Four Forensic Signals That Expose Edited Images
One bright patch in an Error Level Analysis scan does not prove a photo was doctored. Neither does a matching block pair in clone detection, an odd noise profile, or a missing EXIF tag. Each of those signals has a specific failure mode that makes it unreliable on its own. The proof is in convergence: when all four forensic techniques point at the same region of an image, the case goes from interesting to strong.
This is an article for rockimg.com that walks through each technique, explains exactly where it breaks down, and shows why combining them is the only approach that holds up.
Published on: August 2, 2026
How Editing Leaves Traces
Editing software alters a photo in ways that go beyond what the eye can see. Re-saving a JPEG changes its compression history. Cloning a texture duplicates pixel blocks that would never repeat naturally. Compositing elements from two cameras disrupts noise patterns at the boundary. And the software itself often stamps its name into the file's metadata. Each type of edit leaves a different kind of fingerprint, which is why four independent signals are needed to cover the ground.
Error Level Analysis: The Compression Fingerprint
Every time a JPEG is saved, the encoder cuts the image into 8x8 pixel blocks, transforms each block into frequency values, divides those values by a quality table, and rounds. That rounding is permanent. In an untouched photo, every region has been through this process the same number of times at the same settings, so the entire frame settles at a similar error level.
Paste content from another image and save again. The pasted region carries a different compression history. An ELA tool re-compresses the image at a known quality and maps the difference between the original and the re-saved version. Regions that glow brighter than their surroundings have been through fewer rounds of compression, or different settings, than the rest of the frame.
Where ELA breaks down. ELA on a PNG or a fresh maximum-quality JPEG export will look bright everywhere, because there is almost no compression history to compare against. Natural contrast differences (a bright sky next to a detailed treeline) also shift error levels without any manipulation involved. Treat ELA as a reason to investigate further, not as a verdict.
Clone Detection: Matching Block Fingerprints
A common manipulation technique: copy one part of an image and paste it over another to hide or duplicate an object. Clone detection algorithms divide the image into overlapping blocks, compute a fingerprint for each block, and then sort those fingerprints to find near-identical matches in different parts of the frame. Tools like Forensically mark similar regions in blue and connect them with a red line; when many regions overlap, the result can appear white.
Where clone detection breaks down. Large uniform areas (clear skies, white walls, solid backgrounds) will produce matching blocks by nature. Clone detection works best on images with varied texture and detail, where a genuine duplicate stands out from the surrounding content. A sky full of blue matches tells you nothing.
Noise Consistency: Different Cameras, Different Grain
Every camera sensor produces a characteristic noise pattern. The grain in a phone photo at ISO 800 looks different from the grain in a studio shot at ISO 100. When someone composites elements from two different source images, the noise profile changes at the boundary.
Noise analysis tools isolate the noise using a separable median filter. This can reveal airbrushing, deformations, warping, and perspective-corrected cloning. A related technique, noise naturalness mapping, measures the kurtosis of the noise distribution. Real camera noise follows specific statistical patterns, while AI-generated images often produce noise with lower kurtosis values, which a naturalness map renders in red. Regions matching natural photo statistics appear green.
Where noise analysis breaks down. It works best on high-resolution images. Smaller images tend to contain too little information for meaningful measurement. A low-resolution crop will not give you a reliable noise profile.
Metadata Forensics: What the File Header Reveals
A photo straight from a camera typically includes the camera make and model, lens information, shutter speed, aperture, ISO, GPS coordinates, and a timestamp. Software like Photoshop, GIMP, or Lightroom writes its own signature into the metadata when it saves a file. A photo that claims to be an unedited original but carries an editing software tag has been through an editor.
Where metadata breaks down. Missing metadata is not evidence of tampering on its own. Stripping EXIF is common for privacy reasons, and plenty of legitimate workflows remove it. Metadata can also be spoofed. On its own, a stripped file header proves nothing. Combined with suspicious ELA or noise results, it adds weight.
The Blind Spot Table
| Technique | What It Catches | Blind Spot |
|---|---|---|
| ELA | Regions with mismatched compression history | PNGs and max-quality JPEGs look uniformly bright; natural contrast shifts mimic edits |
| Clone Detection | Copy-pasted textures, stamp-cloned areas | Uniform regions (skies, walls) produce false matches |
| Noise Analysis | Composites from different cameras, AI-generated content | Low-resolution images lack enough data for reliable measurement |
| EXIF Metadata | Editor software tags, inconsistent timestamps | Metadata can be stripped or spoofed intentionally |
No single row in this table gives you a definitive answer. Each technique's blind spot is wide enough to drive a false positive through.
Convergence: When All Four Agree
The case becomes strong when the signals stack. ELA highlights a region with anomalous compression history. Clone detection finds duplicated blocks in that same area. Noise analysis shows a different grain profile at the boundary. And the file's metadata carries an editing software tag where the sender claimed the photo was untouched.
That convergence is hard to fake, because an image manipulator would need to defeat four independent detection methods simultaneously. The absence of any single signal does not clear the image, and the presence of any single signal does not condemn it. The question is always whether the signals agree.
You can run all four analyses in a browser with a single upload. The analysis runs locally in JavaScript and the HTML5 Canvas API, so the image never leaves your machine. Drag in a JPG, PNG, WebP, or BMP, wait a few seconds, and review each tab. ROCKIMG's image manipulation detector supports ELA, clone detection, noise consistency, and metadata extraction in one interface.
One important framing to keep in mind: these tools function as a magnifying glass for images. They reveal details that would otherwise be hidden, but they cannot by themselves determine whether a manipulation was deceptive. Extraordinary claims require extraordinary evidence, and a single bright ELA patch is not extraordinary evidence. Four converging signals, though, start to look like it.