Though it would be wonderful to have a single technique that could reliably tell you whether a photograph can be trusted, the reality is that what is needed is a full toolbox of techniques for sniffing out various clues to an image’s history. As you read through the various forensic techniques that Hany often posts in this blog, you may at times feel overwhelmed by all of the approaches. I find it useful to boil things down to just three main types of photo tampering clues, which I call the three F’s. You’ll find that most of Hany’s techniques can be put into one of these classifications, and, in fact, so can the clues that even non-expert viewers often use in deciding whether to trust a photo.
The first type of clue has very little to do with the picture itself, but instead concerns itself with the way that the picture has been packaged into a file. More specifically, these clues relate to the file format used to store the image as well as the additional information—especially metadata—stored in the file along with the photo. To give an obvious example, if you come across an image stored in Photoshop’s .PSD file format, then it’s a relatively safe bet that the image was touched by Photoshop at some point. (I say “relatively” safe only because there’s also a possibility that it was touched by another software application that can save to that format, but you can be sure the file didn’t come direct from a camera.) Another fairly obvious example is the file creation and modification dates. If these are substantially different, then that indicates that the file was opened and resaved at some point in time.
Not all of the file packaging clues are quite so obvious, however. For example, not all JPEG’s are created equal, though you can’t tell the difference just by browsing images in your average photography software. In fact, the JPEG specification allows for enormous variety in file compression parameters, and every hardware and software product implements a very tiny subset of these. Thus, by inspecting these paramaters with the right tools, you can get an indication of what product last saved the JPEG. If these paramaters don’t match what the original capture device is known to produce, that indicates that the file was resaved at some point after capture. Similar techniques can be applied to analyzing the image thumbnail as well, as detailed in this post.
Of course, the file metadata itself can be a rich source of information about the image. It can tell you which device captured the image, which software last saved the image, and, if you’re really lucky, even which editing operations were applied to the photo.
This just scratches the surface of the things you can investigate, but suffice it to say that you can learn a lot about a photo without ever looking at the photo. Keep in mind, though, that even if you know that the file was touched by Photoshop, you don’t necessarily know that anything was done that fundamentally altered the truth of the photo. That’s where the other two classes of clues are most helpful.
Just as a criminal in a crime scene may leave traces behind, so image editing tools may leave tell-tale clues to their usage. Editing software like Photoshop works not by magic, but by math. Every digital photo is a collection of pixels defined by numerical values that represent individual colors. Each tool in Photoshop works by mathematically combining and manipulating those numerical values in different ways. Inevitably, each type of editing operation can leave behind different traces of what was done. A simple copy-and-paste operation might result in a slight fringe of contrasting color where some of the background color from the source image has been blended with the background color of the destination image. Cloning or content-aware fill can result in patterns of pixels that are repeated in multiple locations in the same image. A shadow/highlight adjustment can sometimes result in halos along boundaries between light and dark regions. The Liquify command may cause a stretching or compression of the texture in a portion of the photo. Depending on the skill of the operator, these various traces can be either subtle or obvious.
For some examples of footprints, check out Hany’s post about JPEG ghosts, as well this post which describes how a difference in the amount of detail in a shadow region can be a telltale sign that something has been erased.
By developing an understanding of each of the key editing tools and how they manipulate the image, you can develop better skills at identifying what edits may have been performed on an image. Care should be taken, however, not to confuse traces of tampering with naturally occuring image artifacts, as described here.
Though the increasing sophistication of editing tools has made image manipulation much easier, truly emulating reality remains difficult. More importantly, we are not as adept as we may think in spotting many errors in realism. As Hany has discussed previously in this blog, studies have shown that people are particularly insensitive to errors in lighting, shadows, and reflections. Thus, when someone is editing a photo and simply eyeballs things to get their shadows right, there’s a good chance they’ll get them wrong. Armed with the proper techniques, you can spot these and other flaws in realism and identify fraudulent photos.
Many of the techniques Hany has described in this blog fall into the footprints category. In particular, check out Hany’s discussion of shadows and reflections. For a more subtle technique, check out this post regarding inconsistencies in the lighting on eyes.
You can think of the three F’s as a checklist to go through when analyzing an image. If you have access to the image file itself, it’s helpful to start with an analysis of the file. Then scan the image visually for footprints left behind by editing tools. Finally, you can test for flaws in realism by examining shadows, reflections, perspective, and so on.
Ultimately, our goal at Fourandsix is to introduce tools that make all of this analysis much easier, but there remains a lot you can do with the tools and knowledge already at your disposal.