Use Image Forensics, Spot Edited Photos Easier!

Sometimes, we edit photos just for fun.

Or to create better photos for the Instagram.

Edited photo (left) vs original photo (right). Source: boredpanda

But, it can also be dangerous.

Edited photo (above) vs original photo (below). Source: boredpanda

Imagine if drugs weren’t allowed in space, and this photo got leaked. It could be considered as an evidence that would make Chris Hadfield, the guy above, be in jail.

Moral of the story is you shouldn’t easily believe pictures. Pictures can be manipulated, and it’s getting even easier nowadays. So, in this article, we’re going to try to decide if a picture is manipulated and guess where’s the edited part.

Here’s the picture that we’ll use as an exercise.

Step 1: Google Lens

Google Lens is similar with Google Images, you can find similar images from a photo. Furthermore, it has the ability to analyze particular objects inside the picture.

From an image, you can choose to search only a specific object.

If we look up the image that we use as exercise, here are the results.

From the results, I didn’t find any exact photos, which mean either the photo had been edited, the photo hadn’t been uploaded to the internet, or had been taken down. But, there was an image that shows two buildings with similar architecture design. Sadly, the website didn’t mention the building name, and instead used tags ‘Indonesia, bandung city, mosque…’ From these tags, I concluded that the picture might be a mosque in Bandung.

Next, I tried to look up ‘masjid Bandung’ (‘mosque in Bandung’) in Google Maps and found these results.

I went through each mosque and saw this photo. It’s similar to the photo that we’re looking for, right? So, now we finally know that the buildings in the picture are located in Al-Ukhuwwah Great Mosque in Bandung.

So, for now, our guess is that:

1. the trees were edited, or
2. the photos were not edited at all

Unfortunately, the photo from Google Maps was taken from a different angle, and it was posted in 2018. So, we can’t make sure if the trees were edited or not. And hence, we need another tools to make sure!

Step 2: JPEGsnoop

JPEGsnoop is a JPEG image decoder and analysis tool which provides detailed information about an image — it can let us know if an image has been edited previously. To use the tool, you can open the application and press File > Open Image. You need to choose the image afterwards.

Below is the detailed information of the picture we use as exercise. As you can see, the picture was an output of software GIMP 2.10.20. GIMP, based on Google, is ‘a free and open-source raster graphics editor used for image manipulation and image editing…’

As a result, now we know that the picture was not original and had been manipulated.

The next question is, which part was edited?

Step 3: Forensically

Forensically is a web-based image forensic tools. There are several tools that you can use to detect edits: magnifier, clone detection, error level analysis, noise analysis, level sweep, luminance gradient, principal component analysis, etc.

The first tool that I used was clone detection, which basically looked for objects that might be cloned/copied across the image. There were several parameters in this tool:

• Minimal similarity: how similar two areas should be to be considered clones. High value on this parameter means the two areas must be highly similar. Suggested value: 0.5.
• Minimal detail: how much detail an area needs to be considered for clone detection. Suggested value: 0.01.
• Minimal cluster size: how many blocks two areas need to share in common to be considered clones. Decreasing the value gives more results but more noise. There is no suggested value for this parameter, so I just played around and used trial-and-error.
• Block size
• Maximal image size

You can see my settings (and results) below. The red lines showed which parts of the image were possibly clones.

To make sure which area was cloned, I used error level analysis (ELA) tool. From this video, I learned that we should set the JPEG quality to 100 and Opacity to 1.00, and slowly decrease the JPEG quality until we find something peculiar in the photo.

When I set the JPEG quality to 95, I found a halo on the bottom right of the image.

Next, we’ll use magnifier in Forensically to see what the halo was about. And finally, we found out that there was an area where the clone results weren’t neat.

Below is the result of manual zoom in.

To make it easier for our eyes to see the edited area, I adjusted the exposure and contrast of the zoom-in result.

Conclusion

Based on these tools, we can conclude that the image had been edited most probably by cloning the trees in the picture, specifically in the area below.

That’s all for now, see you!

This article is written by Audrey Betsy Rumapea (18218039) to fulfill Task 3: Forensik Gambar (Image Forensics) for II4033 Digital Forensic