Blog Forensics 7 min read

Fake Photo Detection — 6 Methods That Actually Work

A photo lands in your inbox, your feed, or a news article. It looks real. But is it? Here are six forensic methods that go beyond "zoom in and squint" — each one catches a different type of fake.

Fake photo detection methods — forensic analysis techniques

Fake photos come in three flavors. Manipulated photos start real and get altered — objects removed, faces swapped, backgrounds changed. Composites stitch pieces from multiple photos into one scene that never existed. AI-generated images are entirely synthetic, created by neural networks from text prompts or other images. Each type leaves different traces, and no single detection method catches all three.

Try it free: Authenticity Checker — Run automated forensic checks on suspect photos. Runs in your browser, no signup needed.

The practical approach is to run multiple independent checks. Each method examines a different layer of the image — metadata, compression, pixel patterns, noise — and produces its own set of indicators. When several of them point to the same conclusion, you have something solid.

Method 1: Automated Authenticity Screening

Before diving into specialized tools, start with a broad sweep. The Authenticity Checker runs seven independent checks in a single pass: EXIF metadata consistency, software detection, timestamp analysis, compression patterns, a lightweight ELA scan, noise consistency, and C2PA content credentials. It produces a confidence-scored verdict and highlights which specific checks raised flags.

Think of it as triage. The authenticity checker won't tell you exactly what was faked, but it will tell you whether the image warrants deeper investigation and point you toward which specialized tools to use next. A clean result from all seven checks doesn't guarantee the photo is genuine — but a dirty result from multiple checks means something is off.

The Software field deserves special attention. If the metadata says "Adobe Photoshop CC 2026" or "GIMP 2.10," the file passed through editing software. That's not proof of malicious manipulation (photographers adjust exposure and crop), but it establishes the file was modified after capture. Check the timestamps too: a DateTimeOriginal from January and a ModifyDate from March means the file was reopened months later. The EXIF Checker shows the full metadata breakdown.

Method 2: Error Level Analysis

ELA exploits the way JPEG compression works. A camera saves a photo at a specific quality level — say, quality 90. Every pixel in that image has been compressed uniformly. If someone edits the photo and re-saves it, the edited regions compress differently because they have a different compression history than the untouched areas.

The ELA Scanner re-compresses the image and measures how much each pixel changed. The result is a heatmap where brightness indicates error level. Uniform brightness = uniform compression = probably unedited. Bright patches against a dark background = regions that were modified or inserted at a different quality level.

ELA works best on JPEGs that haven't been re-compressed multiple times. Every re-save degrades the forensic signal. It also has false positives on high-contrast edges and solid-color areas — a sharp text overlay on a photo will "light up" in ELA even though it's a normal edit, not a forgery. Use ELA as a pointer, not a verdict. When it flags a region, investigate that region with other tools.

Run 7 independent forensic checks on any photo — metadata, ELA, noise, compression, and more.

Detect Fake Photos Now →

Method 3: Forgery Heatmap

The Forgery Heatmap takes a different approach than ELA. Instead of looking at compression artifacts, it analyzes pixel-level statistical properties across the image and builds a probability map of manipulated regions. Areas with anomalous statistical signatures — inconsistent noise distributions, unusual gradient patterns, or suspiciously smooth patches — get highlighted with warmer colors on the heatmap.

This method complements ELA because it catches edits that don't involve re-compression. If someone carefully painted over a detail using the healing brush tool and exported as PNG (lossless), ELA would see nothing because there are no JPEG compression artifacts to detect. The forgery heatmap can still flag the region because the painted pixels have different statistical properties than naturally captured ones.

The heatmap is particularly effective at detecting retouching — skin smoothing, blemish removal, object erasure — where the editor blended new pixel data into the existing image. The boundaries of retouched areas often have subtle statistical discontinuities that the human eye misses entirely.

Method 4: AI Detection

AI-generated images — from Midjourney, DALL-E, Stable Diffusion, and similar tools — are a different beast. They aren't edits of real photographs. They're entirely synthetic, generated pixel by pixel by a neural network. Traditional forensic methods that look for editing traces won't catch them because there was no original photo to edit.

The AI Detector uses neural network classifiers trained to distinguish AI-generated images from photographs. It looks for patterns characteristic of generative models: unnatural high-frequency textures, systematic artifacts in hair and skin rendering, inconsistent perspective geometry, and spectral signatures that differ from camera sensor output.

AI detection is probabilistic, not definitive. The tool produces a confidence score — below 30% suggests a real photo, above 70% suggests AI generation, and the zone in between is inconclusive. AI generators improve constantly, so edge cases will always exist. The AI detection guide covers the technical details and current limitations.

Some fakes combine both: a real photograph with AI-generated elements composited in — a synthetic face on a real body, or an AI-generated background behind a real person. These hybrid fakes are the hardest to catch and require both forensic tools (for the compositing seams) and AI detection (for the synthetic elements).

Method 5: JPEG Ghost Detection

This method is surgical. It catches one specific type of fake: composites where elements saved at different JPEG quality levels were combined into a single image.

Here's the scenario: a photographer exports a landscape at quality 92. Someone else takes a portrait exported at quality 75, cuts out the person, and pastes them into the landscape. The final image is saved at quality 85. Now the landscape region has been compressed at 92, then again at 85. The person has been compressed at 75, then at 85. These different double-compression histories create "ghosts" — regions that react differently when re-compressed at various quality levels.

The JPEG Ghost Scanner sweeps through quality levels 60–99, measuring per-pixel error at each level. At the quality level matching a region's original compression, that region shows minimal error (it's already at that quality). The mismatch between regions reveals the splice boundaries.

JPEG ghost detection is less useful for edits that stay within a single file (like clone stamping or retouching) because the entire image shares the same compression history. It specifically targets composites from multiple source files.

Method 6: Embedded Thumbnail Comparison

JPEG files from cameras include a tiny thumbnail image embedded in the EXIF data. The camera generates this thumbnail at capture time. When someone edits the main image but doesn't explicitly regenerate the thumbnail, the thumbnail preserves the original, unedited version of the photo.

The Thumbnail Scanner extracts this embedded thumbnail and compares it to the main image. Differences between them are direct evidence of post-capture editing. If the thumbnail shows a person who was erased from the main image, or if the sky color was changed, you can see exactly what was altered by comparing the two side by side.

This method is limited: many editors do regenerate thumbnails on save, web-optimized images often strip thumbnails entirely, and images from messaging apps rarely retain them. But when the thumbnail exists and doesn't match, it's one of the most compelling forms of evidence because you can literally see the before-and-after.

The Stacking Principle

Each of these six methods has blind spots. ELA misses edits that don't involve re-compression. Forgery heatmaps can flag innocuous image features. AI detectors produce false positives on heavily filtered photos. Thumbnail comparison fails when thumbnails are stripped. No single tool gives you a definitive yes-or-no answer.

The reliable approach is stacking: run multiple independent methods and look for convergence. If the authenticity checker flags compression inconsistencies, ELA highlights a specific region, and the forgery heatmap independently flags the same region — that's three independent signals pointing to the same conclusion. The probability of all three producing false positives on the same area is low.

Start broad with the Authenticity Checker, then go deep on whatever it flags. The Photoshop detection guide walks through the full workflow step by step, and the photo verification guide covers the 6-step process professional fact-checkers use. For the full technical background on each forensic technique, the image forensics guide has everything in one place.

Common Questions

How accurate is fake photo detection? No single method is perfect. Each catches specific edit types and misses others. Accuracy improves dramatically when you combine multiple methods — three independent flags on the same region give high confidence. Professional examiners never rely on just one tool.

Can these tools catch AI-generated images? Traditional forensics (ELA, clone detection) find editing traces in real photos. AI detection uses different classifiers for synthetic images. Hybrid fakes — real photos with AI elements — need both approaches.

Does social media destroy forensic evidence? Mostly, yes. Platforms re-compress images and strip metadata. You're analyzing a degraded copy, which limits detection. Request the original file when possible. Our article on which platforms strip EXIF data covers the specifics.

What if I find a fake? Document everything — screenshot each analysis result, note which tools flagged which areas. For legal contexts, preserve the original file and generate a SHA-256 hash for chain-of-custody. Remember that forensic indicators suggest manipulation but rarely prove it conclusively on their own.

Six Lenses, One Verdict

Fake photos survive casual inspection because they're designed to. They don't survive systematic forensic analysis because edits leave traces at levels the human eye can't reach — compression layers, noise distributions, statistical anomalies, embedded thumbnails. Use these six methods, stack the results, and let convergence do the work.

Detect Fake Photos Now
Share:
S

Scanly.co — 92 free image analysis tools

Photo forensics, metadata, privacy, OCR, and utilities. All client-side.

Advertisement