Error Level Analysis (ELA)

The underlying logic is rooted in the ratchet-like nature of JPEG quantisation. When you first save an image as JPEG at quality Q, the DCT coefficients are divided by the quantisation table and rounded. Some precision is lost. When you save the same image again at the same quality, the coefficients are divided and rounded again, but they are already very close to multiples of the quantisation step. The second rounding changes them by very little. With enough iterations, the values stop changing at all: they have reached equilibrium for that quality setting.

ELA measures how far a region is from that equilibrium. Take the image, re-save it at a fixed quality (commonly 95% in FotoForensics), compute the per-pixel absolute difference, and multiply by an amplification factor. Regions at equilibrium produce small differences: they appear dark. Regions not at equilibrium, because they were recently added, recently edited at a different quality, or simply contain fine detail that never fully equilibrates, appear bright.

The intuition behind the forensic use is that an authentic image has a uniform compression history: every region passed through the same camera processing pipeline, the same JPEG encoder, and the same save step. A manipulated image has at least one region with a different history. That region may not be at the same equilibrium point as the rest of the image and will therefore appear brighter or differently-textured in the ELA map.

The first principle of correct ELA interpretation is that absolute brightness means nothing: what matters is relative brightness between comparable regions. A bright sky should look uniformly bright. Uniform grass should look uniformly dim or uniformly bright. An anomaly is a region whose brightness is inconsistent with its neighbours and with its texture complexity.

The second principle is that high-frequency content is naturally bright. Sharp edges, fine text, fabric textures, and granular detail never reach compression equilibrium fully at high quality settings because each re-save still changes the high-frequency coefficients measurably. A genuine image of a newsprint page will show uniformly high ELA values across the text and this is not a forgery signal; it is a texture signal.

Several entirely innocent image-production pathways produce ELA patterns that could be mistaken for splicing or editing. Each pathway must be considered before interpreting an ELA map.

• In-camera HDR processing: cameras that merge multiple exposures internally produce images where tone-mapped regions may have different local compression characteristics. The ELA map can show irregular bright patches that have nothing to do with post-capture editing.
• Screenshots: a screenshot of a webpage or another application captures elements rendered by a GPU pipeline, which produces flat colours, sharp edges, and composited layers. All of these produce unusually high ELA values because they represent a different production pathway than a camera-captured scene. A screenshot of a photograph is not a forgery of the photograph, but ELA may flag it heavily.
• Smartphone AI processing: modern smartphones apply segment-aware sharpening, noise reduction, and portrait-mode depth effects that treat different regions of the image with different processing. The processing boundary, for example between a blurred background and a sharp foreground in portrait mode, can produce an ELA edge that looks like a splice.
• Re-sampled or resized images: any image that has been downsized and re-saved will have a compression history that differs from an image captured at that resolution. The resampling interpolation redistributes energy across the frequency spectrum and changes the ELA response.

The practical implication is that ELA findings must always be checked against the claimed provenance. If the image is alleged to be a smartphone portrait, the analyst should obtain a known-genuine image from the same device model and compare ELA responses before concluding that the depth-processing boundary is an edit.

FotoForensics uses a re-save quality of 95 as its default, and most published ELA analysis uses this convention. But the choice of re-save quality changes the map. At higher re-save qualities, all regions retain more of their original values and the differences are larger overall; subtle anomalies become more visible but so does noise. At lower re-save qualities, aggressive quantisation pushes all regions toward equilibrium quickly and the differences are smaller.

The forensically safe approach is to run ELA at the same quality as the estimated original compression quality. If the source image was compressed at quality 80, re-saving at quality 80 provides the most meaningful equilibrium comparison. Re-saving at quality 95 on an image that was originally compressed at quality 60 will show high ELA values for the entire image, because the image is far from equilibrium at 95, which is mostly uninformative.

ELA has a specific and limited scope. It detects differences in JPEG compression history. It says nothing about manipulation in lossless-format images (PNG, TIFF). It provides no evidence of manipulation in cases where the edit was applied before the first JPEG save, or where the attacker used a tool that brings the edited region to the same compression equilibrium as the surrounding image. It cannot distinguish object removal or inpainting from authentic content, because neither operation necessarily disturbs the compression history if done carefully.

• Do not use ELA on PNG or TIFF files: ELA measures JPEG compression history. Applying it to lossless formats by converting to JPEG first introduces artefacts that invalidate the analysis.
• Do not use ELA to authenticate faces or text independently: these are naturally high-ELA regions in virtually every photograph.
• Do not present ELA as a standalone finding: corroborate with at least JPEG ghost analysis, noise analysis, or geometric consistency before drawing conclusions.
• Do not share the ELA map without quantitative context: a bright patch looks alarming without knowing what the surrounding baseline level is. Always compare the suspect region to same-texture reference regions in the same image.

FotoForensics, built by Neal Krawetz, is the most widely known ELA implementation and runs as a web service, combining ELA, JPEG quality analysis, and several metadata views for rapid triage. For casework, uploading evidence to a web service creates chain-of-custody concerns: the image is transmitted to a third-party server, logged, and potentially visible to others. Practitioners should use offline implementations for anything that could become court evidence.

Offline ELA requires only a JPEG encoder library and a few lines of code. In Python, the standard approach uses Pillow to re-save the image and NumPy to compute the per-pixel difference, then amplifies and saves the difference image. This can be reproduced, audited, and documented as part of the casework record in a way that a web service cannot.