Forensically

Jonas Wagner publishes Forensically at 29a.ch as a beta. Everything runs client-side in JavaScript and the page states that images are never uploaded to a server, with an offline mode for working without a connection. The tools are a magnifier, clone detection, error level analysis, noise analysis, level sweep, luminance gradient, principal component analysis, metadata and geo tag readers, thumbnail analysis, a basic C2PA content credential reader, JPEG analysis and string extraction. Raw camera files are not supported and the author recommends a 24-bit PNG as the best input. The page is free to use and names no licence.

The value of Forensically is that each tool makes one idea visible. Error level analysis re-saves the image and shows where the compression error differs, which can point at a pasted region but, as the author warns, can mislead. Clone detection looks for repeated blocks. Noise analysis and the luminance gradient show where lighting or sensor noise are inconsistent. Thumbnail analysis compares the embedded thumbnail with the main image, which sometimes still shows the picture before an edit. JPEG analysis shows quantisation tables and structure that hint at the software that last saved the file. None of this is proof. A result is a hypothesis to test with other methods and with the file's provenance, and the author's own caution that it cannot tell true from false belongs in any training session built on it. For casework the examiner moves to validated software with documented methods and a report. The date of use goes into the notes as well, because a web page can change without a version number.