Blog Forensics 7 min read Updated

What is Error Level Analysis and How to Use It

A practical guide to ELA — the JPEG forensics technique that reveals photo manipulation by exposing compression inconsistencies.

Error Level Analysis heatmap showing compression differences in a manipulated photo

What ELA Does

Error Level Analysis (ELA) detects photo manipulation by exploiting how JPEG compression works. When a camera saves a photo as JPEG, every region is compressed at the same quality level. If someone later edits part of the image — pastes in an object, clones out a person, adds text — and saves it again, the edited region has a different compression history than everything around it.

ELA makes that difference visible. It re-saves the image at a known quality level, then calculates the pixel-by-pixel difference between the original and the re-saved version. The result is a heatmap: brighter areas changed more during re-compression. In an unedited photo, brightness should be roughly uniform. Edited regions stand out because their compression artifacts behave differently.

Try it free: ELA Scanner — run Error Level Analysis on any JPEG, right in your browser.

Why JPEG Compression Makes This Possible

JPEG is lossy — it permanently discards image data to shrink file size. It divides the image into 8×8 pixel blocks, applies a mathematical transform (DCT) to each block, then quantizes the results based on the quality setting. Each save loses a predictable amount of additional data.

Here's the forensic insight: a photo saved once at quality 90 will lose a certain amount when re-saved at 90 again. But if part of the image was edited and saved at quality 85, that region has a different compression history. When ELA re-compresses the whole thing, those regions respond differently — and the heatmap reveals exactly where.

This is why ELA works best on images saved once or twice after editing. Repeated re-saves gradually equalize error levels everywhere, washing out the evidence.

Reading the Heatmap

An unedited JPEG produces a roughly uniform ELA heatmap. Edges and high-contrast areas (text, sharp object boundaries) naturally appear a bit brighter — they contain more high-frequency data that changes more during re-compression. But the overall pattern should be consistent.

A bright patch that doesn't match its surroundings is the primary signal. It means those pixels changed more during re-compression than expected — often because they were pasted from another image, generated by a cloning tool, or filled by content-aware fill. The reverse also happens: a suspiciously dark region in an otherwise bright ELA image can indicate heavy smoothing or airbrushing that removed the compression artifacts.

Watch for false positives. Solid color areas (sky, walls) compress efficiently and often look darker — that's normal. Camera noise in shadows creates patterns unrelated to editing. Images saved at very high quality (95-100%) show higher error levels everywhere. Don't mistake these for tampering.

Want to check a photo for manipulation? Run an Error Level Analysis and see the heatmap instantly.

Try ELA Scanner →

How to Run an ELA Scan

Open the ELA Scanner, upload your JPEG (drag-and-drop, paste with Ctrl+V, or browse). Everything runs client-side — your image stays in your browser. The default re-compression quality of 90% works for most images. Lower it to 85% for more sensitivity, raise it to 95% for subtler analysis. The amplification scale (10-15× is a good start) controls how much the error differences are magnified.

Compare the heatmap side-by-side with the original. Look for regions where brightness doesn't match the surroundings, especially around object boundaries. Rectangular patches aligned to 8×8 block boundaries are a strong indicator of block-level editing. If something looks suspicious, cross-check: EXIF metadata may show editing software tags, the Authenticity Checker runs a multi-signal assessment, and the AI Detector can tell you if the image was generated entirely by AI rather than edited.

What ELA Catches — and What It Misses

ELA is best at copy-paste composites (objects pasted from one image into another), cloned or healed regions, and text overlays — anything that creates a localized compression mismatch. Text is especially easy to catch: sharp high-contrast edges compress very differently from photographic content and light up clearly in the heatmap.

It struggles with uniform edits. Color adjustments, brightness changes, and filters applied to the entire image affect all regions equally — no localized mismatch, nothing for ELA to flag. It also only works on JPEG. PNG and other lossless formats don't produce compression artifacts, so re-saving them creates no error difference. And the biggest limitation: multiple re-saves destroy the evidence. After 5-10 saves at the same quality, edited and original regions converge. Images pulled from social media are usually re-compressed by the platform, which overwrites the forensic signal.

Complementary Techniques

JPEG ghost analysis takes a different angle: it re-compresses across a sweep of quality levels and looks for regions that "settle" at a different quality than the rest — revealing spliced content from a source saved at a different JPEG quality. Where ELA shows you where error levels diverge, ghost analysis tells you which quality level each region was originally saved at. Full breakdown in our JPEG ghost analysis article.

Thumbnail mismatch detection is another strong complement. Camera-original JPEGs contain a tiny embedded preview created at capture. If someone edits the main image but the software doesn't regenerate the thumbnail, the preview still shows the unedited scene. This catches modifications that fool both ELA and ghost analysis — more in our EXIF thumbnail guide.

Common Questions

Does ELA work on PNG images? No. ELA relies on lossy JPEG compression behavior. PNG is lossless — re-saving produces an identical file with no error differences to analyze. You can convert a PNG to JPEG first, but results will be less reliable than analyzing an original JPEG.

Can a manipulated photo pass ELA? Yes. If an edited photo is re-saved multiple times at the same quality, compression levels gradually equalize everywhere. After 5-10 re-saves, ELA differences become too small to catch. This is why ELA works best on images saved only once or twice after editing.

What do bright areas mean? Higher error levels — those pixels changed more during re-compression than expected. In an unedited photo, brightness should be fairly uniform. Bright patches against a darker background suggest different compression history, which often means editing.

How is ELA different from AI detection? ELA finds edited regions in real photos by analyzing compression artifacts. AI detection determines whether an entire image was generated by DALL-E, Midjourney, or similar. Use ELA for edited photos, AI detection for fully synthetic ones.

Is ELA admissible as evidence? Not typically as standalone evidence. Forensic analysts include it in full authentication reports alongside metadata analysis, visual inspection, and chain-of-custody documentation. Courts generally want multiple corroborating methods.

Compression Doesn't Lie

ELA turns the invisible math of JPEG compression into a visual map of image integrity. It has limits — JPEG only, degrades through re-saves, blind to uniform edits — but as a first-pass check for tampering, nothing else is as fast or as visual.

The ELA Scanner runs the full analysis in your browser — upload a JPEG, adjust the quality sweep, and see the error map instantly. Your images never leave your device.

Try ELA Scanner
Share:
S

Scanly.co — 92 free image analysis tools

Photo forensics, metadata, privacy, OCR, and utilities. All client-side.

Advertisement