Tip #78Kinesense LE

How to check if an image has been altered

Use error level analysis, EXIF and hex viewers, JPEG Snoop and image compare in the Authentication tab to test whether an image is genuine.

Patricia McCabeSoftware Engineer

KinesenseLE v4.0 introduces a new Authentication tab. You will find this new tab in Report next to Annotate and Clarification. Authentication provides a number of new tools to help investigators determine if an image file or photograph is real or has been altered.

Error Level Analysis

This is a standard tool for analysing jpeg files. It highlights regions of an image which show different levels of compression. This can indicate parts of the image which have been added using image editing software.

Error Level Analysis in the Authentication tab, comparing an image with its compression levels.

Exif Viewer

Exif data is added to an image file by the digital camera and by editing software. This tool extracts that data and highlights terms useful for authentication such as ‘Creator tool’, ‘Software’, ‘Modified Date’, etc.

The Exif viewer in the Authentication tab, listing an image’s metadata with editing software entries highlighted.

Hex Viewer

Hex viewer reads the raw binary data from the image file and automatically searches for and highlights useful byte sequences, such as those corresponding to ‘Photoshop’, or ‘Adobe’.

The Hex Viewer in the Authentication tab, showing an image’s raw bytes with useful sequences highlighted.

Jpeg Snoop

Jpeg Snoop computes the ‘compression signature’ of a jpeg image and then compares it to a database of over 3300 different cameras and software applications, highlighting matches.

JPEG Snoop in the Authentication tab, comparing an image’s compression signature with known cameras and software.

Compare

The compare tool lets you select two images and compare them. If a region of one image differs, those pixels are highlighted. Compare also looks at the binary data and highlights bytes that have been altered.

The Compare tool in the Authentication tab, highlighting the pixels that differ between two images.

Format support

3000+ video formats

Anything playable in Windows Media Player, VLC or FFmpeg is supported, without the manufacturer's original player. Have a format that isn't listed? Our engineers have 17 years experience of dealing with difficult formats.