How to tell if a photo has been edited

You tell whether a photo has been edited by combining signals, not by trusting one detector. Metadata, JPEG artifacts, clone detection, noise inconsistency and reverse search each answer a narrow question, and none proves manipulation alone. The honest forensic output is usually “consistent with editing,” not “fake,” and a confident finding needs several independent signals pointing the same way. That is why, in the Forensics Media team’s review of the major image-forensics toolkits, the leading suites converge on a common core of about seven separate checks, precisely because none of them is trusted on its own.

Start with the metadata

The fastest read is the EXIF metadata: the camera model, timestamp, GPS, and the Software field, which most editors stamp when they save. A “straight from camera” photo whose metadata names Photoshop or a phone editor has been through one. But metadata is the weakest kind of evidence because it is trivially rewritten or stripped, so the right use is not “metadata says Photoshop, therefore fake,” it is “metadata names an editor, so now the pixels and context have to explain why.” The full caveat is in Can EXIF data be faked?.

Look at compression and error levels

If the file is a JPEG, its compression history can hint at editing. Error Level Analysis (ELA) resaves the image and highlights regions that compress differently, which sometimes lines up with a pasted-in area. JPEG ghost analysis asks whether a region started life at a different JPEG quality from the rest, though Farid (2009), who introduced the method, is candid about its precondition: low-quality images “often destroy any statistical artifacts that could be used to detect tampering.” A more formal relative, the detection of nonaligned double-JPEG compression from the integer periodicity of its DCT coefficients (Bianchi and Piva, 2012), is more rigorous than an eyeballed heatmap, but it too needs the right compression mismatch to survive. All of these die on resaved or shared files, which is why ELA in particular is one of the most over-trusted tools in forensics, covered separately in Is Error Level Analysis reliable?.

Check for cloning, noise, and lighting

Beyond compression, an analyst looks at the image’s own physics. Clone or copy-move detection flags regions that are suspiciously identical, the signature of someone duplicating part of an image to cover something up, a method introduced by Fridrich, Soukal and Lukáš (DFRWS, 2003). Noise analysis checks whether the sensor noise is uniform across the frame, since a region pasted from another photo often carries different noise (Mahdian and Saic, Image and Vision Computing, 2009). And the oldest check of all is lighting and shadow consistency: a face or object lit from the wrong direction is hard to fake and hard to hide. Each catches a different class of edit, and each produces false alarms on its own. Even modern deep-learning detectors are imperfect and condition-dependent: the camera-model fingerprint Noiseprint averaged a Matthews correlation of only 0.403 across nine forensic datasets (Cozzolino and Verdoliva, 2020), and the leading TruFor model reports an average F1 of 0.696 while shipping a built-in reliability map marking where its own output is unsafe to trust (Guillaro, Cozzolino, Sud, Dufour, Verdoliva, CVPR 2023).

Look for earlier copies online

Often the strongest evidence is not in the pixels at all. A reverse image search can surface an earlier, unedited version of the same photo, or show that a “new” image has been circulating for years in a different context. This is the backbone of open-source verification, and it sidesteps every pixel-level method’s weaknesses at once, because the problem is provenance rather than manipulation. The full workflow, and where it fails, is in How to verify if an image is real.

Why no single test is proof

The reason serious work runs many checks is that every individual method has a failure mode, and on realistic web images the failures stack up. When Zampoglou, Papadopoulos and Kompatsiaris (IEEE ICMEW 2015) assembled 82 confirmed web forgeries and ran a battery of state-of-the-art detectors against them, 57 of the 82 gave no detection from any method tested, and the authors concluded bluntly that “the algorithms we applied failed in the majority of cases.” That is the same rule Krawetz (Black Hat USA 2007) reaches for ELA: even after reading it alongside principal component analysis and wavelet analysis, he reports that “the details of the manipulation are inconclusive,” because ELA “only identifies ‘a’ change.” A finding is only worth stating when several independent signals point the same way.

So when you are assessing a photo, do not ask “is it fake?” Ask what each signal says and whether they agree. Read the metadata, then distrust it. Run a compression check, but discount it on a resaved or shared file. Look for cloning, noise breaks, and bad lighting. Then search for the image elsewhere. If only one weak signal fires and everything else is clean, you have a hunch, not a finding. A confident answer comes from the picture, the file, and the wider web all telling the same story. This is one of the questions in the wider guide to what forensics can learn from a file.

Sources

• Fridrich, Soukal, Lukáš (2003). Detection of Copy-Move Forgery in Digital Images. Proc. DFRWS 2003.
• Mahdian, Saic (2009). Using noise inconsistencies for blind image forensics. Image and Vision Computing 27(10):1497-1503. DOI: 10.1016/j.imavis.2009.02.001
• Farid, H. (2009). Exposing Digital Forgeries from JPEG Ghosts. IEEE Transactions on Information Forensics and Security 4(1):154-160. DOI: 10.1109/TIFS.2008.2012215
• Bianchi, Piva (2012). Detection of Nonaligned Double JPEG Compression Based on Integer Periodicity Maps. IEEE Transactions on Information Forensics and Security 7(2), April 2012. DOI: 10.1109/TIFS.2011.2170836
• Cozzolino, Verdoliva (2020). Noiseprint: A CNN-Based Camera Model Fingerprint. IEEE Transactions on Information Forensics and Security 15:144-159. DOI: 10.1109/TIFS.2019.2916364
• Guillaro, Cozzolino, Sud, Dufour, Verdoliva (2023). TruFor: Leveraging All-Round Clues for Trustworthy Image Forgery Detection and Localization. CVPR 2023. DOI: 10.1109/CVPR52729.2023.01974
• Zampoglou, Papadopoulos, Kompatsiaris (2015). Detecting Image Splicing in the Wild (Web). IEEE International Conference on Multimedia & Expo Workshops (ICMEW) 2015. DOI: 10.1109/ICMEW.2015.7169839
• Krawetz, N. (2007). A Picture’s Worth: Digital Image Analysis and Forensics. Black Hat USA 2007.