Image manipulation
& provenance analysis.

A supported image file; structural checks vary by format.

• Inspect file segments, chunks or boxes with their offsets and available integrity checks.
• Read compression settings, a quality estimate, embedded metadata, edit history and colour profiles where present.
• Compare an embedded thumbnail with the main image and flag editing-software traces or inconsistent timestamps.
• Inspect data appended after the image ends; extract and fingerprint additional images when found.

Metadata can be altered or absent. A thumbnail mismatch or unusual structure is an investigative lead, not a tampering verdict. Availability of each check depends on the file format.

A JPEG image, ideally retaining its source encoding.

• Read the compression settings stored in the JPEG.
• Compare a suspected region’s compression behaviour with the rest of the image.
• Create a diagnostic block-level map for visual inspection.

Blind splice localisation from this map alone proved unreliable in testing. Use it to inspect a suspected area; it is not an automated tampering finding.

A JPEG image, with its claimed camera source or file history where available.

• Compare compression-setting tables against known camera, editor, export-preset and sharing-platform references.
• Cross-check other encoding tables, colour subsampling, thumbnails and metadata layout.
• Compare those observations with the camera source claimed in embedded metadata.

These patterns identify encoding families, not individual devices. Re-encoding may replace original settings; a matching family does not prove camera origin. Reference coverage is reported with the result.

A supported image or PDF; an embedded provenance manifest is needed for verification.

• Check the manifest’s signature and whether its recorded content fingerprint matches the file.
• Review the source and edit-history assertions recorded by the signer.
• Distinguish intact, invalid and absent credentials.

An absent manifest is largely inconclusive, and re-encoding may remove one. A valid manifest supports integrity of the recorded provenance; it does not establish that everything depicted or asserted is true.

One image.

• Match local visible features under a consistent translation.
• Mark the two regions linked by the strongest duplication signal.
• Report their relative offset.

Only the most prominent duplication is reported. The analysis cannot determine which region is the original and which was pasted; repeated scene structure also requires contextual review.

One questioned image; confirm format support before submission.

• Map local recompression differences, noise level, statistical texture and resampling periodicity.
• Compare a suspected pasted object, replaced face or altered number plate with nearby material.
• Apply a stated false-alarm threshold to the one supported region-flagging map; keep other maps unscored.

Texture, focus and compression can change these statistics. Other maps did not reliably separate planted splices in validation and are displayed without scores. A flag identifies a place to examine, not proof of alteration.

A JPEG retaining the compression signal needed by the analysis.

• Analyse JPEG compression-artifact patterns across the image.
• Highlight regions statistically consistent with a compression-history splice.
• Inspect the map alongside source pixels and other independent evidence.

This is a diagnostic exhibit, not a verdict. An image never encoded as JPEG lacks the required signal; screenshots and resaving can remove or alter it. Published benchmark performance is not case-specific accuracy.

A photo with visible cast shadows and at least three examiner-selected object-base/shadow-tip pairs.

• Trace the lines through corresponding object bases and cast-shadow tips.
• Measure how closely those lines converge toward a common source.
• Repeat the assessment with each pair omitted to identify an inconsistent annotation.

Human annotation is required. Read deviations against the annotation-error allowance and check the single-light-source assumption. Click uncertainty or scene complexity can affect the result; it is not a bare pass/fail decision.

One questioned image; confirm format support before submission.

• Confirm the active detector, loaded version and input preparation before defining the output.
• Distinguish generator references or test images from the component that performs detection.
• Document supported image conditions and evaluation coverage.

The available inventory does not verify the detector used by this workflow. No threshold, accuracy or generator coverage is claimed here.

One questioned photograph; confirm format support before submission.

• Inspect fine-detail periodicity that can arise from display pixels or print halftones.
• Assess the strongest colour-channel signal while excluding JPEG-grid patterns and scene edges.
• Read the indicators against thresholds established on authentic photographs, with softness and tonal context.

Regular scene patterns can create similar peaks, and careful recapture may leave little trace. These are indicators for review, not a definitive screen-versus-camera or print-source verdict.

The questioned image and at least eight flat, well-exposed, native-resolution reference frames from the candidate camera.

• Build a sensor-noise reference fingerprint from multiple suitable frames.
• Measure the questioned image’s agreement with that fingerprint.
• Compare raw scores from different candidate cameras.

No match/no-match verdict. Supplied validation separates synthetic sensors only; real-camera validation is still pending. A single reference frame is inadequate, and processing or resizing can weaken the signal.

A lossless PNG, BMP or TIFF image. JPEG is rejected.

• Inspect changes in low-level pixel statistics associated with simple bit-level embedding.
• Report diagnostic indicators of large or near-maximal payloads.
• Preserve the source for any further payload-focused investigation.

Does not reliably detect content-adaptive concealment or JPEG-domain embedding. Recompression can destroy the signal. A negative screen does not exclude hidden data, and this workflow does not promise payload extraction.

One image.

• Reduce noise using existing pixel information.
• Prepare a viewing copy without generating a reconstructed scene.
• Keep the sealed source image separate and unchanged.

No generative upscaling or invented detail. A cleaner appearance cannot recover information the source never captured, and the working copy must remain distinguishable from the original.

A verified working copy of the source image; confirm accepted source formats before submission.

• Apply ordered geometry, tonal, contrast and noise adjustments with recorded parameters.
• Log each step, reason and abandoned attempt in a hash-linked session history.
• Retain bookmarked before/after views, software versions, references and known limits.
• Finalise a lossless PNG, register it as a derived evidence item, then replay the processing chain and verify its output fingerprint.

Enhancement makes existing information easier to inspect. There is no generative reconstruction; processing choices can affect interpretation and must be justified in the report.

A verified still plus a known-height reference, calibrated camera pose or suitable ground control points.

• Select appropriate scale references and control points before measurement.
• Cross-check alternative geometric approaches when more than one applies.
• Record uncertainty bounds and a probability-based interval in the report.
• Reviewed exports use two-person sign-off; single-user working exports are marked unreviewed.

A single image does not supply a scale by itself. Perspective, reference suitability, point selection and geometry determine what can be measured. Interpret the measurement together with its stated uncertainty and review status.