Forensic Analysis
The structured investigation of a piece of media to determine its authenticity, capture-device origin, and edit history, combining algorithmic analysis (deepfake detection, noise-pattern analysis, metadata review) with expert human judgment.
Forensic analysis is what happens when deepfake detection produces a borderline result and someone needs to make a defensible decision. It's a structured process, not a single tool, and it's the standard approach in journalism, law enforcement, and legal proceedings.
What a forensic review covers
A complete forensic pass typically includes:
Automated detection. Run deepfake detection on the file. Record score, model version, and timestamp.
Capture-device analysis. Look for the unique noise fingerprint of a specific camera or microphone. Real photos from the same device share a characteristic sensor pattern; AI-generated or re-recorded images don't.
Metadata review. EXIF tags, C2PA manifests, platform-specific metadata. Absence isn't evidence, but consistency or contradictions are.
Compression analysis. Multiple rounds of JPEG compression leave detectable patterns at block boundaries. A claim of "original from camera" that shows double-compression is suspicious.
Reverse search. When and where does this file first appear? What's the account that posted it?
Expert review. A trained analyst interprets the above, calibrating against known attack types.
Who does this
Law enforcement labs, investigative-journalism outfits (Bellingcat, Der Spiegel, ProPublica), some large-platform trust & safety teams, and specialized consultancies. In litigation, forensic analysts serve as expert witnesses.
Relationship to detection
Deepfake detection is one tool in the forensic toolbox — high-throughput, automated, probabilistic. Forensic analysis is the broader investigative frame: detection + provenance + device attribution + contextual analysis, culminating in a defensible judgment.