Understanding is considered a key purpose of image forensic science in order to find out if a digital image is authenticated or not. It can be a sensitive task in case images are used as necessary proof as an impact judgment. it's known that There are several different manipulating attacks but, this copy move is considered as one of the most common and immediate one, in which a region is copied twice in order to give different information about the same scene, which can be considered as an issue of information integrity. The detection of this kind of manipulating has been recently handled using methods based on SIFT. SIFT characteristics are represented in the detection of image features and determining matched points. A clustering is a key step which always following SIFT matching in-order to classify similar matched points to clusters. The ability of the image forensic tool is represented in the assessment of the conversion that is applied between the two duplicated images of one region and located them correctly. Detecting copy-move forgery is not a new approach but using a new clustering approach which has been purposed by using the 2-level clustering strategy based on spatial and transformation domains and any previous information about the investigated image or the number of clusters need to be created is not necessary. Results from different data have been set, proving that the proposed method is able to individuate the altered areas, with high reliability and dealing with multiple cloning.