ForensicLens v1.5.0 — Multi-Quality Error Level Analysis

ForensicLens v1.5.0

Upgrades the ELA analyzer to scan across multiple JPEG quality levels instead of a single fixed one, reducing false positives from single-quality compression noise.

What's new

• ELA now recompresses at several configurable quality levels (elaQualityLevels in forensiclens.yaml, default [70, 80, 90])
• Per-level error maps are combined using cross-level consistency — a region flagged at multiple quality levels is treated as much stronger evidence than one flagged at only one
• Reports now show how many of the configured quality levels flagged each region (e.g. "3 of 3")
• Backward-compatible config parsing: an old single-value ELA quality setting still works

Notes

Multi-quality scanning is roughly N times slower than the previous single-quality scan, where N is the number of configured quality levels — see the Benchmarks section for updated timing.

See the README for the full config reference.

ForensicLens v1.4.0 — CI, Coverage & Swift Package Index Readiness

ForensicLens v1.4.0

Adds a dedicated CI test workflow, code coverage reporting, and Swift Package Index readiness — plus status badges on the README.

What's new

• New GitHub Actions workflow running swift test on every push and pull request, across a macOS + Linux matrix
• Code coverage measurement on the Linux job, uploaded to Codecov
• .spi.yml added, declaring supported platforms and Swift versions for a clean Swift Package Index build
• Package.swift reviewed for Swift Package Index compatibility
• Build status, coverage, and Swift Package Index badges added to the top of the README

Notes

This is infrastructure and packaging work only — no changes to the analysis pipeline or CLI behavior in this release. Swift Package Index listing itself still requires a manual submission at swiftpackageindex.com/add-a-package.

See the README for the new badges and coverage instructions.

ForensicLens v1.3.0 — Automated Benchmark Reporting

ForensicLens v1.3.0

Adds a CI workflow that keeps the README's benchmark numbers automatically up to date, so documented performance figures never go stale.

What's new

• Benchmark script now emits structured JSON output alongside its existing results
• A dedicated update script regenerates the README's benchmark table from that JSON, replacing only the content between marked boundaries — the rest of the file is untouched
• A GitHub Actions workflow (manual dispatch, or on push to main when source/benchmark files change) builds the project on Linux, runs the benchmark, and updates README.md automatically
• The workflow only commits when the numbers actually changed — no empty commits

Notes

This is CI infrastructure only — no changes to the analysis pipeline or CLI behavior in this release.

See the README Benchmarks section for the auto-generated table.

ForensicLens v1.2.0 — Batch Directory Scanning

ForensicLens v1.2.0

Adds a batch CLI subcommand to scan an entire directory of images at once, instead of running the tool one image at a time.

New CLI command

forensiclens-cli batch [--no-recursive] [--extensions jpg,png] [--max-concurrency N] [--format json|csv] [--output ]

Features

• Concurrent analysis — images are processed in parallel via Swift Concurrency, bounded by --max-concurrency (defaults to available CPU cores)
• Per-file fault isolation — a corrupt or unreadable file is logged and skipped without aborting the rest of the batch
• Live progress — a running "X/Y processed" indicator prints to stderr during the scan
• Sorted summary report — results ordered by suspicion score descending, with each entry's top contributing anomalies
• Flexible output — human-readable console table by default, or --format json / --format csv written to a file with --output
• Filtering — --extensions to control which file types are scanned, --no-recursive to limit the scan to the top-level directory only

Notes

Batch mode reuses the existing single-image analysis pipeline (Analyzer protocol + SuspicionScorer) — no separate analysis logic, so results are identical to running the tool on each file individually.

See the README for full CLI usage examples.

ForensicLens v1.1.0 — Cross-Field Metadata Checks

ForensicLens v1.1.0

Extends the metadata analyzer with cross-field consistency checks — comparing related EXIF fields against each other instead of flagging anomalies field-by-field, since inconsistencies between fields are a stronger tampering signal than any single field alone.

New checks

• GPS timestamp vs. DateTimeOriginal — flags a mismatch beyond a configurable tolerance
• DateTimeOriginal / DateTimeDigitized / ModifyDate ordering — flags a ModifyDate earlier than DateTimeOriginal, or a significant gap between DateTimeOriginal and DateTimeDigitized
• Partial metadata stripping — flags GPS data present without camera Make/Model (or vice versa)
• GPS altitude consistency — flags a negative altitude without a matching "below sea level" reference
• Editing-software conflict — flags known editing-software signatures co-occurring with an otherwise "untouched" camera-original metadata set

Configuration

All new thresholds are configurable via forensiclens.yaml — no hardcoded values.

Notes

Each rule produces its own named anomaly with a human-readable explanation, so the suspicion score and report can attribute findings to the specific rule that fired.

See the README for the full configuration reference.

ForensicLens v1.0.0 — Initial Release

ForensicLens v1.0.0

First public release of ForensicLens — a cross-platform Swift image forensics library and CLI tool for detecting digital manipulation in still images.

Features

• Error Level Analysis (ELA) — flags regions with abnormally high recompression error, a common indicator of localized editing
• EXIF/metadata analysis — detects editing-software signatures, timestamp inconsistencies, and missing/suspicious metadata fields
• Copy-move (clone) detection — finds duplicated/copy-pasted regions within an image via block-based comparison
• Suspicion scorer — combines all analyzer outputs into a single 0–100 score with a human-readable, itemized report
• Pluggable Analyzer protocol — each detector is independently toggleable via config
• CLI tool — run individual analyzers or the full report against any image, with plain-text or JSON output

Platform support

Builds and runs on both macOS and Linux via Swift Package Manager (swift build / swift test) — no Apple-only frameworks (CoreML, Vision, UIKit, AppKit).

Testing

Full test suite runs offline against synthetic in-memory images — no real photos or special privileges required.

Installation

See the README for installation, CLI usage examples, and configuration reference.