Is This Photo Real Skill 安全审计

67Before anything: check whether a tool **publishes** your submission. Some forensic8services maintain public galleries of uploads. For anything sensitive, prefer local9tools.10

8889### FotoForensics9091Hosted suite built around ELA, plus JPEG quality estimation, last-save quality,92metadata, embedded thumbnail extraction, and hidden-pixel and string checks. The93non-ELA parts are the useful parts.9495**Failure mode:** ELA is the headline feature and the most misread analysis in the96field — see the parent skill. The service also retains and may display submissions;97do not upload sensitive material.98

251252Publishing an accusation of fabrication against a named person carries defamation253risk in most jurisdictions, and "our tool said so" is not a defence. Uploading254material to online forensic services discloses it to those services and, for some, to255public galleries — check whether a tool publishes submissions before submitting256anything sensitive. If the media depicts a crime, a victim, or intimate content:257minimise copies, do not redistribute, and in the case of child sexual abuse material258stop immediately and report to the appropriate authority rather than analysing it. See259[../../ETHICS.md](../../ETHICS.md).

238239| What you got | Send to |240|---|---|241| Earlier copies, credits, original caption | `find-the-original-image` |242| Editing chain, device, timestamps | `secrets-in-file-metadata` |243| Location and date verification | `geolocate-from-pixels`, `where-was-this-taken` |244| Deleted or altered source pages | `read-deleted-pages` |245| Publishing or seeding domain | `who-owns-this-domain`, `recon-a-domain-passively` |246| Accounts amplifying the media | `hunt-a-handle`, `pattern-of-life-from-socials` |247| Coordinated network behind the spread | `graph-the-network`, `find-leaks-in-the-wild` |248| Named individuals in or credited on the media | `find-anyone` |249

46   downstream conclusion.472. **Provenance.** Run `find-the-original-image`; for video, extract and search48   keyframes. You want an earlier appearance, a different caption, a photographer49   credit, and an on-page date corroborated through `read-deleted-pages`. An earlier copy50   with a different caption ends the case.513. **Metadata.** Run `secrets-in-file-metadata`: editing chain, thumbnail-versus-image

29- [ ] Sort for the **oldest** copy where the engine allows.30- [ ] Open every match page. Harvest: caption, date, photographer credit, agency, named31      people, image filename.32- [ ] Corroborate the earliest page's date against an independent archive capture.33- [ ] Search the caption text and any distinctive on-image text as a string, in the34      original language.35

2122### Web archives2324Archived captures date a page independently of what the page claims about itself. See25`read-deleted-pages`.2627**Failure mode:** no capture means no evidence either way; robots-directive28retroactivity and takedowns can remove captures that existed.29

181  `investigate-without-getting-made`.182- **Identification from resemblance** is the highest-consequence error here — "this is183  person Z because they look alike" is not a finding.184

192  details consistent, nothing contradicted in metadata or geometry.193- **Confirmed recontextualised** — the same image demonstrably published earlier with194  a different, better-sourced caption. The most common positive finding here.195- **Probably manipulated** — a specific, describable physical or geometric196  inconsistency you can point at, ideally with a source for the inserted element.197  Not a heatmap.198- **Probably synthetic** — multiple durable generative tells, no provenance history,199  no camera-consistent compression or metadata, no earlier copies. Name the tells.200- **Unconfirmed** — no earlier copy found, nothing wrong found. Where most cases end.201- **Cannot be assessed** — the available copy is too processed for the tests the question

251252Publishing an accusation of fabrication against a named person carries defamation253risk in most jurisdictions, and "our tool said so" is not a defence. Uploading254material to online forensic services discloses it to those services and, for some, to

6  detection, lighting and shadow consistency, C2PA Content Credentials, deepfake and7  AI-generation tells, and the honest limits of AI-detector tools. Use when fact-checking a8  photo or video, checking for a deepfake or AI-generated image, spotting manipulation, or9  testing whether footage is recycled or miscaptioned. Applies to KYC and onboarding fraud,10  insurance claim review, disinformation analysis, and evidence admissibility. Reference at11  useosint.com/skills/is-this-photo-real.

194  a different, better-sourced caption. The most common positive finding here.195- **Probably manipulated** — a specific, describable physical or geometric196  inconsistency you can point at, ideally with a source for the inserted element.197  Not a heatmap.198- **Probably synthetic** — multiple durable generative tells, no provenance history,199  no camera-consistent compression or metadata, no earlier copies. Name the tells.200- **Unconfirmed** — no earlier copy found, nothing wrong found. Where most cases end.201- **Cannot be assessed** — the available copy is too processed for the tests the question202  needs. Say which tests were invalid and why.203

227228**Reporting standard.** State what you verified, what you could not, and what each229conclusion rests on — never a bare "fake" or "real". A defensible line reads: *the230image was published at least three years before the claimed event, on a news site,231credited to a named photographer; the location matches that credit and not the claim; no232manipulation was detected, but the only available copy was a platform re-encode, so233signal-level tests were not meaningful.* "Our analysis shows this is fake" is not.234Include the tests you ran and their negative results, the file's processing history, and