Detecting Fake Photos: Error Level Analysis Study
Over the next few weeks I’ll be testing a photographic analysis technique called Error Level Analysis (ELA). This testing will improve understanding of the capabilities and limitations of ELA for evaluation of suspected paranormal images. It will also aid in the development of guidelines and training to help other investigators apply this in their own work.
Introduction to Error Level Analysis
Advancements in camera technology have produced a staggering number of suspected paranormal photographs. Today anyone with a cell phone or camera can capture an image and disseminate it worldwide in a few moments. Wading through all of these leads is a daunting prospect made worse by the vast array of photo editing tools available to every casual consumer. Many investigators, paranormal news sites and even traditional news outlets have reverted to simply reporting on these events using basic interview techniques to determine credibility of the image author. This is problematic considering how easy it is to create a digitally forged image. There is a definite need for a rapid, effective and simple method to evaluate photographs of suspected paranormal phenomena.
Error level analysis, abbreviated ELA, is an exciting technology that appears to meet all of these requirements. ELA is a tool created by Dr. Neal Krawetz. Here is a brief explanation of how the algorithm works from www.fotoforensics.com:
JPEG images use a lossy compression system. Each re-encoding (resave) of the image adds more quality loss to the image. Specifically, the JPEG algorithm operates on an 8×8 pixel grid. Each 8×8 square is compressed independently. If the image is completely unmodified, then all 8×8 squares should have similar error potentials. If the image is unmodified and resaved, then every square should degrade at approximately the same rate.
ELA saves the image at a specified JPEG quality level. This resave introduces a known amount of error across the entire image. The resaved image is then compared against the original image.
If an image is modified, then every 8×8 square that was touched by the modification should be at a higher error potential than the rest of the image. Modified areas will appear with a higher potential error level.
Error Level Analysis (ELA) cannot detect a faked scene or photographic artifacts recorded by the camera. ELA can detect manipulation of an image after it was recorded by the camera. There are known limitations to ELA too including multiple resaves of the same image which make ELA less effective. Regardless of the outcome of this testing ELA should not be regarded as a conclusive detectoor of forgeries. Instead it should be used to indicate possible manipulation. If ELA shows possible manipulation other algorithms and evaluation methods can verify or nullify the ELA findings.
Example of Error Level Analysis
This image was taken with the Pantech Discovery smart phone. On the left is the original photo and on the right is the ELA result. Lighter colors indicate higher error levels. Similar colors and textures should have similar error levels. Edges normally have higher error levels. This ELA result is relatively dark and consistent indicating no manipulation was made to the photo.
In this example I added in a dog to the image. It can be a little difficult to see the difference in the ELA result at first, but after some study it is pretty apparent the dog doesn’t belong in the original image. First of all the ELA values on the dog aren’t consistent with the surrounding terrain. If you look closely where the rear left leg is, you can see a hard edge on one side of the leg but not the other. If we refer back to the pre-ELA photo it is clear that there is an area of background that was not trimmed out. You can also see that the hard edge around the dog is incomplete in some areas. Of course a close visual examination of the photo would reveal the same thing, but ELA has the potential to detect well executed manipulations.
Testing Equipment and Method
For this test, pictures were taken with two cameras. We chose “lower-end” cameras to represent the types of images investigators often encounter. These lower-quality cameras make all types of analysis, including ELA more difficult. This test will be more accurate to real-world-conditions by using these types of cameras.
The first camera is a 7.1 MP Canon PowerShot SD1000. Images were saved in maximum resolution on the camera’s SD card in jpeg format. After the images were taken, they were transferred to a computer using the removable SD card and saved locally.
The second camera is a cell-phone based camera on a Pantech Discover. This camera is capable of recording in up to 12.6 MP. We left the resolution on the default setting 2.4 MP. The photos were then emailed and saved locally on the test computer system.
All photographic modifications will be carried out using GIMP 2, a free photographic software program available to anyone. GIMP 2 can be downloaded here.
ELA will be conducted on each image utilizing the www.fotoforensics.com website.
Single Operation Tests
Purpose: The purpose of test 1 is to determine what image-modification operations ELA is capable of detecting.
Procedure: Test 1 will utilize 3 images taken with the two cameras listed above. The original images will be processed through ELA using fotoforensics.com. This set of ELA results represents the control group and will be used for comparison.
Next the 3 original images will be subjected to a single-modification in GIMP. An original image will be modified and re-saved in JPEG format, 100% quality, with a new file name. After each modification is complete the modified image will be processed through ELA using www.fotoforensics.com.
The following modifications will be carried out on 3 test images:
2. Brightness or Contrast Adjustment
4. Copy and Move/Clone
6. Add Pixels
Analysis: ELA and non-ELA modified and unmodified images will be compared. The purpose of this is to identify whether ELA was able to detect the modification.