Sherloq: Check a Photo for Edits and Hidden Metadata (GitHub, Scanned)

Sherloq opens a photo and gives you about 35 ways to question it, each in its own window beside the original. Metadata tools dump the full EXIF record with ExifTool, map the GPS position and compare the embedded thumbnail with the image. JPEG tools estimate the last save quality, run error level analysis and draw JPEG ghost maps. Noise, luminance, wavelet and color tools show inconsistencies a splice leaves behind, and dedicated detectors look for copy-move cloning, composite splicing, resampling, median filtering and contrast changes. A reverse search panel opens TinEye, Google and Bing image search in place.

It is a personal research project by Guido Bartoli, started in C++ in 2015 and ported to Python with PySide6, OpenCV and TensorFlow in 2020, with each method credited to its academic paper in the README. The author is clear that it is an educational companion for trying algorithms, not a tool that declares an image real or fake, and that bugs and unfinished features are expected. It has about 3,240 stars and 14 contributors; there are no releases, but contributors are still adding tools, such as PRNU camera fingerprinting in mid-2026, and the last push was on 16 July 2026.

It is GPL-3.0 licensed and runs offline on Linux, macOS and Windows. Optional AI tools, including the TruFor manipulation detector from the University of Naples, need extra packages and model weights you download yourself.

• Repository: github.com/GuidoBartoli/sherloq
• Licence: GPL-3.0 (GNU General Public License v3.0)
• Language: Perl. Stars: 3,237. Forks: 315. Last push: Jul 16, 2026.
• Scan: safe, Oct 28, 2026, commit 3fe95fc

Who it is for

Journalists and fact-checkers verifying a picture before publishing it, OSINT researchers, students learning digital image forensics, and anyone curious how edits leave traces in pixels and metadata.

Getting started

1. Clone the repository

git clone https://github.com/GuidoBartoli/sherloq.git && cd sherloq

2. Create a Python 3.11 environment with uv

uv venv --python 3.11

3. Install the dependencies

uv pip install -r gui/requirements.txt

4. Activate it and launch the app (Windows: .venv\Scripts\Activate.ps1)

source .venv/bin/activate && python -m gui.sherloq_app

The install is large, since it pulls TensorFlow, OpenCV and Qt. On Linux, if Qt complains about the xcb platform plugin, install libxcb-cursor-dev. The optional AI tools add PyTorch through gui/requirements_ai_solutions.txt; install it only if you plan to use them.

Safety scan

We cloned GuidoBartoli/sherloq at commit 3fe95fc on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no pattern hits and no install hooks. The 250,000 lines of HTML and the Perl the scanner reports are ExifTool's bundled documentation and source, not Sherloq's own code, which is about 11,000 lines of Python.
• The committed binaries are third-party tools: exiftool(-k).exe is the standard Windows build of ExifTool (last replaced in June 2024, at 12.76, while the Perl copy in the linux folder was updated to 13.55 in May 2026), and gui/butteraugli/linux/butteraugli is Google's perceptual image comparison tool. The tiny EXE, ELF, Mach-O and LNK files are sample files from ExifTool's own test suite. Sherloq does not build these from source, so you are trusting the copies in the repository.
• There are no lockfiles to check: gui/requirements.txt sets version ranges such as tensorflow 2.16.* and pillow 12.2.*, so pip picks the newest matching release at install time. That avoids stale pins but means two installs can differ.
• Analysis runs locally. The Geolocation tool loads Google Maps at the photo's GPS coordinates, and Similar Search opens TinEye, Google, Bing and two smaller sites in an embedded browser where you upload the image yourself. Skip both for images that must stay private.
• No CI workflows at all, so nothing tests changes automatically. Licence present; no security policy, contributing guide, Dependabot or CodeQL, which fits a one-person research project.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: HTML 250.3K, Python 10.8K, C++ 2,838, C/C++ header 622, Markdown 282, JSON 75.

Questions

Is Sherloq free?

Yes. Sherloq is GPL-3.0 licensed and free for any use. If you distribute a modified version, the GPL asks you to share the source. The bundled ExifTool is free software too; the optional TruFor weights come from their own research project, so check that project's licence before using them commercially.

Can Sherloq prove a photo is fake?

No, and its author says no tool can. Each method shows a signal, such as an odd compression level, a noise mismatch or a cloned patch, that a trained eye then interprets. Use several tools, compare against a known original where you can, and treat the results as leads for verification, not courtroom proof.

Is it legal to analyse other people's photos with Sherloq?

Checking whether a published image was edited is standard verification work for journalists and researchers. Be careful with what the metadata reveals: GPS coordinates or camera serial numbers in a private person's photo can expose where they live, so do not publish or use that information to locate or track anyone.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.