How to Tell If a Photo Has Been Altered

Someone hands you a photograph and asks whether it is real. A contractor's before-and-after. A tenant's damage claim. A listing photo. A screenshot of a document.

There is a disciplined way to work through that question, and it is worth knowing, because a large fraction of real-world manipulation is unsophisticated and leaves obvious traces. There is also a hard limit to how far it goes, and being honest about that limit is more useful than a checklist implying certainty it cannot deliver.

One framing note before the method. Visual forensics can sometimes tell you that an image was altered. It can almost never tell you that an image was not. Absence of evidence in a well-made composite is the expected result, not a clean bill of health.

1. Start with the metadata

Always first: it is fast, and it is where careless manipulation announces itself.

Open the file's full metadata — not the operating system's summary pane, which shows a curated subset, but the complete tag set. The open-source ExifTool utility is the standard way to do this. What you are looking for:

• Software fields. A file naming an image editor in its Software or ProcessingSoftware tag has been through that editor. It does not mean the content was falsified — cropping and color correction are edits too — but it moves the file out of the "straight from the camera" category.
• ModifyDate later than DateTimeOriginal. The file was written after capture. Common and often innocent, but it is a fact you now have.
• Missing camera block entirely. A photo claiming to be a phone capture with no make, model, lens, or exposure data has been re-encoded, stripped, or created some other way.
• Thumbnail mismatch. Some files carry an embedded preview generated at capture, and editors do not always regenerate it. When that thumbnail differs from the main image, the signal is strong and very specific.
• Internal contradiction. A camera model that never supported the lens listed. A GPS timestamp inconsistent with the local timestamp. Dimensions inconsistent with the stated sensor.

Then check metadata against the image content. A timestamp of 9pm on a photo in full daylight. Sun angle and shadow length that do not fit the stated date and latitude. Foliage or snow cover inconsistent with the season claimed. These content-versus-metadata mismatches are among the most reliable findings available, because they require the manipulator to have thought about two independent systems at once.

2. Look for resolution and compression inconsistencies

A composite is assembled from sources that did not share a history, and that leaves statistical fingerprints.

Sharpness that does not match. Every lens and sensor produces a characteristic level of detail, varying smoothly across a frame — softer at the corners, sharper near the plane of focus. A face crisper than the wall directly behind it, at the same distance, is anomalous.

Noise that does not match. Sensor noise has a texture that depends on ISO, exposure, and the camera's processing, and it should be consistent across regions of similar brightness. A patch with visibly different grain — or one suspiciously clean in an otherwise noisy frame — is worth pursuing.

Compression artifacts that do not match. JPEG encodes in blocks, and repeated saves accumulate blocking and ringing. An element pasted in from a heavily compressed source retains its own artifact pattern. Zoom in hard around the boundary of a suspect region and look for a change in the block structure.

A caveat that has become important: modern phone cameras apply aggressive per-region computational processing — different sharpening for faces than for sky, semantic segmentation, multi-frame merging, night modes compositing many exposures. This produces genuine, innocent inconsistencies across a single authentic frame. The technique that used to be a reliable tell now generates false positives constantly.

3. Check lighting and shadow direction

Physics is difficult to fake by hand, and this remains the more durable check.

Under a single dominant light source, shadows should be consistent. Trace each object's shadow back toward the source and see whether the directions agree. Under sun — effectively infinitely distant — shadows run essentially parallel. Under a nearby lamp they radiate from a point, and the projected directions should converge on it.

Beyond direction, check:

• Shadow softness. Overcast light produces soft-edged shadows everywhere; direct sun produces hard ones. An object with a hard shadow in a soft-shadow scene does not belong.
• Shading on the object itself. An inserted element lit from the left in a scene lit from the right is a straightforward catch.
• Color temperature. Light has a color, and it tints a scene consistently. An element carrying a different white balance often reads as subtly wrong before you can articulate why.
• Reflections. Windows, water, polished floors, eyes. Reflections are laborious to fake correctly and are frequently omitted or left inconsistent.
• Contact shadows. Objects resting on surfaces cast a dark shadow where they meet. Composited objects often float — no contact shadow, or one that does not match the geometry.

4. Inspect edges at high magnification

Zoom to 200–400% and trace the boundary of anything you suspect was inserted, removed, or moved.

Manual selection work leaves traces: a boundary too clean for the surrounding image, a halo of light or dark pixels along an edge, a fringe of color belonging to neither side, or fine detail — hair, foliage, chain link — terminating unnaturally instead of resolving into strands. Look also for mismatched motion blur or depth-of-field blur: a sharp-edged object dropped into a region where everything else is out of focus.

Straight lines are useful reference structures. Where an edit crosses a door frame, a grout line, a fence rail, or a window mullion, check that the line continues correctly through the boundary — same angle, same thickness, no kink or offset.

5. Look for repeated texture from cloning

Removing something from a photo means replacing it with plausible surroundings, traditionally by copying nearby pixels. Copy-move manipulation leaves duplicated regions.

Scan surfaces that should be irregular but not repetitive — gravel, grass, wood grain, carpet, brickwork with variable staining, a textured ceiling. You are looking for an identical patch appearing twice: the same knot in two planks, the same distinctive pebble in two places, the same water stain repeated. Real textures do not repeat exactly.

Also watch for the opposite artifact: a region that is too uniform. Content-aware fill and generative removal tools can leave a smeared, low-detail patch where the surrounding texture is busy.

6. Sanity-check the scene against the world

The most decisive findings often come from outside the file. If a photo claims a location, does the visible architecture, signage, vegetation, or street furniture match what is publicly documented about that place? Does the claimed date fit the construction stage, the vehicle models, the weather? Are there other images of the same scene, from other sources?

This is unglamorous and it works. A manipulation that survives every pixel-level test can still be defeated by a detail the manipulator did not know to control.

Where all of this stops working

Now the honest part.

Every technique above targets a specific artifact of editing — the seams left when someone modifies an existing photograph. Modern generative image models leave no seams, because the image is synthesized as a coherent whole. Lighting is consistent because the model learned lighting. Noise is consistent because it was generated across the whole frame. Nothing was copied, so there is no cloned region and no boundary to magnify.

Generative fill and inpainting sit in between, and have largely eliminated the crude tells too: they synthesize a replacement region conditioned on the surrounding image, so texture, noise, and lighting are matched by construction rather than by eye.

Automated detectors exist, and they help in aggregate, but their track record on individual images is uneven — they degrade sharply on compressed, resized, or screenshotted content, and lose accuracy against generator architectures they were not trained on. Treat a detector score as one input, never as an answer.

The uncomfortable summary: the classic checklist reliably catches lazy manipulation, which is still most manipulation. It does not reliably catch competent manipulation, and it is close to useless against a well-prompted generative model. Anyone who claims they can look at an arbitrary image and determine whether it is synthetic is describing a skill that no longer exists at the reliability people assume.

Why provenance beats detection

Detection asks an analyst to work backwards from a finished file with no reference to compare against — an adversarial problem where the adversary improves continuously and the analyst's tools do not keep pace. The trend has one direction.

Provenance inverts it. Rather than proving after the fact that an image is fake, you establish at the moment of capture that a specific file existed in a specific form at a specific time — cryptographically signed, and bound to the actual image data so that any subsequent change is detectable. Verification then becomes a mechanical check anyone can run, instead of an expert judgment call.

That is what the C2PA standard specifies, and it is a more tractable problem than detection, because it does not require anticipating what tomorrow's generative models will do. A hash either matches or it does not. Our explanation of Content Credentials covers the mechanism in detail, including what it genuinely does not prove.

Provenance has its own limitation, and it is a real one: it only works if it was there at capture. It cannot be applied retroactively to a photo someone already sent you. So if you are the one creating documentation that may be challenged later, the decision worth making is upstream — capture with provenance and keep the original file untouched. That is the problem EtchImage is built to solve.

Practical habits for anyone holding originals

• Never work on the original. Copy first, edit the copy, keep the original byte-for-byte as received or captured.
• Avoid re-encoding when sharing. Screenshots and chat-app compression destroy exactly the properties an examiner needs, invisibly.
• Record a hash of important originals. A SHA-256 checksum taken when a file arrives lets you demonstrate later that it has not changed in your custody.
• Keep the chain short. Every intermediary that re-saves or forwards a file weakens it. Fewer hops, fewer questions.