Service · Digital image forensics
Digital image forensics to test whether a photo can be trusted
Digital image forensics is the examination of a photograph to establish whether it is genuine, whether it has been altered, and what can reliably be said about its origin and history. We examine metadata, file structure, compression and pixels, and test for AI-generated content.
Expert Witness Code of Conduct
Reports prepared in line with court rules on expert evidence
SWGDE best practice
Recognised methods for digital and multimedia evidence
Repeatable methods
Documented workflow that another examiner can reproduce
Hash-verified custody
SHA-256 recorded on receipt and at every hand-off
Strictly confidential
Encrypted transfer and secure storage of evidence
Overview
What is digital image forensics?
Digital image forensics is the examination of a digital image to determine whether it is genuine, whether it has been altered, and what can reliably be established about where it came from. It is used in legal disputes, insurance claims, investigations and cases of alleged image manipulation.
Every camera and phone writes images in characteristic ways: the metadata it records, how it compresses the file and the noise its sensor leaves in each pixel. Editing, re-saving or generating an image changes those traces. We examine the file and its pixels, compare it with reference material where it exists, and look at its history. Metadata alone never proves an image is authentic, because it can be removed or rewritten, and a skilled alteration may leave little to detect. That is why authentication is strongest when technical analysis is combined with provenance: where the image came from, and independent evidence of its history.
What we examine
How we examine a digital image
No single test proves an image is genuine. We combine independent examinations, and weigh them with what is known about the image’s history.
Metadata (EXIF)
Camera make and model, date and time, GPS location and editing software.
File structure
Whether the file is consistent with the claimed camera, phone or format.
Compression history
JPEG compression patterns that show whether an image was re-saved or processed.
Pixel-level analysis
Noise, sharpness, edges, lighting and textures examined for inconsistencies.
Cloning and copy-paste
Regions duplicated within the image or inserted from elsewhere.
Splicing and compositing
Evidence that different photographs or regions were combined.
AI-generated content
Characteristics consistent with generative or AI-edited imagery.
Source and provenance
Comparison with originals, earlier versions, camera files and cloud records.
What we look for
Signs of manipulation, and their innocent explanations
Many signs of alteration have ordinary causes. A careful examination separates deliberate editing from normal camera processing and the effects of sharing.
Cloned regions
Part of the image copied and pasted elsewhere, to hide or repeat something.
Not always editing: brick, grass and other repeating patterns can look cloned when they are not.
Spliced content
Objects or people taken from another photograph and added to the image.
Not always editing: mixed lighting and lens effects can create similar differences across a real scene.
Re-saved or recompressed
The image has been saved again, rather than kept as the camera created it.
Not always editing: messaging apps, social media and cloud services re-save almost every image.
Resizing, cropping and sharpening
The image has been scaled, cropped or processed after it was taken.
Not always manipulation: phones apply processing automatically, and cropping can be harmless.
Altered or missing metadata
Dates, locations or device details that are absent or do not match the image.
Not always editing: many apps strip metadata, and wrong device clocks give wrong dates.
AI-generated or AI-edited
Images created or changed using generative tools, in whole or in part.
Not always manipulation: phone cameras use AI processing, so findings are given as a level of confidence.
Related forensic services
Services often used with image forensics
Image questions often lead to authentication, video or expert evidence. Each of these services has its own page.
Digital Image Authentication
A focused examination of whether a photograph is original, including AI-generated images.
Image authentication →
Video Authentication
The same principles applied to video, testing for editing, splicing and deepfakes.
Video authentication →
Expert Witness
Independent reports and testimony explaining image findings to the court.
Expert witness services →
Common questions
What lawyers and insurers ask us about images
Short, direct answers to the questions that most often decide whether a photograph can be relied on.
How do you tell if a photo has been edited?
By combining several independent examinations: metadata, file structure, compression history and pixel-level analysis. We look for inconsistencies that editing leaves behind, and for innocent explanations of anything unusual, before reaching any conclusion.
Where the original camera file, a RAW image or an earlier version exists, comparing the questioned image against it is often the most powerful test. The example below shows the structure of a set of findings. In a report, each examination is described so another examiner can repeat it.
Can you detect AI-generated or AI-edited images?
Often, but no single tool is conclusive. We use several detection methods, examine the image and its file, and check its provenance. The result is reported as a level of confidence, not a yes or no.
| Approach | What we examine |
|---|---|
| Multiple detection methods | Several independent tools, as each has known strengths and blind spots. No single result is relied on. |
| Pixel and texture detail | Unnatural skin, hair, text, hands and backgrounds, and textures that do not behave like a camera sensor. |
| Lighting and geometry | Shadows, reflections and perspective that do not match a real scene. |
| File and encoder | Structure, metadata and compression that point to generation or editing tools rather than a camera. |
| Provenance | Where the image first appeared, earlier versions and any content credentials (C2PA). |
Does missing or wrong metadata mean a photo is fake?
No. Metadata is easily removed or rewritten, and many apps and websites strip it automatically. Missing metadata tells us the file is not as the camera created it, but not whether the picture itself was changed.
Equally, correct-looking metadata does not prove an image is authentic, because editing software can preserve or recreate it. We treat metadata as one line of evidence, tested against the file structure, the pixels and the image’s history. More on image authentication.
What conclusions can an image forensics report reach?
There is a real difference between finding evidence consistent with manipulation, finding no evidence of manipulation using the examinations performed, and proving an image is authentic. We state which applies, with its level of confidence and the reasons for it.
Image analysis on its own rarely proves authenticity, because a skilled alteration can leave little to detect. The strongest conclusions combine technical findings with provenance, such as the original device, earlier versions or cloud records. Where those are missing, we say what would strengthen the conclusion. More on expert witness services.
Instructing us
What to send us, and what you receive
The original file and its history matter as much as the image itself. Please contact us before sending images so we can arrange a secure transfer.
What to send us
- The original image file, not a screenshot, download or messaged copy
- Any RAW file, earlier version or other copies of the same image
- How and when the image was obtained, and who has handled it
- The camera or phone the image is said to come from, if known
- The date, time and place the image is claimed to show
- Which part of the image is disputed, and why
- The specific questions you need answered
Please do not send screenshots or images downloaded from social media if the original file exists. Each copy can remove the traces we examine.
What you receive
An independent expert report, prepared in line with the Expert Witness Code of Conduct, that sets out:
- Evidence examinedEvery file, with its hash value
- ProvenanceWhere the image came from and how it was handled
- Methodology and toolsThe examinations performed and how
- ObservationsWhat each examination showed, with exhibits
- LimitationsWhat the examinations cannot establish
- ConclusionsThe opinion and its level of confidence
- ExhibitsAnnotated images, maps and comparisons
Our process
How an image examination works
We tell you what the image can support before you commit. You receive a written scope and quote before any work begins.
Initial assessment
We review the image and its history, and tell you what conclusions are possible.
Secure evidence transfer
Encrypted transfer or original media by courier. SHA-256 hash recorded on receipt.
Metadata and file analysis
Metadata extracted and the file structure compared with the claimed source.
Image analysis and review
Pixel-level, compression and AI examinations, then independently reviewed.
Report and testimony
Findings with their limitations, and court attendance if required.
A single image can often be examined within one to two weeks. Multiple images, AI questions or comparison with a device take longer, and urgent court deadlines can be accommodated.
See the full processEXIF
lost in screenshots
Keep the original file, not a screenshot
Screenshots, downloads and messaging apps strip metadata and re-compress images, removing the traces forensic examination relies on. Keep the original file, the device it came from and any earlier versions, and record how you obtained them.
Frequently asked questions
Image forensics FAQs
Answers to the questions we are asked most often about photographs and still images.
See all FAQsOften. We look for the traces that editing leaves in the metadata, file structure, compression and pixels, such as cloned or inserted regions and inconsistent noise or lighting. We also consider innocent explanations, and report what the findings support and how confidently.
We use multiple detection methods and report a level of confidence; no single tool is conclusive. Visual examination, file analysis and provenance are weighed together, because AI-generated images are improving quickly and detection tools have known limits.
Yes, but the conclusions may be more limited. Screenshots and social media copies have usually lost their metadata and been re-compressed. We can still examine the content and pixels, and the original file or an earlier version makes a much stronger conclusion possible.
Sometimes. Metadata may record the date, time and GPS location, but it can be wrong, removed or altered. We test it against the image content, the file structure and any other evidence, and report how reliable it is.
Image analysis alone can rarely prove authenticity. It can show that an image is consistent with an original and that no evidence of manipulation was found. The strongest conclusions combine technical findings with provenance and independent corroborating evidence.
Fees depend on the number of images, the questions to be answered, whether AI or device comparison is needed and whether court attendance is required. We offer fixed-fee and hourly engagements, and you receive a written quote before any work begins.
Related services
Other video and image forensic services
Image matters often involve video, measurements or files that will not open. These services are provided by the same team.
Video Forensics
Analysis of CCTV, dashcam, body-worn and phone video.
All video forensic services →
Video Enhancement
Clarifying detail in stills and footage while documenting every step.
Forensic video enhancement →
Speed, Height and Distance
Measurements from photographs and video using photogrammetry.
Speed, height and distance →
Video Decoding
Recovering stills and footage from proprietary or damaged files.
Video decoding →
Get expert advice
Find out what your image can show
Tell us what the image shows, where it came from and what is disputed. We will give you a candid view of what an examination can establish before you commit to any work.
Freecall
1800 865 190
Hours
Monday to Friday, 9.00 am to 5.30 pm
All enquiries are treated in strict confidence. Please contact us before sending any footage so we can advise on the most appropriate transfer method. If you do share footage with us, always use a secure method to protect the integrity of your evidence.