Jay found a couple of haloes with just a quick look in pictures that haven't been tampered with.
Before the Air India crash occupied my attention, I was able to run some DCT resolution comparisons using one of our more powerful computers. The monochrome snowy pond image got a mild hit for possible use of a smoothing or healing tool. And the non-mill seaside scene got a mild hit for possible use of a clone tool.
DCT stands for discrete cosine transform, and is one of the mathematical tools used in JPEG image compression. It turns out that compressibility is a good proxy for overall resolution. You treat the image as a set of 8x8 patches and investigate the DCT compressibility of each. Then you shift by one pixel and do it again, hence the supercomputer. The fidelity of a compressed patch to its source in a local region is normally distributed, so when you find an outlier patch, it's something that has either more or less resolution than the rest of the image. That is often an indication of whether certain kinds of common image manipulation tools like smoothing, dodging, burning, or healing have occurred.
The monochrome snowy lake has a slightly suspicious (z = 1.72) smooth patch.
Similarly the vector of DCT coefficients for an image is a sort of proxy for its contents, If you take every possible 8x8 patch and compare it to every other possible 8x8 patch (again, cough, supercomputer) you can often identify cloned image elements. Each set of DCT coefficients is a 64-element vector (i.e., a vector in 64-dimensional space). You can use normal vector arithmetic (i.e., dot product) to reckon vectors that lie in similar directions and therefore image elements that compress to the same DCT representation.
The seaside image has a slightly suspicious duplicate signpost (normalized dot product = 0.640).
This analysis directs the analyst to portions of the image to examine using other tools or with a well-trained Mark 1 eyeball.