Photo forgery usually takes one of three shapes: a splice pasted in from another picture, a copy-move edit that clones one part of the same photo over another, or a region edit that changes only one area. It may look seamless to the eye, but the file often stores that part differently from the rest.
JPEG compresses in 8×8 pixel blocks. When a piece of another photo is pasted in and the result is saved again, the pasted area's block grid can be misaligned or carry a different compression history. Error level analysis (ELA) re-saves the image at the same quality and looks for areas whose difference stands out. If the whole photo has been re-saved many times, that difference fades.
Sensor noise is spread evenly across a real photo. Pasted or covered areas tend to have noise of a different strength or texture, and pieces that were scaled or rotated leave regular patterns in the frequency domain. Origma compares these signals region by region and records areas whose statistics differ from their surroundings as evidence on the tampering axis.
The heatmap on the result screen means 'the signal here differs from its surroundings', not 'this part was forged'. Flat areas such as sky or walls, heavy retouching or filters, and messenger recompression can all light it up. That is why we never conclude from a heatmap alone and read it together with metadata and provenance signatures.
Modern edits that remove an object with AI and fill the gap leave almost no compression or noise traces, and we still catch them poorly. When the evidence is too thin we say 'inconclusive'. Origma's results are probabilistic assessments, not certified forensic reports or legal proof — get expert review for weighty decisions.
This is general guidance, not legal advice. A scan result is a probabilistic assessment, not proof.