Image forensics plays an integral role in online investigations. Providing investigators with the ability to analyse media and uncover previously inaccessible insights, these tools are only growing more and more important in an age of AI-generated imagery and rising new media trends. 

But what does image forensics involve? Why does it matter? And what’s next for the image forensics landscape?  

Below, we’re diving into all of these questions and more, bringing you a full guide to image forensics while exploring an example of the processes that make them possible.  

First things first, what is image forensics?

Image forensics involves the analysis and examination of digital images to uncover a wide range of useful information. This could include information about the image’s origin, authenticity, any potential manipulations or alterations, and more.  

Often, an investigator will turn to the use of image forensics with three objectives in mind:  

1. Manipulation analysis 
2. Metadata analysis  
3. Content analysis 

Manipulation analysis 

Ongoing innovations in image generation and manipulation tools like Midjourney, Dall-E, and Adobe Photoshop / Firefly have made it easier than ever before to manipulate existing images beyond recognition, or to create entirely new and photorealistic images. For investigators, this creates a big challenge.  

Firstly, offenders can confidently claim that an image is fake, and that it was manipulated to include them. Without the correct tools and processes available, these claims can be difficult to overcome with certainty. Image forensics can help, enabling investigators to analyse specific images and determine if they are the original, or if they have been manipulated – as well as providing details on how.  

Investigators may also end up spending valuable time pursuing false lines of enquiry based on generated or manipulated images. With tools only getting more realistic, the use of image forensic tools will be extremely helpful in determining image authenticity by indicating a source. To learn more about the challenges of AI-generated imagery, read our full blog here.  

Metadata analysis

Metadata analysis is one of the most significant components in any image forensics research. It involves using specialised tools like CameraForensics, Griffeye, or Bluebear, to explore the hidden data that sits behind an image. This could be lens type, camera model, username, GPS, serial numbers, and more.  

Once this metadata is revealed, users can filter wider databases against this to discover other related imagery that may contain additional information, context, or identifiers. 

Content analysis

Content analysis involves exploring the specific content of imagery, rather than analysing the metadata behind imagery. Here, experts examine the content of an image to detect hidden information, inconsistencies, or any other insights that may forward their research. 

Many of Bellingcat’s investigations make effective use of content analysis to aid their online research. To see this in action, explore the example below, which saw image forensics being applied by Bellingcat investigators to debunk imagery of Ukrainian soldiers harassing women. 

Exploring image forensics in action with Bellingcat

Investigative journalists, Bellingcat, set out to explore a dashcam video captured on March 24th that was circulating pro-Russian forums. It depicted supposed Ukrainian soldiers harassing a woman at a traffic stop, firing their guns into the air and verbally abusing a mother in front of her child. They set out to answer two questions:  

• What was the full story? 
• Were the two soldiers Ukrainian? 

Collaborating with online geolocation specialists, Bellingcat were able to identify and link the imagery to a specific road by comparing a user-submitted video to the March 24th dashcam footage.  

The March 24th dashcam footage showing specific tree branches and features 

User-submitted video of the same features confirming the location 

This information indicated that the dashcam footage was captured in the Donetsk region, which was heavily occupied by Russian forces at the time. As Bellingcat writes: 

“[Ukrainian soldiers] would have had to cross one of the most contested and dangerous frontlines in Ukraine and advance 30 kilometres into Russian-occupied territory before accosting this woman for overtaking it.” 

Following the investigation, which uncovered that the video was a hoax, many pro-Russian commentators were quick to disavow their previous claims. This is a great example of content analysis and image forensics in action - take a moment to read more about the investigation today. 

How is image forensics changing?

The way that we generate, share, and access images is always changing, as new tools, platforms, and types of media rise in popularity. That’s why image forensics processes are also constantly changing.  

Image forensics tools continue to evolve, leveraging sophisticated algorithms, AI, and machine learning techniques to detect even the most subtle manipulations in images. 

Accessibility and training remain a constant focus. The tools and techniques for image forensics have become more accessible to a broader audience, including law enforcement, journalists, and the general public. This has led to increased awareness and scrutiny of digital images. 

A widespread emphasis on global collaboration. Image forensics partners and users have recognised the need for greater collaboration with social media platforms, governments, and more. As the online landscape changes, and perpetrators deploy new countermeasures, this is more important than ever.  

Committed to driving positive change 

With online exploitation and abuse continuing to pose a threat to children worldwide, image forensics equips investigators with the tools necessary to fight back. To learn more about image forensics, take a look at our previous image forensics guide, where we provide clear examples, and answer your burning questions.