Often we are asked to provide expert opinion on when digital photographs were originally taken and if they’ve been manipulated. Examining the properties of a photograph will reveal some information, but how do we know whether the properties are accurate? It is easy to manipulate these if you know what you are doing.

Visual anomalies in photographs may initially suggest evidence of digital manipulation. Inconsistencies between photographs taken in a series, light and tone variations and pixel aspect ratios may all raise suspicions. However these visual conclusions cannot take precedent over the definite results of the forensic analysis.

When an expert analyses the embedded metadata and algorithms, evidence of digital manipulation may become clearer. It should be noted that without the “original” photographs, one should not rely on forensic analysis alone as metadata can be lost in reproduction.

Examination of the EXIF metadata will reveal further information. Exchangeable image file format (EXIF) is metadata embedded in a photograph, which define date and time information, camera model and settings, geo-locations and other pertinent information. However we would not expect to see any useful EXIF information from a photograph downloaded from the internet.

Error level analysis can establish whether a photo has been digitally altered. Photographs in a JPEG file format actually lose quality each time they are resaved. The investigator can take advantage of this to try and work out if an image has been digitally manipulated.

Error level analysis shows the difference in quality level, represented by brightness. Things which are very bright have been edited most recently, whilst duller parts have been resaved multiple times. This highlights which parts of the image have been changed and in what order the changes occurred.

Adobe Photoshop CS5 photographic manipulation software is used to interrogate pixel aspect ratios and zoom into areas of particular interest. Pixel aspect ratio is a mathematical ratio that describes how the width of a pixel in a digital image compares to the height of that pixel. It also allows the investigator to make colour, focus and size calculations of suspected digital manipulation.

JPEG Snoop is a software package that allows a user to identify whether a picture has been retouched. It analyses a range of data and grades and image from Class 1 (definitely processed/edited) to Class 4 (uncertain if edited or original). Whilst it cannot define whether a photo is "original", it can easily ascertain if it has been digitally manipulated.

JPEG Snoop uses an internal database that compares an image against a large number of compression signatures. If the compression signature matches any photo editing software, we can be reasonably certain that the image has been edited. Access Data Forensic Toolkit FTK is recognized around the world as the standard in computer forensic investigation technology. FTK is a court-validated platform that delivers cutting edge analysis, decryption and password cracking, whilst providing an intuitive interface that the user can customise to suit their needs. FTK is useful to analyse Exchangeable Image File Format (EXIF) or meta-data. This is a specification for image file formats used by digital cameras. EXIF is a recording of data attributes to an image, which describes the settings used by the camera to record the photo. EXIF data can include the camera details, length of exposure, focal length, shutter speed, ISO rating, and various other useful datasets.