SourceCheck

Error level analysis: what the bright patches mean

Error level analysis turns up in online arguments about whether a photo was edited, usually as a colourful image with a glowing patch and an arrow. Sometimes that patch is a real edit. Often it is an edge, a patch of text, or a misunderstanding of what the technique measures.

ELA only works on JPEG, and it only makes sense once you know what JPEG does to an image.

What JPEG throws away

JPEG splits an image into small blocks and discards detail the eye is least likely to miss. The amount it discards depends on the quality setting. Crucially, the loss shrinks with each save: the first save removes a lot, the second removes less, and after several saves the image barely changes at all, because there is little easy detail left to remove.

What ELA measures

ELA saves the image once more at a fixed quality and compares the result with the input. The difference - the "error level" - is shown as brightness.

If every part of a photo has been through the same history of saves, similar surfaces change by similar amounts. If one region has a different history - pasted in from a photo saved at a different quality, or edited and saved separately - it changes by a different amount, and stands out from matching content around it.

Reading the output

The key word is matching. ELA output is never uniform, even for an untouched photo, because different kinds of content compress differently.

  • Edges are bright. Sharp transitions are expensive to compress. Every outline glows a little.
  • Text and fine texture are bright for the same reason.
  • Flat areas are dark. Sky, walls and skin compress cheaply.

So a bright edge or a glowing sign is not a finding. The finding is a surface that is brighter or darker than the same kind of surface elsewhere in the image. One face noticeably brighter than three others under the same light. A patch of sky that does not match the sky around it.

A SourceCheck report with a content hash mismatch and deep analysis section below
Forensics sits below provenance in the report: when a signature exists, it is the stronger evidence.

Three situations where ELA tells you nothing

Heavy recompression. Social networks re-encode uploads, often more than once. After that, error levels across the image converge and differences vanish - both real edits and innocent variation.

Lossless formats. PNG has no lossy compression history, so there is nothing to compare. Converting a JPEG to PNG and back also scrambles the evidence.

Whole-image generation. An AI-generated image is created in one pass. There is often no pasted region with a different history, so ELA can look perfectly clean.

A careful editor can also deliberately even out error levels. ELA catches the quick edit far more often than the skilled one.

How to use it without fooling yourself

  1. Run it on the original JPEG, never on a screenshot.
  2. Ignore edges, text and texture first.
  3. Compare like with like across the image.
  4. Treat a real anomaly as a place to investigate - check the scene, other photos, earlier copies.
  5. Never publish an ELA image as proof on its own.

Where it sits among other checks

ELA is a pixel-level guess about history. When a file carries valid Content Credentials, the signed record of edits is far stronger evidence than any forensic reading. When it does not, ELA is one useful lens among several - metadata, AI signals, reverse image search - and is most valuable when it points you to the specific region the other checks should focus on.

Keep reading