JPEG Ghost
Was part of this photo saved separately?
Drop in a JPEG and slide through recompression qualities. A region that was first saved at a lower quality than the rest of the picture, the tell-tale of a spliced-in patch, shows up as a ghost: an area that goes noticeably darker than its surroundings at one quality setting. Read it as a lead to look closer, not proof.
Runs entirely in your browser. Your image is never uploaded or stored.
JPEG Ghost needs a JPEG. A PNG, screenshot or freshly generated image has no JPEG quality history to compare against, so the result would be meaningless.
How the ghost appears
A JPEG throws away a little detail every time it is saved, and how much depends on the quality setting. When you take a photo saved at high quality and recompress it at a lower quality, the whole frame changes by a similar amount, so a difference map is fairly uniform. But if a patch was originally saved at, say, quality 60 and pasted into a picture saved at quality 90, then when you recompress the whole image down to around quality 60 that patch barely changes, because it has already been through that compression, while everything around it changes more. The patch goes dark in the difference map. That dark echo is the ghost, and the quality where it appears is the quality the patch was first saved at. The method is due to Hany Farid, who introduced it as "exposing digital forgeries from JPEG ghosts" (IEEE Transactions on Information Forensics and Security, 2009).
How to read it
Slide the quality from low to high and watch the map. A single, roughly rectangular region that darkens clearly at one setting while the rest of the frame stays even is the signal worth chasing. What is not a ghost: the whole image brightening or darkening together as you move the slider, which is normal, and busy or high-contrast areas that always differ. As Farid notes, the method works best when the spliced region was saved at a lower quality than its host, and it fades when the qualities are close. Treat a ghost as a lead to corroborate with other checks, never as proof on its own.
Where it fails
Like Error Level Analysis, JPEG Ghost depends on there still being a quality difference to find, and repeated resaving erases it. An image pulled off social media or a chat app has usually been recompressed enough times that every region sits at the same quality, so no ghost can appear even if the picture was edited. A clean result on a heavily shared photo is meaningless, not reassuring. Pair this with the photo edit check and the metadata viewer before drawing any conclusion.
Sources
- Farid, H. (2009). Exposing Digital Forgeries from JPEG Ghosts. IEEE Transactions on Information Forensics and Security 4(1):154-160. DOI: 10.1109/TIFS.2008.2012215
- Krawetz, N. (2007). A Picture's Worth: Digital Image Analysis and Forensics. Black Hat USA 2007.