How to Tell if a Photo is Authentic or Altered

How to Tell if a Photo is Authentic or AlteredAs most of us are aware, photographs can be subjected to any number of computerized changes before they are printed and/or, in many cases, altered once the printed results are examined. In fact, this was witnessed in a case that changed the way law enforcement presents photographic evidence to a court of law. In its first-of-a-kind case, the crime lab personnel had not intended to corrupt the integrity of the photo; they had simply cropped off what they presumed to be extraneous edges of the photo. The defendant’s attorney stated that the prosecution’s evidence — confirmed by a criminal evidence technician — was untouched. However, when the changes to the original photo were pointed out to the court, it was determined that even this modest alteration was sufficient enough to prevent it from being admitted as evidence.

Today, one of the most commonly used formats for digital images is the JPEG — or JPG (named by the Joint Photographic Experts Group). This is a compressive format that is intended to maintain a photo’s visual quality while reducing its resultant file size (which helps when the question of storage comes up, especially when you’re dealing with thousands of images — it adds up). In order to work, it is vital that JPEG compression has access to what is called the quantization table. This can be tricky because different cameras may use different tables; when a photo is opened in an editing program, such as Photoshop, the quantization table is converted over to the one used by the editing software. This means that once the photograph is altered in the editing software, the saved photograph will be saved in the software’s quantization table format.

One of the software programs that can be used to determine if a photographic image has been altered is called JPEGsnoop, a free JPEG file decoding utility. This program is currently available for personal computers running the Windows OS. However, be aware that the term ‘editing’ is often loosely used and may also refer to a photograph that is authentic but has been transferred to a new location. This simply means that if you take a picture with your digital camera, upload it to Facebook, and then download that same photograph to a different program, it may be construed by the decoding utility as having been edited. So, even though the original photo has never been subjected to an editing program, the uploading and downloading process will deem it edited.

So what can JPEGsnoop do for you?

  • It can compare compression characteristics of a photo to a known internal database that is compiled from thousands of cameras and/or photo editing software.
  • The software can match the signature of the photograph to a photo editor such as Photoshop, which could mean the photograph is not an original.

Can JPEGsnoop guarantee, with 100% certainty, that a photograph is not the original?

  • No software is 100% infallible. However, JPEGsnoop can raise your suspicions that a photograph may have been edited and may not be the original.
  • This utility cannot stand alone as legal proof that a photo is or is not authentic. It is intended for personal use only.

To check its reliability, I took JPEGsnoop for a test drive and I personally found the software easy to use. The picture I used was an original that I took with my Samsung SGH-T679 smartphone. When I ran the photograph through JPEGsnoop I received the following report:

EXIF IFD0 @ Absolute 0x00000026

Dir Length = 0x000C
[Make] = “SAMSUNG”
[Model] = “SGH-T679”
[Orientation] = Row 0: top, Col 0: left
[XResolution] = 72/1
[YResolution] = 72/1
[ResolutionUnit] = Inch
[Software] = “T679UVKJ1”
[DateTime] = “2012:04:11 19:48:50”
[YCbCrPositioning] = Centered
[ExifOffset] = @ 0x0912
[XPKeywords] = “Test”
Offset to Next IFD = 0x0000131C

The JPEGsnoop utility then correctly informed me that the photograph appeared to be an untouched original from the smartphone camera that I had used to take the photo.

To verify that the JPEGsnoop utility did all it claimed, I then took the same photograph and edited the photograph using FotoFlexer, an online photo editing software. The utility then issued me the following report.

Based on the analysis of compression characteristics and EXIF metadata:

ASSESSMENT: Class 1 — Image is processed/edited
This may be a new software editor for the database.
If this file is processed, and editor doesn’t appear in list above,
PLEASE ADD TO DATABASE with [Tools->Add Camera to DB]

The report then went on to inform me that it could no longer determine if the photograph was an original or that it had been taken with my Samsung smartphone.

In my attempt to verify the utility’s reliability, I followed the same procedure that I used above with several other photo editing software programs. With each of these programs, I varied the editing I did in an attempt to change other photographs. With each of these, the results were the same.

I know that during this election year we are all getting tons of email and other correspondence meant to persuade or dissuade us from voting for a particular political nominee. Wouldn’t it be nice to be able to verify if a photo sent to you was actually taken and presented as-is or if it is just some bogus propaganda or viral hoax being sent via spam? For this purpose alone, I think that this software can be worth using.

The bottom line is this: JPEGsnoop does work, and I believe that it worth your while to try, especially since it is offered for free. Try using it to analyze that suspicious photograph that is either posted on the Internet or sent to you by well-meaning friends or acquaintances. You never know. You might find that you have one up on those people who think that they have all the answers.

Do you have favorite software, preferably free, that you use to determine if a photo is a fake or not? Let us know what you use and why.

Comments, as always, are welcome.

CC licensed Flickr photo above shared by Crafty Dogma