"Photoshopped" covers a wide range: a harmless colour grade, a removed ex, a spliced-in protest crowd, a doctored receipt. The goal here isn't to catch every retouch — it's to decide whether an image has been changed in a way that changes its meaning. That question has an answer more often than people assume, and you rarely need a lab to reach it.
A note on scope before you start: this is manipulation forensics, not AI detection. If you suspect the whole image was synthesised rather than edited, our is-this-image-AI-generated guide is the better tool. The checks below assume a real photograph that someone altered. Work them in order and stop as soon as one gives you a clear contradiction.
The five-step forensic pass
Start with the metadata — it is the cheapest tell
Before any pixel analysis, drop the file into an EXIF viewer (Jeffrey's Image Metadata Viewer, ExifTool, or the metadata panel inside FotoForensics). Two fields do most of the work. The Software tag will often name the editor outright — a value like "Adobe Photoshop 26.0" on a photo that is supposedly a raw phone snapshot is a contradiction worth explaining. Then compare DateTimeOriginal against ModifyDate: when the modify date is later than the capture date, the file was opened and re-saved by something. Neither proves manipulation on its own, but both point you at where to look.
Run Error Level Analysis on a first pass
ELA re-saves a JPEG at a known compression level and maps how far each region moves. Areas edited and pasted in tend to sit at a different error level than the untouched background, so they glow brighter or duller in the ELA view. FotoForensics (built by researcher Neal Krawetz) and Forensically at 29a.ch both do this in-browser with nothing to install. Read it carefully, though: ELA is a lead, not a verdict. Sharp high-contrast edges naturally show high error levels, and any image that has been screenshotted or re-compressed by a social platform will look noisy everywhere. Treat a bright patch as a question, not an answer.
Look for cloned regions and noise seams
The two edits people actually make are cloning (stamping one part of the image over another to hide or duplicate something) and splicing (pasting a chunk from a different photo). Forensically's clone-detection view flags near-identical blocks, which catches a duplicated cloud, a copied face in a crowd, or a repeated brick used to paint out an object. Its noise-analysis view is the counterpart for splices: every camera sensor lays down a distinctive noise fingerprint, and a region imported from another source usually carries the wrong one, leaving a faint seam at the join.
Interrogate light, shadows, and reflections
Physics is the one thing a hurried editor forgets. Pick every object that casts a shadow and check the shadows point consistently away from a single light source; a pasted-in figure often carries its old lighting. Do the same with reflections in windows, water, glasses, and eyes — a reflection that does not match the scene is a strong signal. Shadow length and direction also encode the time of day, so a shadow that disagrees with the claimed hour is its own kind of edit. This is slow, manual work, but it needs no tools and it is very hard to defeat.
Find the earliest version of the image
Manipulation is often just recycling. Run the picture through Google Lens, TinEye, and Yandex to surface older copies — an unedited original from three years ago settles the question faster than any forensic filter. TinEye's "oldest" sort is built for exactly this. Our companion walkthrough on reverse image search covers the phone and desktop steps in detail.
Free tools worth bookmarking
None of these is a verdict machine. Run an image through two or three and weigh the signals; agreement across independent methods is what builds a case.
| Tool | Type | What it's good for |
|---|---|---|
| FotoForensics fotoforensics.com | Free web tool | Fast ELA plus a metadata dump. The standard first-pass check. |
| Forensically 29a.ch/photo-forensics | Free web tool | ELA, clone detection, noise analysis, and magnifier in one no-install suite. |
| Jeffrey's EXIF Viewer exif.tools | Free web tool | Reads Software, timestamps, GPS, and camera fields from an upload or URL. |
| ExifTool exiftool.org | Free command-line | The reference metadata reader; scriptable and exhaustive for power users. |
| Google Lens / TinEye lens.google.com · tineye.com | Free | Finds older, unedited copies. Provenance often beats pixel forensics. |
Where these methods lie to you
The fastest way to embarrass yourself is to over-read a single filter. A few honest limits:
- Metadata is easy to strip and easy to fake. Almost every social platform deletes EXIF on upload, so a "clean" file with no metadata usually just means it passed through Instagram — not that it's untouched. And a Software tag can be edited by hand. Absence of evidence isn't evidence.
- ELA collapses on re-compressed images. Screenshots, memes, and anything downloaded-then-reuploaded have been re-saved so many times that ELA lights up everywhere. It works best on an original-quality JPEG straight from a source.
- A clean forensic result is not proof of authenticity. A skilled edit, or a manipulation done before the file was ever compressed, can pass every check here. These tools raise confidence; they rarely deliver certainty in either direction.
- Content Credentials are the emerging counter-signal. A growing number of cameras and editors now sign images with C2PA provenance data. If it's present, it tells you what was done and by which tool — see our Content Credentials guide.
The habit that matters most
Forensics is a tiebreaker, not a starting point. Before you open FotoForensics, ask the boring questions: who first posted this, when, and does any reputable outlet carry the same image with a caption? An unedited version with a real date and a named photographer beats a glowing ELA map every time. Run the pixels when the context runs out — not before.
Not sure the claim behind the photo is even real?
FAXTR searches 100+ fact-checking organizations in one query — free, no login required.