Image Forensics

What it is and why it matters

A photograph used to be hard to fake convincingly. Now every phone has editing built in and a messaging app can strip a picture of everything that said where it came from. Image forensics works with what is left: the metadata if it survives, the way the file was compressed, the noise the camera's sensor left in the pixels and the geometry of light and shadow in the scene. No single one of these settles a question. The examiner looks for several independent signs that agree.

The questions follow a pattern. Source identification asks which device or software produced the file. Authentication asks whether the content has been altered since capture and, if so, where. Content analysis asks what the picture shows and whether it supports or contradicts a claim. Comparison sets an image against another image or a known person or object. Enhancement makes something easier to see and is always reported as a processed copy, never as evidence that the image is genuine.

Metadata deserves a word of warning. EXIF fields such as the camera model, date and GPS position are written by the camera and can be rewritten by anyone with a free tool. Their presence and consistency are useful. Their absence is normal for screenshots and social media downloads and proves nothing by itself. A date in the metadata is a claim the file makes, not a fact the examiner has established.

Types of digital evidence

EXIF, XMP and IPTC Metadata
Camera make and model, capture time, exposure settings, GPS position, software name and edit history as written by the camera or editing program.
JPEG Structure
The order of markers, the quantisation tables and the Huffman tables, which differ between camera makers, phone models and editing software and change when a file is re-saved.
Embedded Thumbnail
The small preview stored inside many image files. It is sometimes left unchanged when the main image is edited, so it can show the picture before the change.
Compression History
Traces of a file having been saved as JPEG more than once, which appear as periodic patterns in the compressed coefficients and point to editing or re-saving.
Sensor Noise Pattern
Photo-response non-uniformity, a fixed pattern of tiny sensitivity differences unique to a sensor. Estimated from reference images, it can link an image to a camera or show a region where the pattern is missing.
Lighting and Geometry
The direction of light, the shadows, reflections, perspective and vanishing points, which must agree across the whole scene in an unaltered photograph.
Device and App Records
Gallery databases, edit histories and cloud sync records on a phone that show when an image was created, edited or received and by which app.
Content Credentials
Cryptographically signed provenance data attached by some cameras and software under the C2PA specification, which records the capture and editing history when present and verifiable.

Devices and data sources

Smartphone galleries, where originals, edited versions and received images sit side by side
Images attached to chats and emails, usually re-encoded by the app
Downloads from social media platforms, which re-compress and strip metadata
Digital cameras and their memory cards, which keep original files in camera formats such as JPEG, HEIF and RAW
Scanned documents and photographs of documents used in financial disputes
Screenshots, which carry no camera metadata at all
Cloud photo libraries reached under lawful authority
Printed photographs that must be scanned before examination

How an examination runs

The order matters. Each step protects the one after it.

01
Obtain the Original File
Ask for the image as a file from the device or the account, not a screenshot or a chat forward. Record the route it took and the generation received.
02
Hash and Survey
Hash the file, open it in a viewer that does not rewrite it and record format, dimensions, colour profile and file size.
03
Read the Metadata
Extract every metadata block with a tool that shows raw fields. Check that the camera model, software name, dates and image dimensions agree with each other and with the file structure.
04
Examine the Structure
Compare the JPEG or HEIF structure and quantisation tables with those produced by the claimed device or app. An editor's tables in a file said to come straight from a phone need explaining.
05
Look at the Pixels
Study lighting, shadows, perspective, edges and noise across the image. Run clone detection and noise consistency analysis and treat every result as a lead to be checked by eye, not a verdict.
06
Compare With Exemplars
Where the claimed device is available, take reference images under similar settings and compare structure, metadata and sensor noise pattern.
07
Weigh the Evidence
Decide what the independent signs support together. One inconsistency may have an innocent cause. Several that point the same way are harder to explain away.
08
Report
Describe the file's generation and every test with its result, then state the conclusion as a degree of support with its limits.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

EXIF: Exchangeable Image File Format, the metadata block cameras write into JPEG and HEIF files. Readable and writable with ordinary tools, so never proof on its own.
Quantisation Table: The set of numbers a JPEG encoder uses to decide how much detail to discard. Different makers and programs use different tables, which makes the table a clue to the file's origin.
Double Compression: The effect of saving a JPEG a second time, usually after editing. It leaves statistical traces that can show the image was re-saved, though not always what was changed.
Error Level Analysis: A visualisation of how much each part of an image changes when re-compressed. Textured areas and flat areas respond differently in any image, so bright patches are not proof of editing. It is a pointer for closer inspection, nothing more.
PRNU: Photo-Response Non-Uniformity, the sensor noise pattern used for source camera identification. It needs many reference images from the same camera and is weakened by scaling, cropping and heavy compression.
Clone Detection: Searching an image for regions that repeat, as happens when part of a picture is copied to cover something up.
Colour Filter Array Trace: The regular pattern left by the way a camera interpolates colour from its sensor. Edited regions can break the pattern.
HEIF and HEIC: The container and format used by recent iPhones and some Android phones for photos. It holds metadata and sometimes several images, and conversion to JPEG changes the file completely.
Generation: How far a file is from the capture. An original, an edited save, a chat forward and a screenshot of that forward are four generations.
Content Credentials: The C2PA approach to provenance, where a signed manifest travels with the file. A valid manifest shows a history. A missing one is the normal state of most files today.

Challenges and limits

What makes it hard

Metadata can be edited, copied from another file or stripped, so it is a starting point and never the conclusion
Messaging apps and social platforms re-compress every image, erasing quantisation tables, sensor noise and most metadata
Error level analysis and similar visualisations are widely misread, and a confident-looking heat map can be wrong in both directions
Sensor noise analysis needs reference images from the actual camera and fails on small, scaled or heavily compressed images
Generative editing tools now fill and extend images with far fewer of the classic traces, so pixel analysis alone grows weaker each year
Screenshots of documents and chats carry no capture metadata, and the question shifts to whether the content is consistent with the app it claims to show
Comparison of faces, marks and objects is open to bias and must follow a structured method with the limits stated

Keeping the evidence intact

Keep the received file unchanged and hash it, because viewers and gallery apps can rewrite metadata silently
Work on copies and keep every processed version labelled with the steps that produced it
Record the tool and version for every test, since results vary between versions
Separate enhanced images made for viewing from the untouched file used for authentication
Keep reference images and their capture settings with the case so the comparison can be repeated

Standards and legal considerations

SWGDE Best Practices for Image Authentication
SWGDE's image documents, including Best Practices for Image Authentication, Guidelines for Forensic Image Analysis, Best Practices for Image Content Analysis and Best Practices for Maintaining the Integrity of Imagery, set out how each type of image examination is done and reported.
Read the guide
ENFSI Best Practice Manual for Digital Image Authentication
The European manual on authentication of digital images, with the examination strategy, the methods and the way conclusions are expressed.
Digital Imaging and Multimedia Procedure
UK guidance from the Defence Science and Technology Laboratory on handling evidential images, their audio and metadata from capture to disclosure.
ISO/IEC 27042:2015
The analysis and interpretation guideline, relevant wherever an examiner moves from what the pixels contain to what they mean.
Read the guide
C2PA Technical Specification
The Coalition for Content Provenance and Authenticity's specification for Content Credentials, the signed provenance data that some cameras and editors now attach to images.

In practice

An Altered Receipt
A photo of a receipt is submitted in an expense dispute. The metadata names an image editor as the last software, the quantisation tables match that editor rather than the phone's camera and clone detection finds the digit area repeated from another part of the receipt. Three independent signs point the same way.
The Wrong Phone
A person claims a photo was taken on their own phone. Reference photos from that phone give a strong sensor noise pattern that does not correlate with the questioned image, while the questioned file's structure matches a different phone brand. The examiner reports strong support for a different source, not an identification of which one.
A Timestamp Two Hours Off
An image's EXIF time appears to contradict a witness. The phone's settings and the gallery database show the camera wrote local time without a zone marker and the device had been set to another country's zone while travelling. Corrected, the time agrees with the witness.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

VideoSurveillance & Image / Video ForensicsImage & Video MetadataRead EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can proveBeginner

VideoSurveillance & Image / Video ForensicsDeepfake / AI ForensicsExamine face swaps and AI-made media, check C2PA provenance and know where detectors failAdvanced

LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.IntermediateDCFA

Standards for this area

SWGDE Best PracticesSWGDE publishes the free, practical documents that most digital forensic procedures are quietly built on. This page explains how the library is organised, which documents matter for each kind of work and how they relate to the OSAC Registry.Best practice

Careers that use it

Video Forensic Analyst

Questions people ask

Does the EXIF date prove when a photo was taken?

No. It records what the camera's clock said, and it can be changed afterwards with a free tool. It becomes useful when it agrees with the file structure, the device's own records and the content of the picture.

Can you tell whether a photo has been edited?

Often, when the file is an early generation. Editing software, re-saving and content changes leave traces in the metadata, the compression and the pixels. A heavily compressed social media copy may not support any conclusion either way.

What does error level analysis show?

It shows how different parts of a JPEG respond to re-compression. Because texture and flat colour respond differently in every image, it cannot by itself show editing. Examiners use it as one pointer among several, and never as a verdict.

Is a screenshot useful?

It shows what was on a screen at that moment and nothing about the original image. It can be examined for consistency with the app it shows, but the original file is needed for source or authenticity questions.