Photo Forensics Software for OSINT, Journalism & Digital Investigation
Photo Forensics Studio is free photo forensics software that runs entirely in your browser. It combines the pixel-level methods used in professional image authentication — error level analysis, JPEG ghost detection, copy-move (clone) detection, noise-variance mapping and bit-plane statistics — with a full audit of the file itself: EXIF, GPS, XMP edit history, IPTC, ICC profile, JPEG quantization tables and quality estimate, C2PA / Content Credentials presence, trailing data and embedded thumbnails. Every exhibit is hashed (SHA-256, SHA-1, MD5) over its original bytes before anything is decoded, and the whole examination can be exported as a printable evidence report with the parameters of every method, so a second examiner can reproduce it. The methods follow the practice described by the Scientific Working Group on Digital Evidence (SWGDE) for image authentication: multiple independent techniques, documented parameters, and conclusions drawn only where methods agree.
Detection methods at a glance
| Method | What it detects | How it is computed here | Known limits |
|---|---|---|---|
| Error Level Analysis | Regions that re-compress differently from the rest: splices, local edits, pasted elements from lower-quality sources | Re-save at the chosen JPEG quality (default 75), map the absolute difference; 16 px block errors are normalised by each block's edge content and flagged beyond 6 MAD above the median (or far below it, for pre-compressed pasted content); a verdict needs a contiguous cluster | Edges and text are naturally bright; heavy recompression, resizing and screenshots erase the signal |
| JPEG ghost sweep | Content that carries an earlier JPEG compression history different from the file's own (copy-pasted from another JPEG) | Re-save at qualities 40–100 in steps of 5 at native resolution; a block whose error dips at a quality other than the file's own quantization-table quality is a ghost; the quality forming the largest cluster is reported | Pasted regions smaller than ~200 px or not aligned to the 8×8 grid are often missed; PNG/WebP sources have no own-quality reference |
| Copy-move (clone) detection | A region duplicated elsewhere in the same image (clone stamp, healing brush, object removal) | 16 px blocks every 4 px, brightness-normalised 4×4 mean features, lexicographic neighbour matching, offset voting; an offset counts when ≥20 pairs agree (scaled with image size), the shift is ≥32 px and the source blocks form a coherent region | Repeating textures (brick, tiles, text) can match legitimately; rotated or rescaled clones are not matched |
| Noise variance map | Regions whose sensor-noise level differs from the rest: spliced content, generative fill, local denoise or blur | Residual against the 8-neighbour mean per 8 px block; the noise floor is estimated on low-texture blocks only and outliers beyond ±3.5 MAD are clustered | Skies and shadows are naturally smooth; a near-zero floor means a rendered, upscaled or AI-generated image and is reported as such |
| Luminance gradient | Inconsistent lighting direction between an object and its scene | Sobel-style gradient; direction mapped to hue, magnitude to brightness | Visual aid only; not scored |
| Bit planes + chi-square | Sequential LSB steganography; unnatural low-bit structure | LSB planes of R,G,B shown; Westfeld–Pfitzmann pairs-of-values chi-square on the blue channel | Meaningful only for lossless formats; JPEG decoding destroys LSB payloads |
| EXIF thumbnail check | Editing after capture; metadata transplanted from another photo | Embedded EXIF thumbnail correlated with the downscaled image (flag below 0.95, notable below 0.85) | Some cameras and transfer tools write a differently processed thumbnail |
| Metadata & structure audit | Editor signatures, re-saves, generative-AI markers, stripped EXIF, resized images, appended data | EXIF IFD0/ExifIFD/GPS/IFD1, XMP (CreatorTool, dates, xmpMM:History, IPTC digital source type), IPTC, ICC, JPEG quantization tables → quality and IJG-standard check, progressive flag, subsampling, APP markers, COM, bytes after EOI, C2PA/JUMBF presence | Metadata is trivially editable; its absence proves nothing |
How Do You Tell If a Photo Has Been Edited?
No single test proves manipulation. Error Level Analysis, first described by Dr. Neal Krawetz at the Black Hat Briefings, exposes regions that respond differently to re-compression; JPEG ghost analysis (Farid, 2009) finds content that was saved at a different quality before it was pasted in; copy-move detection finds duplicated blocks; noise analysis finds regions with a foreign noise floor. The studio runs all of them and reports each one as no signal, weak or notable with the numbers behind the call. The question to ask is whether two or more independent methods point at the same region, and whether that region coincides with an object rather than with edges, text or sky. The metadata audit then tells you how the file got here: which software last wrote it, whether its EXIF dimensions still match the pixels, whether it carries an XMP edit history or a generative-AI source-type tag, and whether a C2PA manifest is present.
What Does Metadata Reveal About a Photo?
EXIF records the camera make and model, lens, exposure, capture time and often GPS position; XMP records the editing software and, in xmpMM:History, every save step; IPTC carries captions and credits. The studio decodes all three, converts GPS to decimal coordinates, and cross-checks them: a DateTimeOriginal that differs from ModifyDate, EXIF dimensions that differ from the actual pixels, a progressive JPEG (cameras write baseline), 4:4:4 chroma subsampling, non-standard quantization tables or an editor's name in the Software tag each tell part of the story. It also reads the JPEG container itself: estimated save quality from the quantization tables, APP markers (Adobe, Photoshop IRB, ICC), comment segments, embedded JPEG headers and any bytes appended after the end-of-image marker.
Can This Tool Detect AI-Generated Images?
Partly, and honestly: there is no reliable pixel-level detector for modern diffusion models, and this tool does not pretend to be one. What it does check is what generators and their pipelines leave behind — a near-zero noise floor (reported explicitly), IPTC DigitalSourceType values such as trainedAlgorithmicMedia, PNG text chunks with generation parameters (Stable Diffusion, ComfyUI), XMP creator tools, and C2PA manifests that many generators now attach. For provenance-based verification of Content Credentials, see the C2PA Inspector (decode and verify a Content Credentials manifest without uploading) and the AI provenance & C2PA hub: a valid credential is a positive signal, and absence proves nothing.
Evidence Report & Chain of Custody
Enter a case ID, exhibit prefix and examiner name, drop one or many files, and export the examination as a printable report (save it as PDF from the print dialog) or as JSON. Each exhibit carries the SHA-256, SHA-1 and MD5 of the original bytes, format and dimensions, the parameters of every method, the result images, the plain-language verdicts and the full metadata, plus a method summary a second examiner can follow. Because the hashes are computed before decoding, anyone can confirm that the report describes the same file they hold.
RAW Files
TIFF-based RAW formats (DNG, CR2, NEF, ARW, PEF, ORF, RW2 and others) are read for their full EXIF/MakerNote-adjacent metadata and the largest embedded JPEG preview is analysed with all pixel-level passes. The sensor data itself is not demosaiced in the browser, and the report says so for each RAW exhibit.
OSINT Investigation Workflows
For investigators, image forensics is one step in verifying a photo. Combine the studio with OCR text extraction to read text in the image, the steganography tools for deeper hidden-data tests, reverse image search to find the earliest copy, and the GPS coordinates it extracts to cross-reference the claimed location. A fuller walkthrough is in the image forensics guide; the video counterpart is the Video Forensics Studio. For a side-by-side with FotoForensics, Forensically, Ghiro and Amped Authenticate, see photo forensics software compared.