Error Level Analysis (ELA)
Definition
A technique that re-compresses a JPEG at a controlled quality setting and maps the pixel-level difference between the re-compressed and original images. Regions altered after the last full save cycle show different error levels than surrounding unaltered areas. ELA does not prove manipulation; it identifies regions warranting further examination.
- Technique type
- JPEG compression forensics
- Developed by
- Neal Krawetz (2007)
- Detection method
- Per-pixel comparison of compression artifacts
Common questions
What does Error-Level Analysis detect in JPEG images?+
ELA reveals parts of a JPEG image that have been independently compressed. When you edit a JPEG and resave it, different regions may show different compression fingerprints. ELA highlights these mismatches, which can expose areas like a forged or pasted-in seal that were compressed separately from the rest of the document.
How does ELA actually work?+
The technique compares an image against a resaved version at a known quality level, then calculates the per-pixel difference. High differences show regions that don't match the original compression history. This lets you spot edits and forgeries, even when they're subtle.
What's a common use case for ELA in document forgery?+
Document examiners use ELA on checks, seals, and signatures. A forged seal pasted onto a document will have a different compression pattern from the surrounding paper. ELA makes that inconsistency visible and measurable, giving you evidence of tampering.
Related terms
- ByteRange
- A four-integer entry in a PDF digital signature dictionary specifying which byte ranges of the file were hashed when the signature was...
- C2PA (Coalition for Content Provenance and Authenticity)
- An open technical standard that embeds cryptographically signed provenance assertions into media files at the point of capture or editing. A C2PA...
- Check Washing
- A cheque alteration technique in which organic solvents dissolve the original ink entries while leaving the pre-printed bank security printing intact, allowing...
- Compression Floor
- The stable low-residual state that a JPEG region approaches after many successive saves at the same quality. Once the DCT coefficients are...
- Content-Aware Fill
- An image editing feature (Photoshop from CS5; AI-driven from version 22.0) that replaces a masked region with synthesised pixel content matching the...
- Copy-Move Detection
- A class of image forensics algorithms that search for duplicated regions within a single image, indicating a patch-and-conceal manipulation. Implemented via block...
- Cross-Reference Table (Xref)
- The index structure at the end of a PDF file that maps each object number to its byte offset. Multiple xref sections...
- CTS-2010 (Cheque Truncation System)
- RBI's standard for cheque security features in India, requiring watermark, void pantograph, UV-reactive printing, and MICR E-13B encoding; cheques not meeting CTS-2010...
- Deepfake Detector
- A machine-learning classifier trained to distinguish authentic recordings from AI-synthesised or face-swapped media. Outputs a probability score rather than a binary verdict....
- Digital Signature Certificate (DSC)
- A cryptographic certificate issued by a Controller of Certifying Authorities (CCA)-licensed CA in India (or equivalent trust-service provider under eIDAS in the...
- Discrete Cosine Transform (DCT)
- A mathematical transform that expresses a block of pixel values as a sum of cosine functions at different frequencies. JPEG applies the...
- ELA Residual
- The pixel-level absolute difference at a given location after re-compression. High residual means the pixel value moved substantially on re-compression, indicating the...
Explained in these topics
- Cheques, Demand Drafts, Stamps and Seals: Forgery PatternsA JPEG forensics technique that reveals inconsistencies in compression-artefact levels across a JPEG image, identifying areas that were independently compresse...
- JPEG Compression Artifacts and Error Level AnalysisA forensic method that re-compresses a JPEG at a known quality and measures the absolute pixel difference between the re-compressed and original versions. The...
- PDF Metadata Forensics and Document Image AuthenticationAn image authentication technique developed by Neal Krawetz (2007) that detects regions of different compression history by computing the per-pixel difference...
- Writing a Media Authenticity Examination ReportA technique that re-compresses a JPEG at a controlled quality setting and maps the pixel-level difference between the re-compressed and original images. Region...