Look for signs a photo was edited TAMPER
Someone sends you a photograph and the question is whether it was edited. TAMPER runs the standard checks and gives you places to look, not an answer.
How it works
What the checks are, and what each one is worth
These are the standard first-pass checks. Every one of them produces places to look, and none of them produces a verdict, which is why this tool does not print one.
- Error level analysis. The image is re-saved at a known JPEG quality and compared with itself. Regions that have been through a different number of compression cycles can stand out. It is the most widely misused technique in this area: a bright region is not evidence of editing, and a uniform image is not evidence of authenticity.
- Cloned regions. Blocks of the image that are unusually similar to other blocks, which is what a clone-stamp or a copy-paste patch leaves behind. Repeating texture (sky, grass, brickwork, a crowd) sets this off constantly and honestly.
- Metadata. The camera make and model, the software field, and the timestamps. An image that says it came from a phone but carries an editor in its software field has been through one. This is the most reliable of the three and the easiest to remove.
When these checks say nothing at all
Most photographs you are handed have been through a process that destroys the signal before you see them.
- Anything from a social platform. Facebook, Instagram, WhatsApp, X and the rest re-encode every upload and strip the metadata. Error level analysis on a WhatsApp image is analysis of WhatsApp's encoder.
- Anything screenshotted or re-saved. One more save at a different quality flattens the history the technique reads.
- A PNG. The technique is about JPEG compression. A PNG has none, so there is nothing to compare.
- Anything generated rather than photographed. These checks look for a photograph that was altered. They are not a detector for an image that was never a photograph.
What to do with the result
Treat it as a list of places to put your attention, then look at the picture. In practice the things that settle a question are ordinary: a shadow falling the wrong way, a reflection that does not match, a background detail that dates the scene, an edge that is too clean. The checks tell you where to start; your eyes finish.
If it matters, get the original. A file straight off the camera or the phone, with its metadata intact, is worth more than any analysis of a copy that has been through three apps, and if somebody cannot produce the original, that is itself the most useful thing you have learned. EXIF reads what is left in a file and ATTEST hashes it so what you were given can be shown later to be what you analysed.
Doing this often? OBSCURA Case keeps photographs with the rest of the evidence: searched, tagged, with an audit trail and a chronology. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.