Image Forensics Explained — 5 Ways to Spot Manipulated Photos

Every digital photo carries invisible fingerprints — compression artifacts, metadata timestamps, pixel-level patterns that change the moment someone opens the file in an editor. Image forensics is the practice of reading those fingerprints to determine whether a photo has been altered, and how. It won't always tell you what's real, but it will tell you what's been touched. Scanly offers five forensic tools that run entirely in your browser — no uploads, no server processing. Try Error Level Analysis free →

Analyze Image Free

1. Error Level Analysis (ELA)

When a JPEG image is saved, the entire image is compressed at the same quality level. Every region ends up with similar compression artifacts. If someone pastes a new element into the image — a different face, an added object, a removed logo — that region has a different compression history. It was saved at a different quality level, or resaved more times, or came from a different source entirely.

Error Level Analysis exploits this. It resaves the image at a known quality level and compares the result to the original. Regions that change significantly have higher "error levels" — they show up as bright areas in the ELA output. Unedited photos produce relatively uniform ELA maps. Edited photos show bright spots where foreign elements were inserted.

The catch: ELA highlights compression differences, not edits specifically. A photo resaved multiple times will show artifacts even without manipulation. Sharp edges and high-contrast boundaries naturally produce higher error levels. ELA is a screening tool — it tells you where to look, not what happened. Use Scanly's Error Level Analysis tool to run ELA on any image.

2. JPEG Ghost Analysis

JPEG ghost analysis is related to ELA but approaches the problem differently. Instead of resaving once and comparing, it resaves the image across a range of quality levels (from 50% to 99%) and looks for "ghosts" — regions that disappear at a specific quality setting.

The logic: if an image was originally saved at quality 85%, resaving it at exactly 85% should produce minimal differences — the compression is idempotent at the same setting. But if part of the image was pasted in from a source saved at quality 75%, that region will behave differently when resaved at 85% versus 75%. It "ghosts" — becomes invisible — at its original quality level but remains visible at other levels.

This method is particularly useful for detecting splices where someone combined elements from photos saved at different quality settings. The JPEG Ghost tool sweeps through quality levels automatically and highlights regions with inconsistent compression origins.

3. Clone Detection

Clone stamping is one of the most common photo edits. Someone wants to remove an object — a person, a sign, a blemish — so they copy pixels from a nearby area and paint over the unwanted element. The result looks natural to the eye because the texture and lighting match, but the image now contains two regions with identical or near-identical pixel patterns.

Clone detection algorithms scan the image for these duplicated regions. They break the image into small blocks, compute a signature for each block, and compare all signatures against each other. When two blocks in different locations match beyond a statistical threshold, they're flagged as potential clones.

False positives happen with naturally repetitive textures — brick walls, grass, fabric patterns, sky gradients. But cloned regions from deliberate editing usually appear in unnatural positions: identical cloud formations on opposite sides of the frame, or matching skin texture appearing where a person was removed. The Clone Detection tool draws connecting lines between matched regions so you can evaluate whether the duplication is natural or deliberate.

4. Metadata Inspection

EXIF metadata is embedded in every photo by the camera or phone that captured it. It records the camera model, lens, exposure settings, GPS coordinates, timestamps, and software used to process the image. This data is invisible in the image itself but tells a detailed story about how the file was created and modified.

Forensically, metadata reveals several things. Software tags show which programs touched the file — "Adobe Photoshop CC 2024" in the metadata of a photo claimed to be straight from the camera is a red flag. Timestamp inconsistencies between the "date taken" and "date modified" fields suggest post-processing. GPS coordinates can confirm or contradict claimed locations. Serial numbers and lens data can link photos to specific devices.

The limitation: metadata is trivially easy to strip or forge. Most social media platforms remove it automatically. Anyone with basic tools can delete or overwrite EXIF fields. Metadata absence proves nothing — metadata presence is useful but not conclusive on its own. Check any image's metadata with the EXIF Viewer, or strip it for privacy with the EXIF Remover.

5. Forgery Heatmap

A forgery heatmap combines multiple forensic signals into a single visual overlay. Rather than running each analysis separately and interpreting the results yourself, the heatmap aggregates indicators — compression inconsistencies, noise level variations, edge artifacts — and renders a color-coded map over the original image. Warmer colors indicate higher probability of manipulation.

This is the most accessible entry point for people who aren't familiar with forensic techniques. You don't need to understand JPEG compression math or know what a DCT coefficient is. Upload the image, look at the heatmap, and see which regions the algorithm considers suspicious. The Forgery Heatmap tool generates this overlay instantly in your browser.

The trade-off is precision. A heatmap is a summary — it can miss subtle edits that individual techniques would catch, and it can highlight regions that are artifacts of normal photography (lens distortion at edges, high-ISO noise patterns). Use it as a first pass, then follow up with specific tools on flagged regions.

When Forensics Works — and When It Doesn't

Image forensics is most effective on original files. A JPEG straight from a camera retains all its compression fingerprints, metadata, and noise patterns. Every edit disturbs these signals in detectable ways.

Forensics becomes unreliable when the image has been processed through multiple stages — downloaded from social media (recompressed), screenshotted (re-rendered), or converted between formats. Each transformation adds its own artifacts and destroys the original signals. A photo that's been shared through WhatsApp, screenshotted on someone's phone, and then posted to Instagram has been through three rounds of recompression. At that point, forensic analysis will flag artifacts from the platform processing, not from human editing.

AI-generated images present a different challenge entirely. They have no original camera data, no compression history from editing, no cloned regions — they're synthetic from the first pixel. Traditional forensic tools aren't designed for this. Scanly's AI Detector uses pattern analysis specifically trained to distinguish AI-generated images from photographs.

Combining Methods for Stronger Evidence

No single forensic technique is conclusive on its own. ELA highlights compression differences that could be edits or could be normal artifacts. Metadata can be stripped or forged. Clone detection flags natural patterns alongside deliberate duplications. The power of forensic analysis comes from convergence — when multiple independent methods flag the same region, the probability of manipulation increases substantially.

A practical workflow: start with the Forgery Heatmap for a quick overview. If it flags specific regions, run ELA and JPEG Ghost analysis on the same image to see if compression analysis agrees. Check Clone Detection for copy-paste operations. Inspect the metadata for software and timestamp evidence. If three or more methods point to the same area, you have strong forensic grounds to question the image's authenticity.