Imagine you work claims at an insurer, and someone sends in a photo of their flooded kitchen. Looks right. Ruined cabinets, water line up the wall, the lot. Five years ago, you’d have moved on to the next file. Now there’s a nagging little voice asking whether anyone actually stood in that kitchen with a camera.
That nagging voice is basically the job description for image forensics these days. Anybody can fire up animage generation model, type a sentence, and get something that passes at a glance, which is great fun right up until the picture ends up as evidence. So, here’s how these images get made, what they tend to give away, and how investigators check one without claiming more than they can back up.
How an image generation model actually takes a picture
Quick bit of background, because it makes the rest easier to follow.
Early generators (GANs) were built around a kind of contest. One network drew pictures; another tried to spot the fakes, and they kept at it until the fakes got hard to spot. Most current tools work differently, using diffusion. You begin with pure static, like an untuned TV, and the model strips it away bit by bit, nudged along by the words in your prompt.
Whichever method it is, there’s no camera anywhere in the process. The image gets assembled from patterns the model absorbed from millions of training pictures. No lens, no sensor, no actual light from an actual room. That missing physical origin is what analysts go looking for.
What synthetic images tend to leave behind
Nothing here is a smoking gun by itself. The famous slip-ups, like extra fingers, are getting rarer every few months, so analysts tend to stack up several small things instead.
- Obvious visual errors. Hands, lettering on signs, earrings that don’t match, hair merging into a wall. Newer models mostly fix these, so don’t count on finding any.
- Lighting that doesn’t add up: two shadows pointing different ways, a mirror showing something that isn’t there, perspective lines that won’t meet.
- Texture you can’t see but software can. Generated images sometimes have faint repeating patterns in the frequency data, where real sensor noise looks messier.
- No believable camera signature. Every real sensor leaves its own faint noise pattern, and a generated file usually has none, or one that doesn’t belong to any camera on record.
- Whatever the file admits to. Metadata naming editing software, a strange compression history, EXIF that’s blank or contradicts itself. Some tools now label their output, but labels can be stripped in seconds.
One catch, and it trips people up a lot: a test that finds nothing doesn’t mean the image is real. Social platforms recompress and strip upload all the time, so plenty of the evidence is already gone by the time you’re looking at a downloaded copy. Run the same test on the original, and you may get a very different answer.
A practical workflow for checking a suspect image
- Secure the original
Get the earliest copy you can. The original file beats a screenshot, and a screenshot beats something that’s been through three group chats. Make a copy, confirm it matches a hash, and only ever touch the copy. Write down who handled the original and when, because gaps in that record are an easy way for a lawyer to throw out good work later.
- Read the file before you look at the picture
Open the file “guts” before you look at the picture. What container is it? What do metadata, timestamps, thumbnails and compression history say? If it claims to be from a phone but is put together in a way that phone doesn’t do, that’s a red flag before you’ve looked at a single pixel.
- Look at the physical logic of the scene
Now ask whether the scene could physically exist, with shadows from one light and reflections showing real things. A method called photogrammetry is handy for this. Find something of known size, a doorway or a painted lane line, say, and check whether everything else and the perspective sit right with it. Generated scenes are often nearly right, which is exactly the problem.
- Test the signal
Next comes the signal itself: noise, frequency content, tiny local oddities. One trick is to compare patches of the same image against each other. If somebody pasted something in, or part of it was regenerated, that patch often behaves differently from what’s around it.
- Cross-check, then report honestly
Don’t hang everything on one test. Try a few different ones and see if they line up. If they don’t, put that in the report, along with the things your tests simply can’t tell you. A report that admits its limits hold up better when somebody starts asking awkward questions.
Why no detector can be treated as a verdict
AI image detectors are good for a quick first pass, and that’s about it. They learn from older generators, so a brand-new model can walk right past them for a while. They also raise false alarms on genuine photos that have been edited heavily or squeezed by compression.
So, a detector’s score is a place to start digging, not finding. In court somebody has to explain what was done and be able to repeat it, and “the tool said 87%” doesn’t cover that.
Who needs this, and where it matters most
- Police and other investigators checking whether an image handed in as evidence shows something that really happened.
- Lawyers and courts, on either side of an argument about whether an exhibit is genuine.
- Insurers and in-house investigators chasing doctored claims or made-up paperwork.
- Newsrooms and security teams, who need to check pictures before they spread, or who are wading through huge volumes of captured media for intelligence gathering.
The tools behind the work
What kit you need depends on where you are in the process.
- First, getting the media off a device without changing it. A decent data acquisition system does this in a way you can repeat and write up.
- Then examination and clean-up. Video enhancing software and image tools can pull out detail that’s already in the file, though they can’t invent any, and every setting you use should be logged.
- Hardware matters more than people expect. Big batches of high-res images chew through memory, so a proper forensics computer saves a lot of waiting, especially near a deadline.
- And since image work usually comes with chats, location data and documents, it helps to keep all your digital evidence in one tidy place.
If you’re putting together a complete digital forensic investigation setup, have a look at how the parts connect before you buy them one at a time. The forensic technology is moving about as fast as the generators are, so your investigation software has to keep up. Reading more broadly about digital forensics helps too, because image work never really happens on its own.
Conclusion
Kits only get you so far. Give two analysts the same software and you can get two different answers, mostly because one understands what the software is doing, and the other just clicks buttons. Good digital forensic training covers the methods and standards, plus how to present your findings to people who are trying to poke holes in them.
If you’re brand new, a forensic investigator course is a sensible place to begin. Teams already handling images could try video training software on sample material, including known synthetic pictures, before they go anywhere near a live case.
FAQ
- What is image forensics?
Looking closely at a picture to work out where it came from, whether anybody changed it, and whether a camera took it or software made it. - Can you always tell if an image came from an image generation model?
No. Some are easy to spot. Others, particularly ones that have been compressed or passed around a lot, leave next to nothing to work with. A good analyst tells you what they can show and where they’re guessing. - Are AI image detectors reliable enough for court?
Not by themselves. They’re fine for sorting out a big pile, but evidence needs documented, repeatable methods and a person who can explain them. - Does removing metadata make an image impossible to analyze?
No, metadata is just one clue. Noise, frequency of content, lighting, and geometry are still there to check, though you’ll be able to say less. - Is photogrammetry useful for spotting fake images?
It can be, as long as something of known size is in the shot. It shows whether sizes, distances, and perspectives hang together physically. - Where can I learn to do this professionally?
Look for training that covers methods, record-keeping and giving evidence in court, and practice on sample images before touching real cases.