forensics.media Subscribe

Error Level Analysis

Has this photo been edited or Photoshopped?

Drop in a JPEG photo and this highlights any area whose compression does not match the rest, which can reveal a part that was added, painted over or spliced in. Error Level Analysis is one of the classic ways to spot a Photoshopped or manipulated image. Read it as a lead to look closer, not proof.

Runs entirely in your browser. Your image is never uploaded or stored.

How to read the map

What you seeWhat it can mean
Uniform, mostly darkConsistent with an untouched, single-save JPEG
One region brighter than the restPossible edit or paste, or just a high-detail area. Corroborate before concluding
Bright edges and text everywhereNormal high-frequency detail, not evidence of an edit
Flat or blank on a shared imageRepeated recompression has erased the signal, so the result is meaningless

Why edited regions glow

JPEG divides a picture into 8x8 pixel blocks and compresses each independently, discarding a little detail on every save. An untouched photo has passed the whole frame through the same number of compression cycles, so it settles at a uniform error level. A region pasted in or painted over later has a different compression history, still has more error to give up on the next save, and glows against the settled background. ELA is a map of where a JPEG's compression history is not uniform.

What fools it

Plenty of innocent things glow. High-contrast edges, sharp text and saturated colours carry more high-frequency detail, so they light up whether or not anyone touched them, and simply opening and resaving a file in an editor raises the error level because the software rewrites the pixels. The signal is also fragile: Krawetz notes that after roughly 64 resaves there is virtually no change left to read, which is why ELA is close to useless on anything pulled off social media or a chat app, where the file has already been recompressed many times before you see it. A clean map on a heavily shared photo is meaningless, not reassuring.

When ELA is worth trusting

ELA is most informative on a single-generation JPEG, straight from a camera or a first save, where a spliced region was added at a clearly different quality from the background. Even then it is a lead: there is no numeric threshold, an analyst reads the contrast by eye, and Krawetz is direct that in his own worked examples ELA "only identifies 'a' change," reporting even after combining several analyses that "the details of the manipulation are inconclusive." A bright region is worth quoting only when an independent method points the same way. For the full method see what is Error Level Analysis?, for where it fails see is Error Level Analysis reliable?, and for the wider workflow see how to detect Photoshop manipulation.

Sources

  • Krawetz, N. (2007). A Picture's Worth: Digital Image Analysis and Forensics. Black Hat USA 2007.
  • Farid, H. (2009). Exposing Digital Forgeries from JPEG Ghosts. IEEE Transactions on Information Forensics and Security 4(1):154-160. DOI: 10.1109/TIFS.2008.2012215
  • Zampoglou, Papadopoulos, Kompatsiaris (2015). Detecting Image Splicing in the Wild (Web). IEEE ICMEW 2015. DOI: 10.1109/ICMEW.2015.7169839