Quantcast

Jump to content

» «
Photo

Error Level Analysis

1 reply to this topic
K^2
  • K^2

    Vidi Vici Veni

  • Moderator
  • Joined: 14 Apr 2004
  • United-States
  • Most Knowledgeable [Web Development/Programming] 2013
    Most Knowledgeable [GTA Series] 2011
    Best Debater 2010

#1

Posted 07 May 2012 - 04:24 PM

First of all, what is Error Level Analysis? It is a technique used for digital image forensics. It allows finding areas of the image that did not come from the same source. It is most effective on photographs, but can be used with some other images as well, keeping in mind the limitations. The tool for performing the analysis has been available for a long time over at ErrorLevelAnalysis.com. The site still gives a lot of explanation of what the technique is useful for, and shows example, but no longer allows use of the tool itself.

Fortunately, the technique is extremely simple and can be performed in almost any graphics editor. I will write out this tutorial for GIMP, but it is just as easy in Photoshop, and I'm sure many other editors.

Lets start with a source image. This one comes from internet, and original author is not known to me. I'm sure many of you have seen it, however.

user posted image

Open the image with GIMP. First thing you want to do with it is copy it to the clipboard.

In the image menu. (One right above the image.)
CODE
Select -> All (Ctrl+A)
Edit -> Copy (Ctrl+C)

(I will note standard shortcuts when available, or you can just select from menu.)

Now you will want to save a copy of this image. This is the crucial step that determines how the rest plays out. You want to save an image as a JPEG with a lower quality than it has had before. Hopefully, the image you have isn't saved at a higher quality than original. If it is, you kind of have to guess what the original quality was or go with trial and error.

In the image menu.
CODE
File -> Save As... (Ctrl+Shift+S)


user posted image

Everything should be correct by default. What's important in this menu is that file type is set to (By Extension), which will make sure that giving the file a .jpg name will save as JPEG. Give it any temp name you want, making sure extension is correct.

Note: It has to be JPEG. Even if the image you are working with was in BMP or PNG, save a copy as JPEG.

Hit Save and proceed to the next pop-up.

user posted image

This is another important step. This is where you set the quality of compression on which the entire technique relies. If original image was a JPEG, GIMP will set the default quality to the quality at which the image was last saved, which you can use to guide your guess. In this case, the quality was 85. So I'm going to set quality to 75 and hit Save.

Close the image you are working with, and open the copy you saved. (Yes, that's important. GIMP doesn't refresh the image automatically. Behavior of other editors may vary.)

Now you should have your saved copy open and original in clipboard. We want to combine the two. To do this, you will want to create a new layer. First of all, make sure you have the dock with layer controls open. If you don't, you can open it from the image menu.

CODE
Windows -> Layers, Channels, Paths...


You should see something like this.

user posted image

Make sure the Layers tab is selected, as in the image above, right click on the layer marked "Background", and select "New Layer..."

user posted image

Defaults should be fine, but set Fill Type to White, as above. The image should now be complete white, and you should have "New Layer" as the top layer in the layers dock. Now you want to paste the original from the clipboard.

In the image menu.
CODE
Edit -> Paste (Ctrl+V)


And you want to anchor the pasted image. To do that, right click on the temporary layer called "Floating Selection" and select "Anchor Layer".

You should now have two layers that look identical pasted one right on top of another. That's not very useful, as you want to look for differences between the two, so what you want to do next is switch the layer mode. Making sure that "New Layer" is selected in the layers dock, find the drop-down list titled "Mode" in the same dock. It is currently set to "Normal". Change it to "Subtract" instead.

If you've done everything correctly, the image should now look solid black. In reality, it is not, but it's very dark, so we need to bring out the contrast. First, go ahead and merge the layers. Right click on the "New Layer" and hit "Merge Visible Layers..."

user posted image

It shouldn't matter, but just in case, select "Clipped to image", and hit Merge.

You can now work with the difference of layers as a single image. You want to bring out the contrast, and the best tool for that is Levels.

In the image menu.
CODE
Colors -> Levels...


user posted image

What you should be paying attention to is the histogram (Input Levels). Only on the far left of the histogram are levels non-zero. That's consistent with image appearing pitch black. You want to change it so that the available levels take up most of the range. To do that, grab the little white arrow right bellow the histogram, and start dragging it to the left.

As you do this, the number on the far right will change, and once it's low enough, you'll start seeing something on the image. You want the arrow somewhere in the vicinity of the tail of the distribution in the histogram. In this case, I stopped it at 17. Generally, use the live preview of the image to see what works. Hit Ok. This is what the image looks like now.

user posted image

This is the final result of ELA technique. You can save it (preferably as PNG) and use it for whatever you need. Alternatively, if you are using it for analysis, you can combine it with original image for easy comparison using Opacity slider. Repeat the steps of creating new layer, pasting image, and anchoring it down, and you should be able to use the opacity slider to compare error levels to features of the image more easily. For example, like so.

user posted image

This is at opacity of top layer set to 35%.



Ok, so now that you have your ELA image, what do you look for? Well, the "static" you see are error levels. Errors are higher in places where image was changed more for better compression. That's big part of why you want to set quality lower when saving a copy. You force the image to adjust for better compression. There are many things that error levels depend on, and that means you can't rely only on the noise level to spot modifications, but you can use it as a guide. On this image, there are several places you want to pay attention to.

Carpet. The error levels are naturally high on any kind of pattern. Patterned cloth and grass/leaves will give you the highest levels. What you should be looking for are decreases in error levels rather than increases. Use of smudge tool, for example, will drop error levels considerably.

Sharp edges. Look at Obama's outline. It has pretty high error levels. This is typical, but you should watch the levels. A sudden spike in error levels around outline that matches no change in boundary on original image tends to point to copy-paste job. In this case, nothing special.

Flag. The error levels look high, but again, it is not inconsistent with the patterns we see. You can't say anything conclusive about something like this one way or another.

Clock. There is absolutely no reason for such high error levels on something with so little detail. If it was just near the numbers, that'd be fine, but this is the entire clock image inconsistent with the rest of the picture. Definitely fake. The clock was pasted in.

Chord. By itself, you can't say much. Phone chord is another example of a patterned object, so you expect high error levels. But when you compare the ELA image to the original, you start noticing something. In the low portion of the chord, the high error levels are contained within the chord. But as you go up, starting at around Obama's elbow, the error level range expands well outside of the chord. This is the sort of inconsistency along boundary that I was mentioning earlier. You should strongly suspect tempering.

Sleeve. This is a subtle one, and probably not going to be noticeable unless you have a good suspicion about how the image was modified. Look at the sleeve near the left hand. You can see a patch of high error level just where you'd expect the chord to pass if the phone was held properly.

With this particular image, the original is available for comparison.

user posted image

Consistent with above, the chord was moved right where ELA suggests it was, and the clock was pasted in.



Besides warnings above, there are two more situations that are likely to produce false positives. First, video game screenshots. These are pasted together from images by their very nature. It can be very difficult to tell the difference between things that look pasted in because they were rendered and because they were actually pasted in. However, if smudge tool was used, you should still see a drop in error levels. Second is movie footage for similar reasons. Green screen is used a lot these days, and anything added in with CG will look similarly forged.

Otherwise, I encourage you to take a look at some famous faked photos to see exactly how they were faked. The only way you'll be able to use this technique to find fakes is if you have some experience with known fakes.

I hope this was helpful to somebody. If you have questions, post them.
  • BnB likes this

Vaderios
  • Vaderios

    Matte Painter-Illustrator

  • Members
  • Joined: 22 Jun 2005

#2

Posted 29 December 2012 - 10:14 AM

Im sure you know this site smile.gif http://www.hackerfactor.com/

-Angel




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users