posted on May, 22 2011 @ 04:11 PM
I think there's a lot of misunderstanding here of what error level analysis (ELA) is and how it works. To understand we should first understand image
jpg/jpeg (they stand for Joint Photographic Experts Group, the group that created the standard) is a "lossy" image compression format. This means
that it actually destroys data in the original image in order to make a file smaller. This destruction of data is performed in such a way that it
should not visually change the image. Of course, when the compression is too strong, the results of the lost data become visible and we get what we
call "compression artifacts."
One of the things that often results in low image quality is recompression. When you open a file in an editing program and then save it in, the
compression calculations will be redone. As this occurs, it will result in a further loss of data. Over multiple cycles this becomes quite noticeable
in the form of artifacting.
What ELA does is attempt to identify the relative level of data loss or compression error for different parts of the image, and then produce a
false-color image or heatmap showing us what level of error each part of the image is at.
This is useful to image forensics because, typically, the entirety of an image will be at the same rough level of error. Let's say we edit an image
though, for example by inserting an object in to an image. In context, we'll use a UFO as an example. We have an image of a sky with some houses
below and the sort that was taken by a camera belonging to the hoaxer. The camera saved the image at probably 80% quality depending on its settings.
He then takes a picture of a UFO off of the internet. This image of a UFO is based on an image of a vacuum cleaner part, but editing has occured since
then, so it has been compressed by the camera, and then it has been recompressed once by photoshop after some editing, and then someone resized the
image so it's been recompressed again, at around 80% quality each time. This means that the UFO image, after multiple recompressions, is of lower
quality (higher error level) than the image of the sky. We edit the UFO image in to the sky and save it. At the end of the process, we have one image
in which the sky has been compressed twice and the UFO has been compressed four times. Hopefully an ELA analysis will show us that these are at much
different error levels, indicating that they don't go together - they aren't from the same original data.
There are several things that make this very difficult. First, the image must be in jpeg format (or another lossy compression format, although I have
only seen it implemented for jpeg since most images we want to analyse are in this format). Second, the image must be derived from edited digital
copies. As a previous example, two pictures of greys were presented. The first image is not a candidate for ELA analysis because the alien has been
inserted via CGI in to video master. The video master copy used in the editing house is not compressed at all, rather it is raw data from the
camera's image sensor. This means that, even though we know Paul has been added artificially, he will be at the same error level as the background,
because they were both inserted at uncompressed (or 100%) quality and then compressed to a release video format (h.264, matroska, mpeg, etc) and then
recompressed to jpeg for the still image. The second example (the "new" greys) appears to be either a scan of a negative or a scan/photograph of a
printed photo. This is not eligible for ELA because the first digital copy in the chain was of the photo in its current form, not of some original
Basically, ELA is useful with two assumptions.
1. The photo being analyzed is a result of direct computer editing of some original, unmodified (or less modified) photograph. As such, scans and
photographs of potentially modified photos are not eligible (because ELA would only help us find modifications that happened after the scanning or
2. The editing was performed with images in a lossy format, or at least one image in a lossy format. For example, an image in camera RAW format
(nikon/.nef, canon/.cr2, sony/_, etc) with an image inserted also in camera RAW format would not be detectable by ELA, because both images were
inserted at 0% error level and have the same compression history. This is also true of raw video formats (which are used exclusively inside
professional video editing houses) and rendered images in a full-quality format.
Now, interpreting ELA is a whole seperate problem. The results of an ELA program are hard to interpret, primarily because a jpeg file normally
contains varying levels of error throughout the image, because jpeg handles different kinds of patterns more or less effectively. This means that you
might have a flat color area in an image with fairly low error and then a person on that background with high error, and this is perfectly normal. In
order to effectively interpret ELA you must look at two areas with a similar pattern or property as understood by the compression algorithm, so
effectively two areas that look quite similar texture-wise. They should have a similar error level across the image, although they may still vary
because of the things around them. If we see a strong difference between two areas of very similar texture, this may indicate that one of the areas is
not of the same origin as the other (although we cannot be sure of this). This information is most useful by looking at the ELA of the whole image in
context and by applying some experience having looked at many examples.