it runs metadata analysis, compression pattern review, and software signature detection in a single pass. If the result is suspicious, follow up with ELA for local edits, JPEG ghost analysis for spliced regions, and thumbnail mismatch for any modification. Layer techniques based on what each one finds.

Can image forensics prove a photo is genuine?

No single technique can prove a photo is genuine with absolute certainty. Forensics can identify signs of manipulation or inconsistency, and passing all checks increases confidence that the image is unmodified. But a skilled editor who understands forensic methods can potentially evade individual checks. Multiple passing results across different techniques provide the strongest evidence of authenticity.

Can forensic analysis be done on screenshots?

Screenshots are challenging for forensics because the screenshot process strips original metadata and recompresses the image. ELA and ghost analysis lose most of their signal. Visual inspection, AI detection, and screenshot-specific analysis still work. For best results, always try to obtain the original file rather than a screenshot.

Are these forensic tools admissible in court?

Individual tool outputs are typically not accepted as standalone evidence. However, forensic analysts routinely include ELA, metadata analysis, and compression pattern results in full authentication reports submitted in legal proceedings. Courts generally require multiple corroborating methods plus expert interpretation. File hash verification (SHA-256) is the most widely accepted technique for establishing file integrity.

Complete Guide to Image Forensics: 8 Analysis Techniques

Q: Do these techniques work on AI-generated images?

AI detection is a separate technique from traditional forensics. ELA, JPEG ghosts, and thumbnail analysis are designed for detecting edits to real photos. They may produce inconclusive results on fully AI-generated images because those images were never captured by a camera. Use a dedicated AI detector for generation detection, and traditional forensic techniques for edit detection.

Why No Single Test Is Enough

Digital image forensics is an arms race. For every detection technique, there's an editing method that can evade it. ELA catches compression inconsistencies — but re-saving equalizes them. Thumbnail analysis catches overlooked previews — but smart editors regenerate them. AI detectors catch generation artifacts — but generators keep improving.

Try it free: Authenticity Checker — Run a multi-signal forensic check on any photo. Runs in your browser, no signup needed.

The solution isn't a better single test. It's layered analysis — running multiple independent techniques that target different types of evidence. A manipulated photo might fool one check, maybe two. Fooling all eight is exponentially harder. Here's each technique, what it catches, and what it misses.

1. Error Level Analysis (ELA)

Error Level Analysis re-saves a JPEG at a known quality level and measures how much each region changes. In an unmodified photo, all areas change roughly equally — they share the same compression history. In an edited photo, pasted or cloned regions show different error levels because they were compressed a different number of times.

Best for: detecting locally spliced or cloned elements in JPEG images.

Limitations: doesn't work on PNG (lossless), degrades after multiple re-saves, misses uniform global edits like color grading. Read the full guide: What is Error Level Analysis?

2. JPEG Ghost Analysis

JPEG ghost analysis sweeps across compression quality levels (50–99) and looks for regions that reach minimum error at a different quality than the rest of the image. When you splice a region from a quality-75 source into a quality-92 photo, ghost analysis lights up exactly that region at quality 75.

Best for: detecting content composited from images saved at different JPEG quality levels.

Limitations: fails when source and destination share the same quality, degrades after multiple re-saves, doesn't apply to non-JPEG formats. Full explanation: How JPEG Ghost Analysis Works.

3. Thumbnail Mismatch Detection

Camera-original JPEGs contain a tiny embedded preview (typically 160×120) in the EXIF IFD1 section. The thumbnail mismatch scanner extracts this preview and compares it to the current main image. If they differ, the photo was modified after the camera created it — and the thumbnail shows the original scene.

Best for: catching any modification to camera-original JPEGs, regardless of how skillfully it was done.

Limitations: requires an embedded thumbnail (web images and social media downloads lack them), some editors regenerate the thumbnail on save. Detailed guide: What Is an EXIF Thumbnail?

Start with an automated authenticity check — metadata, compression, and software analysis in a single pass.

Check Photo Authenticity →

4. Steganography Detection

Image steganography analysis looks for hidden data embedded in pixel values — typically in the least significant bits (LSB) where changes are invisible to the eye. Statistical tests like chi-square analysis and entropy measurement reveal whether bit patterns deviate from natural photographic noise.

Best for: detecting covert data hidden inside images — a different category of manipulation than visual editing.

Limitations: JPEG compression destroys most LSB steganography, advanced techniques (F5, OutGuess) are harder to detect, and legitimate images can occasionally trigger statistical anomalies. Full guide: What Is Steganography?

5. AI-Generated Image Detection

The AI image detector uses a neural network trained to distinguish photographs from images created by generators like DALL-E, Midjourney, and Stable Diffusion. It analyzes texture patterns, noise characteristics, and structural features that differ between camera-captured and AI-synthesized images.

Best for: identifying fully AI-generated images mixed in with real photographs.

Limitations: less effective on hybrid images (AI-edited real photos), accuracy drops on screenshots and heavily compressed files, models need continuous updating as generators improve. Full guide: How to Detect AI-Generated Images.

6. File Hash Verification

The file hash scanner computes cryptographic digests (MD5, SHA-256) of the entire file. If two files produce the same hash, they're bit-identical. If a hash doesn't match a known reference, the file has been altered — even if the change is invisible.

Best for: verifying file integrity, establishing chain of custody, detecting any modification (visual or metadata-only).

Limitations: any change breaks the hash — even benign metadata edits or re-saving at the same quality. For visual similarity rather than exact identity, use perceptual hashing. Background: What Is a File Hash?

7. Screenshot Detection

The screenshot scanner analyzes metadata patterns, resolution characteristics, and compression signatures to determine whether an image is a direct photograph or a screenshot of another source. Screenshots strip original metadata and recompress, destroying forensic signals from the original.

Best for: identifying images that have been screenshotted (and therefore lost their original forensic value), detecting potential fabrication via screen capture.

Limitations: some screenshots closely mimic photographic characteristics, and a screenshot of a screenshot compounds detection difficulty. Guide: How to Detect Screenshot Images.

8. Automated Authenticity Checking

The authenticity checker runs multiple forensic tests in a single automated pass — metadata consistency, software signature analysis, compression pattern review, thumbnail match, and timestamp verification. It synthesizes results into an overall authenticity assessment.

Best for: a quick, thorough first-pass analysis before digging into individual techniques.

Limitations: automated scoring may miss nuance that manual analysis catches, and legitimate photos with unusual processing (HDR, computational photography) can score lower than expected. Workflow: How to Verify Photo Authenticity.

🔍 Pro tip

For bulk investigations, the Batch Scanner processes up to 50 images at once — extracting EXIF, computing hashes, counting faces, scoring AI probability, and running NSFW classification in a single pass. Use it to triage, then send flagged images to individual forensic tools.

Building a Forensic Workflow

The order matters. Start broad and narrow down:

Step 1 — Automated authenticity check. Run the authenticity checker for a quick composite score. If it passes cleanly, the photo is likely unmodified. If it flags concerns, proceed to specific techniques.

Step 2 — Metadata inspection. Open the EXIF checker and look for software tags (editing software present?), GPS consistency (does the location match the claim?), timestamp logic (was the date plausible?), and camera model consistency.

Step 3 — Compression forensics. Run ELA and JPEG ghost analysis to check for local edits and quality-level mismatches. These two techniques complement each other — ELA finds error-level anomalies, ghosts find quality-level mismatches.

Step 4 — Thumbnail check. If the image has an EXIF thumbnail, compare it with the thumbnail scanner. A mismatch definitively proves modification.

Step 5 — AI and content checks. Run the AI detector to rule out full generation, and the screenshot scanner to verify the image is a direct photograph rather than a screen capture.

Step 6 — Hash and record. Compute a SHA-256 hash of the file for your records. If this is evidence, the hash establishes file identity for chain-of-custody documentation.

What Each Technique Catches

Manipulation Type	ELA	Ghost	Thumb	Auth	AI	Hash
Object removal/addition	✅	⚠️	✅	✅	—	✅
Spliced composite	✅	✅	✅	✅	—	✅
Color/exposure edit	—	—	✅	⚠️	—	✅
Fully AI-generated	—	—	—	⚠️	✅	—
Metadata tampering	—	—	—	✅	—	✅
Hidden data (stego)	—	—	—	—	—	✅

✅ = strong detection, ⚠️ = partial/conditional, — = not applicable

Common Questions

Which technique should I use first? Start with the automated authenticity check — it runs metadata, compression, and software analysis in one pass. If it flags concerns, follow up with ELA, ghost analysis, and thumbnail checking based on the specific signals.

Can forensics prove a photo is genuine? No single technique can prove absolute authenticity. Passing all checks increases confidence significantly, but a skilled editor who understands forensic methods could potentially evade individual tests. Multiple passing results across independent techniques provide the strongest evidence.

Do these work on AI-generated images? AI detection is a separate technique from traditional edit forensics. ELA, ghosts, and thumbnails detect edits to real photos. They produce inconclusive results on fully AI-generated images. Use the AI detector for generation detection.

Can forensics work on screenshots? Screenshots strip original metadata and recompress the image, destroying most forensic signals. Visual inspection, AI detection, and screenshot-specific analysis still work, but confidence is lower. Always try to obtain the original file.

Are forensic tools admissible in court? Individual outputs aren't standalone evidence, but forensic analysts routinely include them in full authentication reports for legal proceedings. SHA-256 hashing is the most widely accepted for establishing file integrity.

Eight Checks, One Verdict

No forensic technique is bulletproof. Each one targets a specific type of evidence and has specific blind spots. The power comes from combining them — eight independent checks, each looking at a different aspect of the image. A photo that passes all eight has strong forensic credibility. A photo that fails even one deserves closer inspection. Start with the Authenticity Checker for a quick overview, then work through the individual tools as needed. Every analysis runs in your browser — your images never leave your device.