Digital Image Forensics & AI-Generation Detection Suite for .NET
ForensicsDetector is a cross-platform C# console application for deep forensic analysis of digital images. It runs sixteen analytical modules that cover metadata inspection, JPEG compression consistency, sensor noise physics, and frequency-domain structure, then combines their outputs into two probability scores: the probability of manual manipulation (splicing, retouching, clone stamping) and the probability that the image was produced by a generative model (Midjourney, Stable Diffusion, DALL·E, Flux, and similar).
The tool ships in two operating modes: an interactive console CLI for local examination, and a built-in Telegram bot for remote analysis. Every scan produces a self-contained interactive HTML report with embedded visual evidence maps.
- Overview
- Detection Capabilities
- The 16-Stage Forensic Pipeline
- Scoring Model and Verdicts
- HTML Forensic Report
- Getting Started
- Telegram Bot Mode
- Configuration
- Platform Notes
- Technology Stack
- Project Structure
- Methodological Limitations
- Disclaimer
- License
- Contact
Edited and synthetically generated images leave measurable traces. Editors and generative models break JPEG quantization consistency between regions, remove or flatten sensor noise, damage demosaicing periodicity, lack lens-level chromatic aberration, produce spectral artifacts of variational decoders, and record metadata signatures of editing software.
ForensicsDetector is built around this idea. The pipeline runs sixteen fixed stages, and each stage targets a separate physical or statistical property of the image, so a manipulation that fools one check still has to survive the others. Their outputs are combined into two weighted scores, Manipulation Probability (0-100%) and AI/CGI Probability (0-100%), which are then mapped onto a final verdict.
Key characteristics:
- Multi-signal scoring. Sixteen independent modules cover metadata, compression history, sensor physics, and spectral structure. No single module decides the outcome on its own.
- Dual interface. Interactive console mode for analysts and an embedded Telegram bot (long polling, concurrent request handling) for remote use.
- Evidence-oriented reporting. Each analysis yields a portable, offline-viewable HTML report containing all rendered forensic maps and the complete extracted metadata tree.
- C2PA awareness. Cryptographic Content Credentials (CAI / JUMBF markers) are checked before any heuristic analysis, providing hard evidence of AI generation or AI filtering when present.
- False-positive suppression. A dedicated messenger-image heuristic recognizes EXIF-stripped, re-compressed images forwarded through messaging platforms and prevents their recompression artifacts from being misread as tampering.
- Bilingual operation. The console, bot messages, and reports support English and Russian (set
Languageinconfig.json).
| Class of Threat | Signals Examined |
|---|---|
| Splicing / collage | Error Level Analysis peaks, noise-variance discontinuities, high-pass "sterile patch" detection, JPEG ghost boundaries |
| Retouching / liquify / airbrushing | Local luminance-variance flattening in 16x16 blocks, contrast suppression analysis |
| Clone stamping / copy-move | ORB feature-vector matching (Hamming distance) with geometric-displacement filtering and spatial cluster counting |
| Re-saving / laundered history | Double JPEG quantization (DCT comb-effect analysis), JPEG Ghost maps at Q75/Q85 |
| AI generation (diffusion models) | 2D FFT spectral anomalies (latent-VAE signatures), upscaler checkerboard artifacts, sterile PRNU fingerprint, Y/CbCr SNR mismatch, missing Bayer CFA structure, missing chromatic aberration, SRM residual anomalies, C2PA Content Credentials |
| Editing-software traces | EXIF/XMP software signatures (Adobe Photoshop, GIMP, PicsArt and derivatives), stripped-metadata detection |
| Provenance | Full EXIF/XMP/IPTC metadata extraction, camera-EXIF presence check, cryptographic origin credentials |
Stages are executed sequentially; each module reports a metric, a rendered evidence map (where applicable), and an anomaly flag.
| # | Module | Method | What It Detects |
|---|---|---|---|
| 1 | EXIF / XMP & Software Signatures | Full metadata tree extraction (MetadataExtractor) | Editor fingerprints (Photoshop, GIMP, PicsArt), missing camera EXIF, complete tag inventory |
| 2 | C2PA Content Credentials | JUMBF / CAI marker inspection | Cryptographic proof of AI generation or AI filtering (hard indicator) |
| 3 | Liquify / Retouch Analysis | 16x16 block luminance-variance and contrast statistics | Locally smoothed ("plastic") regions typical of warping and airbrushing |
| 4 | Double JPEG Quantization (DQ) | DCT coefficient periodicity analysis | Repeated JPEG encoding: the file was opened and re-saved |
| 5 | Error Level Analysis (ELA) | Re-encode at Q95, per-block error amplification (x20) | Locally elevated compression error, i.e. regions inserted at a different quality level |
| 6 | High-Pass Noise Map | High-frequency residual extraction and local variance audit | "Sterile" over-smoothed patches left by healing, cloning, or insertion |
| 7 | Copy-Move / Clone Stamp | ORB (6000 keypoints, Harris response) + Hamming BFMatcher, k-NN self-matching, displacement filtering (>50 px), spatial clustering | Duplicated image regions; reports the number of distinct clone clusters |
| 8 | JPEG Ghosts (Q75 & Q85) | Systematic re-compression sweep against reference qualities | Regions whose error signature reveals an earlier compression history different from the rest of the frame |
| 9 | Noise Mismatch Analysis | Sobel-gradient local noise-variance estimation | Abrupt noise-variance discontinuities, a hard indicator of splicing |
| 10 | 2D FFT Fourier Spectrum | Log-scaled Fourier spectrum rendering and energy audit | Periodic spectral peaks of latent-diffusion VAE decoders and neural upscalers |
| 11 | Bayer CFA Demosaicing | Correlation of pixel values against the Bayer color-filter pattern | Absence of sensor demosaicing structure, expected in fully synthetic images |
| 12 | PRNU Sensor Fingerprint | Photo-Response Non-Uniformity noise-energy and flatness estimation | "Sterile" fingerprint: no physical sensor ever captured the scene |
| 13 | Y/CbCr SNR Mismatch | Luminance vs. chrominance signal-to-noise comparison | Unnatural SNR balance between luma and chroma channels, typical of generative output |
| 14 | SRM (Spatial Rich Models) | Third-order high-pass residual analysis | Statistically anomalous residual texture, synthetic or heavily filtered content |
| 15 | Chromatic Aberration (CA) | Radial lateral-CA phase measurement | Missing lens-level aberration: the "optics" are mathematical, not physical |
| 16 | Upscaler Checkerboard | Checkerboard-pattern variance audit | Grid artifacts of neural upscalers (ESRGAN-class and similar) |
The pipeline produces two independent scores and a combined verdict.
Manipulation Score (0-100%) is accumulated from weighted triggers: editor signatures in metadata (+35), double JPEG quantization (+10, escalating to +25 when corroborated by physical anomalies), local retouching (up to +25), clone-stamp clusters (up to +40), high-pass sterile regions (up to +30), JPEG Ghost boundaries (up to +35), noise-variance discontinuities (up to +50), and localized ELA peaks (up to +50).
AI/CGI Probability (0-100%) is computed from two signal families:
- Hard indicators: C2PA credentials (immediate 100% classification), 2D FFT spectral anomaly, Y/CbCr SNR mismatch, SRM residual anomaly, missing chromatic aberration, upscaler checkerboard artifacts.
- Missing-physics indicators: sterile PRNU fingerprint, absent Bayer CFA interpolation, stripped EXIF combined with physical anomalies.
The base score is boosted when multiple hard indicators concur (x1.35 for two or more) and damped when strong independent evidence of manual editing exists (down to x0.45), so that a genuine photo manipulation is not misclassified as AI output. A messenger-image safeguard suppresses AI scoring for EXIF-stripped, re-compressed images that otherwise show no physics anomalies.
Final verdict matrix:
| Manipulation | AI Probability | Verdict |
|---|---|---|
| >= 40 | >= 65 | Hybrid Forgery: AI generation combined with manual collage |
| >= 45 | any | Photo Manipulation / Splicing / Heavy Edit Detected |
| any | >= 65 | AI Generation / Synthetic Art |
| >= 25 | any | Local Edit / Splicing Signs Detected |
| any | >= 40 | High AI / Generative Filter Probability |
| any | >= 25 | Suspicious Image (Signs of Processing) |
| < 25 | < 25 | Natural Photo (No Manipulation or AI Detected) |
Every analysis produces Forensics_Report_YYYYMMDD_HHMMSS.html, saved next to the executable. The report is fully self-contained (all visuals are Base64-embedded) and can be archived, e-mailed, or shared as a single file. It contains:
- Final Manipulation and AI probability scores, color-coded, with the combined verdict;
- A trigger summary listing every anomaly that contributed to the scores, with per-trigger metric values;
- The complete rendered evidence gallery: ELA map, High-Pass noise map, Copy-Move match visualization, JPEG Ghost maps (Q75/Q85), 2D Fourier spectrum, and Bayer CFA deviation map, each annotated with its metric;
- The full structured EXIF / XMP metadata table grouped by metadata directory;
- Contextual flags (C2PA detected, double JPEG, messenger re-compression, CA anomaly).
In console mode the report is opened in the default browser automatically upon completion.
- .NET 9 SDK or later: download
- Supported OS: Windows (native OpenCV runtime bundled), Linux, macOS (see Platform Notes)
- Supported input formats: JPG/JPEG, PNG, WEBP
All NuGet dependencies are declared in ForensicsDetector.csproj and are restored automatically, so no manual package installation is required.
git clone https://github.com/whoamicrash/ForensicsDetector.git
cd ForensicsDetector
dotnet build -c ReleaseThe executable and all required binaries are placed in bin/Release/net9.0/.
Interactive mode: run without arguments and follow the menu (choose language, then console analysis or Telegram bot).
dotnet runDirect CLI analysis: pass an image path as the sole argument to skip the menu entirely.
dotnet run -- "C:\evidence\sample.jpg"or run the compiled binary directly:
./ForensicsDetector /path/to/sample.jpgThe console output reports both probabilities together with the individual triggers that produced them, prints the overall verdict, and saves and opens the HTML report.
Tip. For meaningful metadata analysis always use original files. Images exported by social networks and messengers are stripped of EXIF and re-compressed; the detector accounts for this, but original files always provide stronger evidence.
The built-in bot allows remote forensic analysis from any Telegram client. Requests are processed concurrently: each incoming image gets its own task running the full 16-stage pipeline.
Setup:
- Create a bot with @BotFather and obtain the token.
- Start ForensicsDetector and select mode
2, or enter the token when prompted. The token persists inconfig.json. - Send any image to the bot, preferably as a document/file.
Behavior:
/startreturns usage instructions, including the warning that Telegram strips EXIF from photos sent as images, so files should be sent via the paperclip attachment as File/Document to preserve metadata.- On each image the bot acknowledges receipt, runs the full pipeline, replies with an HTML-formatted summary (both scores, verdict, and the list of triggers), and attaches the complete interactive HTML report as a document.
- Temporary files are deleted after processing; the report is delivered to the chat and is not retained on the host.
config.json is created automatically next to the executable on first run:
{
"Language": "ru",
"TelegramBotToken": "YOUR_TELEGRAM_BOT_TOKEN_HERE"
}| Key | Values | Purpose |
|---|---|---|
Language |
"ru" / "en" |
Interface language for console, bot, and reports |
TelegramBotToken |
string | Bot token issued by @BotFather; persisted after first entry |
-
Windows: the
OpenCvSharp4.runtime.winpackage is referenced by the project, so native OpenCV binaries are restored automatically. Windows is the zero-configuration target. -
Linux / macOS: swap the Windows runtime package for the native runtime of your platform. In
ForensicsDetector.csproj, replace:<PackageReference Include="OpenCvSharp4.runtime.win" Version="4.13.0.20260627" />
with one of the following:
<PackageReference Include="OpenCvSharp4.runtime.linux-x64" Version="4.13.0.20260627" /> <!-- or --> <PackageReference Include="OpenCvSharp4.runtime.osx-arm64" Version="4.13.0.20260627" />
then run
dotnet restore && dotnet build -c Release. Report auto-opening uses the OS default handler and works on all three platforms; when unavailable, the report path is printed to the console.
| Component | Version | Role |
|---|---|---|
| .NET | 9.0 | Runtime and SDK |
| OpenCvSharp4 | 4.13 | Image processing, ORB/BFMatcher copy-move detection, FFT, color-space transforms |
| SixLabors.ImageSharp | 2.1 | JPEG re-encoding (ELA, JPEG Ghosts), pixel-level block analysis, report imaging |
| MetadataExtractor | 2.9 | EXIF / XMP / IPTC metadata parsing, C2PA/JUMBF marker inspection |
| Telegram Bot HTTP API | n/a | Bot transport: long polling via getUpdates over raw HTTP |
ForensicsDetector/
├── ForensicsDetector.sln # Visual Studio solution
├── ForensicsDetector/
│ ├── ForensicsDetector.csproj # Target framework and NuGet dependencies
│ └── Program.cs # Full application: pipeline, modules, CLI, bot, report generator
├── LICENSE # GNU GPL v3
└── README.md
The entire codebase is intentionally contained in a single source file, organized into clearly separated regions: configuration, localization, the sixteen analysis modules, score aggregation, HTML report generation, Telegram transport, and console UX.
Forensic image analysis is probabilistic. Users should be aware of the following constraints, which come with the underlying methods rather than with this particular implementation:
- Re-compression masks evidence. Heavy re-encoding (messengers, social platforms, screenshots) destroys fine-grained compression and sensor-noise cues. The pipeline detects such images and adjusts scoring, but a low-quality re-upload can never be analyzed with the same confidence as the original.
- Single-compression images limit JPEG-based modules. ELA, DQ, and JPEG Ghosts are most informative on first-generation JPEG files.
- Small images reduce statistical power. Modules operating on 16x16 blocks require sufficient block counts; very small images may produce inconclusive local statistics.
- Heuristic AI detection, not a neural classifier. AI/CGI probability is produced by physical-signal aggregation (spectral, CFA, PRNU, SNR, aberration), not by a trained deep-learning model. The scoring is deliberately conservative: strong independent evidence of manual editing suppresses the AI score to avoid conflating collage with synthesis.
- Scores are estimates, not proof. Any individual module can fire on legitimately processed images (for example, camera-internal noise reduction or aggressive social-media transcoding). Only the joint pattern of multiple independent indicators should be treated as meaningful, and final interpretation belongs to a qualified examiner.
This tool is intended for forensic analysis, media verification, research, and educational use. All outputs are probabilistic estimates and must be interpreted by a qualified specialist in combination with other evidence. Results produced by ForensicsDetector do not by themselves constitute proof of tampering or authenticity and must not be used as the sole basis for legal, administrative, or editorial decisions. The authors accept no liability for misuse of the software or for consequences of misinterpretation of its results.
Distributed under the GNU General Public License v3.0. See LICENSE for the full text.
Author: @whoamicrash. Telegram: @hackerebanatik
Issues and pull requests: github.com/whoamicrash/ForensicsDetector/issues