Error Level Analysis: Single Operation Tests

facebooktwittergoogle_plusredditpinterestlinkedinmail

This is the single operation tests of error level analysis, a process to detect digitally manipulated photographs. For more information on what error level analysis does and the testing read the testing overview here.

Testing Equipment and Method

For this test, pictures were taken with two cameras. We chose “lower-end” cameras to represent the types of images investigators often encounter. These lower-quality cameras make all types of analysis, including ELA more difficult. This test will be more accurate to real-world-conditions by using these types of cameras.

The first camera is a 7.1 MP Canon PowerShot SD1000. Images were saved in maximum resolution on the camera’s SD card in jpeg format. After the images were taken, they were transferred to a computer using the removable SD card and saved locally.

The second camera is a cell-phone based camera on a Pantech Discover. This camera is capable of recording in up to 12.6 MP. We left the resolution on the default setting 2.4 MP. The photos were then emailed and saved locally on the test computer system.

All photographic modifications will be carried out using GIMP 2, a free photographic software program available to anyone. GIMP 2 can be downloaded here.

ELA will be conducted on each image utilizing the www.fotoforensics.com website.

Overview

Purpose: The purpose of test 1 is to determine what image-modification operations ELA is capable of detecting.

Procedure: Test 1 will utilize 3 images taken with the two cameras listed above. The original images will be processed through ELA using fotoforensics.com. This set of ELA results represents the control group and will be used for comparison.

Next the 3 original images will be subjected to a single-modification in Photo POS Pro. In this test no image will receive more than one modification. An original image will be modified and re-saved in JPEG format, 100% quality, with a new file name. After each modification is complete the modified image will be processed through ELA using www.fotoforensics.com.

The following modifications will be carried out on 3 test images:

1. Crop
2. Brightness or Contrast Adjustment
3. Recolor
4. Copy and Move/Clone
5. Splice
6. Add Pixels
7. Blur
8. Sharpen

Analysis: ELA and non-ELA modified and unmodified images will be compared. The purpose of this is to identify whether ELA was able to detect the modification.

Original Images

Error Level Analysis Original Image 1

Error Level Analysis Original Image 1 – Taken with Canon

 

CANON ELA RESULT IMAGE 1

Error Level Analysis Result Image 1 – Taken with Canon

 

Error Level Analysis Original Image 2

Error Level Analysis Original Image 2 – Taken with Canon

 

CANON ELA RESULT IMAGE 2

Error Level Analysis Result Image 2 – Taken with Canon

 

Error Level Analysis Original Image 3

Error Level Analysis Original Image 3 – Taken with Pantech

 

PANTECH ELA RESULT IMAGE 3

Error Level Analysis Result Image 3 – Taken with Pantech

 


Part 1: Crop

Original images were cropped to different degrees. Image 1 was cropped to a large degree and resaved in PNG with no compression. Image 2 was cropper to a moderate degree and resaved in PNG with moderate compression (5). Image 3 was cropped a minor amount and resaved in JPG with mild compression (90% quality).

CANON IMAGE 1 CROP

Cropped Image 1 – Taken with Canon

 

CANON ELA RESULT 1 CROP

Error Level Analysis Result Cropped Image 1 – Taken with Canon

 

CANON IMAGE 2 CROP

Cropped Image 2 – Taken with Canon

 

CANON ELA RESULT 2 CROP

Error Level Analysis Result Cropped Image 2 – Taken with Canon

 

PANTECH IMAGE 3 CROP

Cropped Image 3 – Taken with Pantech

 

PANTECH ELA RESULT 3 CROP

Error Level Analysis Result Cropped Image 3 – Taken with Pantech


Part 2: Brightness or Contrast Adjustment

Original image 1 had contrast increased by 60 points. Image 1 was resaved as JPEG at 100% image quality. Image 2 had brightness increased by 25 points. Image 2 was resaved as a JPEG at 90% image quality. Image 3 had brightness decreased by 20 points and contrast increased by 20 point. Image 3 was resaved as a JPEG at 90% image quality. 

CANON BC IMAGE 1

Brightness/Contrast Modified Image 1 – Canon

 

CANON ELA RESULT 1 BC

Brightness/Contrast Modified Image ELA Result 1 – Canon

 

CANON BC IMAGE 2

Brightness/Contrast Modified Image 2 – Canon

 

CANON ELA RESULT 2 BC

Brightness/Contrast Modified Image ELA Result 2 – Canon

 

PANTECH BC IMAGE 3

Brightness/Contrast Modified Image 3 -Pantech

 

PANTECH ELA RESULT 3 BC

Brightness/Contrast Modified Image ELA Result 3 – Pantech


Part 3: Recolor

Original image 1 had the shadows of all three channels adjusted to a value of 100. The image was then saved in JPEG format at 90% quality. Original image 2 had midtones in the magenta to cyan channel changed to a value of 100. The image was saved in JPEG format at 90% image quality. Original image 3 had highlights of the cyan to red channel adjusted to a value of 100. The image was then saved in JPEG format at 90% quality. 

CANON RECOLOR IMAGE 1

Color Modified Image 1 – Canon

 

CANON ELA RESULT 1 RECOLOR

Color Modified Image ELA Result 1 – Canon

 

CANON RECOLOR IMAGE 2

Color Modified Image 2 – Canon

 

CANON ELA RESULT 2 RECOLOR

Color Modified Image ELA Result 2 – Canon

 

PANTECH RECOLOR IMAGE 3

Color Modified Image 3 – Pantech

 

PANTECH ELA RESULT 3 RECOLOR

Color Modified Image ELA Result 3 – Pantech


Part 4: Copy and Move/Clone

Original image 1 had the helicopter cloned using the clone brush. The image was saved in JPEG format at 90% image quality. In Original Image 2 the reflection of of the car’s headlight was cloned into a bush in the foreground. A yellow object in the background was cloned 8 times into the night sky and into the windows of the vehicles. The image was saved in JPEG format at 90% image quality. In original image 3 I cloned an extra fire ring into the left side of thee photo. I cloned one of thee milk jug planters onto the railroad tie bench and I cloned an extra bush along the fence, directly next to the original. The image was saved in JPEG format at 90% image quality. 

CANON CLONE IMAGE 1

Cloned Image 1 – Canon

 

CANON ELA RESULT 1 CLONE

Cloned Image ELA Result 1 – Canon

 

CANON CLONE IMAGE 2

Cloned Image 2 – Canon

 

CANON ELA RESULT 2 CLONE

Cloned Image ELA Result 2 – Canon

 

PANTECH CLONE IMAGE 3

Cloned Image 3 – Pantech

 

PANTECH ELA RESULT 3 CLONE

Cloned Image ELA Result 3 – Pantech


Part 5: Splice External Image

Original image 1 had several fake flying saucers added in. The UFO in the upper left corner and the bottom left corner were left at 100% opacity. The large UFO in the upper right corner was adjusted to 50% opacity. The UFO in front of the helicopter was adjusted to 75% opacity. The UFO on the right side just above the trees, was adjusted to 50% opacity. The image was resaved in JPEG format at 90% quality. Original image 2 had several ghostly figures added in that were taken from a popular ghost app. The figure in the top left was given an opacity of 25%. The little girl ghost in the bottom left was left at 100% opacity. The women in the window on the green car had opacity adjusted to 40%. Finally the figure in the upper right had opacity adjusted to 50%. The image was resaved in JPEG format at 90% quality. Original image 3 had mangy dogs added from a separate JPEG photo. A large dog was inserted into foreground left with 100% opacity. A medium sized dog was inverted horizontally, set to 50% opacity and place on the right side of the picture. A third smaller, inverted dog was added into the background with an opacity of 75%. The image was resaved in JPEG format at 90% quality. 

CANON SPLICE IMAGE 1

Spliced Image 1 – Canon

 

CANON ELA RESULT 1 SPLICE

Spliced Image ELA Result 1 – Canon

 

CANON SPLICE IMAGE 2

Spliced Image 2 – Canon

 

CANON ELA RESULT 2 SPLICE

Spliced Image ELA Result 2 – Canon

 

PANTECH SPLICE IMAGE 3

Spliced Image 3 – Pantech

 

PANTECH ELA RESULT 3 SPLICE

Spliced Image ELA Result 3 – Pantech


Part 6: Add Pixels

In original image 1 I used the paintbrush tool to add a pepper in front of the helicopter, added a red circle around the helicopter and added a purple line. The image was saved in JPEG format at 90% image quality. In image 2 the paintbrush tool was used to add a yellow orb in the upper left hand corner and a red arrow pointing to the orb. The text tool was used to create the word “ORB” in white font. The image was saved in JPEG format at 90% image quality. In original image 3 the paintbrush tool was used to create a series of 3 yellow stars along the back fence, a white circle with inconsistent fill near the fire ring, and green leaves on the ground in the bottom center of the image. The image was saved in JPEG format at 90% image quality. 

CANON ADD PIXELS IMAGE 1

Pixels Added Image 1 – Canon

 

CANON ELA RESULT 1 ADD PIXELS

Pixel Added Image ELA Result 1 – Canon

 

CANON ADD PIXELS IMAGE 2

Pixels Added Image 2 – Canon

 

CANON ELA RESULT 2 ADD PIXELS

Pixel Added Image ELA Result 2 – Canon

 

PANTECH ADD PIXELS IMAGE 3

Pixels Added Image 3 – Pantech

 

PANTECH ELA RESULT 3 ADD PIXELS

Pixel Added Image ELA Result 3 – Pantech


Part 7: Blur

Original image 1 had Gaussian blur applied using the RLE method with values of 20 used for the horizontal and vertical blur radius. The image was saved in JPEG format at 90% image quality. Original image 2 had linear motion blur applied at an angle of 0 degrees with a length of 33. The image was saved in JPEG format at 90% image quality. Original image 3 had selective Gaussian blur applied with a blur radius of 20 and a max delta of 125. The image was saved in JPEG format at 90% image quality. 

CANON BLUR IMAGE 1

Blur Image 1 – Canon

 

CANON ELA RESULT 1 BLUR

Blur Image ELA Result 1 – Canon

 

CANON BLUR IMAGE 2

Blur Image 2 – Canon

 

CANON ELA RESULT 2 BLUR

Blur Image ELA Result 2 – Canon

 

PANTECH BLUR IMAGE 3

Blur Image 3 – Pantech

 

PANTECH ELA RESULT 3 BLUR

Blur Image ELA Result 3 – Pantech


Part 8: Sharpen

Original image 1 had unsharp mask applied with a radius of 5.0, an amount value of .50 and a threshold of 0. The image was saved in JPEG format at 90% image quality. Original image 2 had sharpen applied with a value of 99. The image was saved in JPEG format at 80% image quality. Original image 3 had an unsharp mask applied with a radius of 10.0, an amount value of 1.0 and a threshold of 0. The image was saved in JPEG format at 90% image quality. 

CANON SHARPEN IMAGE 1

Sharpened Image 1 – Canon

 

CANON ELA RESULT 1 SHARPEN

Sharpen Image ELA Result 1 – Canon

 

CANON SHARPEN IMAGE 2

Sharpened Image 2 – Canon

 

CANON ELA RESULT 2 SHARPEN

Sharpen Image ELA Result 2 – Canon

 

PANTECH SHARPEN IMAGE 3

Sharpened Image 3 – Pantech

 

PANTECH ELA RESULT 3 SHARPEN

Sharpen Image ELA Result 3 – Pantech


Analysis

Part 1: Crop
Error levels between the cropped photos and the originals exhibited small changes, but this is likely the product of resaving the files in various formats and not the crop operation. ELA does make the 8×8 JPEG grid squares more visible.

If an image is saved in JPEG, cropped, then saved in a lossless format like PNG or TIFF, an examination of the top or left edge of the photo can reveal potential cropping: If the photo is not cropped perfectly at the edge of the square then the squares along these edges should have an abnormal pixel count (other than 8×8 pixels).

However, if a cropped image is resaved in JPEG a new grid will be applied and this method can no longer detect crop operations. In some cases the previous grid may be visible underneath the new JPEG grid, but identifying previous grids visually takes a careful approach. 

Part 2: Brightness or Contrast Adjustment
Brightness appears to have a mild result on ELA. Increases in brightness will generally result in higher average ELA values while lower brightness levels will reduce ELA values. Extreme changes in brightness may result in large areas of color turning all white or all black which would in turn affect ELA result. Many of these changes would be obvious when thee picture is visually inspected. 

Contrast has a significant effect on ELA results. Increasing or decreasing contrast can result in abnormally high and low ELA values in the same image. Contrasting edges seem to generate higher error levels while areas of similar color generate very low error levels. Expect loss of definition and extreme ELA values in a photo where high levels of contrast were applied. 

Part 3: Recolor
Increasing any color channel appears to increase error levels across the image, at least in the areas affected by the hue adjustment. There appears to be no significant effect on definition in the ELA results. 

Part 4: Copy and Move/Clone
Clone operations are difficult to detect with ELA. If the cloned portion is moved to an area that produces a very different ELA result, it is possible to spot inconsistencies. However in many cases the clones portions match the error levels of the background and do not stand out. This is not surprising considering we are using portions of the same picture with the same compression rates. If a cloned area was taken from a version of the image with different compression, the cloned area will likely be easier to detect.

As a side note our images with cloned portions appear to have a higher average ELA value than the originals. 

Part 5: Splice External Image
ELA appears to be a reliable indicator of spliced-in images. Many of the spliced in sections can be clearly detected because the error level of the spliced portion is not consistent with the rest of the image or contrasting edges do not produce the expected error level. 

The reliability of this method hinges on the difference between the compression of the two spliced images. If a UFO from a highly compressed file is being inserted into another image with low compression this splice should be obvious in ELA. The opposite is true as well. However if the two images being spliced are similar in compression, the splice will generally be harder to detect. 

Transparency also makes splices harder to detect. As the spliced portion becomes more transparent, it will generally appear to be more consistent with the background ELA result. 

Part 6: Add Pixels
Pixels and images added with GIMP’s paintbrush tool are relatively easy to spot using ELA. Analyzing the error levels of the fill and the contrasting edge can provide indication of added pixels. Furthermore added in pixels appear to exhibit “rainbowing” where edges or fill have streaks of blue and red in the ELA results. 

Part 7: Blur
Just as blur reduces the definition in the photo, it will reduce the definition of the ELA result. In most cases this will also result in lower average error levels, but when selective blur is used, it resulted in more high and low values in the same image. 

Part 8: Sharpen
Sharpening results in higher error levels along contrasting lines. Excessive contrast can also introduce artifacts/noise into the image which will degrade the definition of the ELA results. 

 

facebooktwittergoogle_plusredditpinterestlinkedinmail