How Image Tampering Detection Works: Metadata and Error-Level Analysis
A clear explanation of the signals used to detect edited images — EXIF metadata, error-level analysis, noise and lighting — and why these methods flag suspicion rather than deliver proof.
Photo editing is everywhere, and most of it is harmless. But when an image is used as evidence — a receipt, an ID, a signed document — edits matter. Image tampering detection is the practice of finding traces that an image was changed after it was captured. Here is how the common techniques work and where they fall short.
Metadata (EXIF) analysis
Cameras and phones embed EXIF metadata into photos: the device model, timestamp, exposure settings, and sometimes GPS coordinates. When an image is edited and re-exported, this metadata often changes or disappears, and editing software may leave its own fingerprints. A document photo that lists an image editor as its 'creator software' is worth a second look.
The caveat is that metadata is fragile. Messaging apps strip it, social platforms rewrite it, and honest users export images all the time. Missing metadata is a prompt to investigate, not evidence of wrongdoing.
Error-level analysis (ELA)
JPEG images lose a little detail each time they are saved. Error-level analysis re-saves an image at a known quality and compares the result to the original. Regions that have been edited and pasted in often compress differently from their surroundings, so they stand out with a different brightness in the ELA view.
How to read an ELA result
In an ELA image, uniform surfaces should show a uniform error level. A pasted signature, a swapped number, or a cloned stamp frequently appears brighter or sharper than the rest. Sharp rectangular boundaries around a region are a particularly strong hint of a composite.
But ELA is easy to over-read. Edges, text, and high-contrast areas naturally show higher error levels even in untouched images. Analysts learn to distinguish 'this is just an edge' from 'this looks pasted', and even then they treat the output as a lead, not a conclusion.
Noise, lighting and geometry
Beyond compression, forensic reviewers look at sensor noise, lighting direction, and perspective. A genuine photo has a consistent noise pattern across the frame; a pasted element often carries noise from a different source. Shadows should fall in a consistent direction, and text should sit on a consistent baseline and perspective plane.
- Inconsistent noise between a region and its background.
- Shadows or highlights that disagree with the rest of the scene.
- Fonts, kerning, or baselines that differ within the same block of text.
- Repeated (cloned) textures that should be unique.
Forensic tools are lie detectors for pixels: useful, suggestive, and never sufficient on their own for a final legal determination.
The limits of automated detection
Modern editing — and AI generation — can produce images with few obvious artefacts. Meanwhile, ordinary processing can make honest images look suspicious. That is why responsible tools report a confidence indicator and a list of observations, rather than a binary 'fake or real' stamp. The human reviewer, with context the tool lacks, makes the call.
Used well, tampering detection narrows your attention to the parts of an image that deserve scrutiny. That is genuinely valuable — provided everyone understands it is the beginning of an investigation, not the end.