Error Level Analysis

Error Level Analysis

Error level analysis is a very simple technique to enhance [double compression artifacts] cause by montages with different level of quantization in compression images.

This technique is only valid for images in quantized lossy algorithms such as JPEG

This technique was first proposed by Dr. Neal Krawetz and Hacker Factor Solutions. In “A pictures worth...” Hacker Factor Solutions, 6, 2007. In this technique a copy of an image is saved with reduced quality, and the difference from this lower quality image is computed from the original image (E = | I - M|, where E is the Final Image, I is the original image and M is the lower quality image).
The value histogram for the new image is adjusted for better contrast.
According to [double compression artifacts] the closer the quantization of the lower quality image gets to a value q3 that will make the error in the original image be minimal, the higher the error will be for tampered parts of image.

Usage

When the plug-in is lunched, several parameters will be asked accordingly to the image below.

• File To analyze - The file with the tampered image
• Jpeg quality - The quality of resave image, in the case of batch render, this is the initial quality. This value must be between 0.01 and 1.0
• Gamma level for adjustment - When adjusting the value histogram, it is possible to adjust the gamma value different from 1.0. lower values of gamma make a darker image, while brighter values make a brighter image.
• Attach info to image - Whether the information of the image should be rendered direct to the image. In this case the quality and gamma parameters will be rendered in the image. This option is very interesting when doing a batch render
• Batch Render - Whether a batch render is to be performed. In a batch render all qualities of images are rendered between Jpeg Quality and 1.0.
• Step for Batch Render - in a batch render, the increment steps between the quality of each image is given by this parameter.

Batch render is especially interesting to make a search for possible values of quality resave that may reveal tempered regions of the image.

Examples of tampered image and ELA.

ELA result

see the difference in error level between the bat region and the rest of the image.

In the next example a square in the middle of the image was cropped and resave with a lower quality, although the image is visually identical, this technique can clearly show the tampered region.

Caveats

All caveats listed in [double compression artifacts] apply to ELA. When analyzing images with this kind of tool, the forensics investigator should take extra caution not to get trap in some pitfalls like error in Jpeg compression due to very homogeneous areas, that leads to false positives.

Error Level

Error level in ELA is given by the difference of pixels. Sometimes, especially if the images where saved in the same editing software (same quantization tables) this error level might be very small, in this cases is useful to utilize techniques such as [JPEG Ghost] that highlight the square of error.