International Journal of Engineering and Manufacturing (IJEM)
IJEM Vol. 15, No. 3, 8 Jun. 2025
Cover page and Table of Contents: PDF (size: 741KB)
Forensic Software Tool for Detecting JPEG Double Compression Using an Adaptive Quantization Table Database
PDF (741KB), PP.32-42
Views: 0 Downloads: 0
Author(s)
Iyad Ramlawy
1
Yaman Salem
1,*
Layth Abuarram
1
Muath Sabha
2
Index Terms
Digital Image Forgeries, JPEG, Double Compression, Quantization Table (QT), Database, Forensic Software Tool
Abstract
Most digital forensic investigations involve images presented as evidence. One of the common problems of these investigations is to prove the image's originality or, as a matter of fact, its manipulation. One of the guaranteed approaches to prove image forgery is JPEG double compressions. Double compression happens if a JPEG image is manipulated and saved again. Thus, the binaries of the image will be changed based on a “previous” quantization table. This paper presents a practical approach to detecting manipulated images using double JPEG compression analysis, implemented in a newly developed software tool. The method relies on an adaptive database of quantization tables, which stores all possible tables and generates new ones based on varying quality factors of recognized tables. The detection process is conducted through image metadata extraction, allowing analysis without the need for the original non-manipulated image. The tool analyzes the suspected image using chrominance, and luminance quantization tables utilizing the jpegio Python library. The tool recognizes camera sources as well as the programs used for manipulating images with the related compression rate. The tool has demonstrated effectiveness in identifying image manipulation, providing a useful tool for digital forensic investigations. The tool identified 96% of modified images whereas the other 4% identified as false positives. The tool fixes the false positives by extracting the software information from the image metadata. With a rich sources database, forensic examiners can use the proposed tool to detect manipulated evidence images using the evidence image only.
Cite This Paper
Iyad Ramlawy, Yaman Salem, Layth Abuarram, Muath Sabha, "Forensic Software Tool for Detecting JPEG Double Compression Using an Adaptive Quantization Table Database", International Journal of Engineering and Manufacturing (IJEM), Vol.15, No.3, pp. 32-42, 2025. DOI:10.5815/ijem.2025.03.03
Reference
[1]Y. Salem and M. M. N. Hamarsheh, “Forensically analyzing IoT smart camera using MAoIDFF-IoT framework,” Forensic Science International: Digital Investigation, vol. 51, no. September, p. 301829, 2024, doi: 10.1016/j.fsidi.2024.301829.
[2]Y. Salem, M. Owda, and A. Y. Owda, “Towards Digital Forensics 4 . 0 : A Multilevel Digital Forensics Framework for Internet of Things ( IoT ) Devices,” International Journal of Wireless and Microwave Technologies (IJWMT), vol. 14, no. 2, pp. 27–54, 2024, doi: 10.5815/ijwmt.2024.02.03.
[3]A. Piva, “An Overview on Image Forensics,” ISRN Signal Processing, vol. 2013, pp. 1–22, 2013, doi: 10.1155/2013/496701.
[4]K. B. Meena and V. Tyagi, Data, Engineering and Applications, no. April. 2019.
[5]A. H. Saber, M. A. Khan, and B. G. Mejbel, “A survey on image forgery detection using different forensic approaches,” Advances in Science, Technology and Engineering Systems, vol. 5, no. 3, pp. 361–370, 2020, doi: 10.25046/aj050347.
[6]GitHub, “JPEG Image Double Compression Detection using QT Code.” [Online]. Available: https://github.com/iyadRamlawynew/JPEG "(accessed Jan. 28, 2025)".
[7]Y. Salem, M. Owda, and A. Y. Owda, “A Comprehensive Review of Digital Forensics Frameworks for Internet of Things (IoT) Devices,” in 2023 International Conference on Information Technology: Cybersecurity Challenges for Sustainable Cities, ICIT IEEE 2023 - Proceeding, 2023, pp. 89–96, doi: 10.1109/ICIT58056.2023.10226145.
[8]Y. Yusoff, R. Ismail, and Z. Hassan, “Common Phases of Computer Forensics Investigation Models,” International Journal of Computer Science and Information Technology, vol. 49, no. 3, pp. 17–31, 2011, doi: 10.5121/ijcsit.2011.3302.
[9]Y. Salem, M. Moreb, and K. S. Rabayah, “Evaluation of Information Security Awareness among Palestinian Learners,” in 2021 International Conference on Information Technology (ICIT), 2021, pp. 21–26, doi: 10.1109/icit52682.2021.9491639.
[10]Y. Salem and E. Y. Daraghmi, “GDPR-BLOCKCHAIN COMPLIANCE for PERSONAL DATA: REVIEW PAPER,” Journal of Theoretical and Applied Information Technology, vol. 99, no. 24, pp. 5867–5877, 2021.
[11]Y. Salem, M. Owda, and A. Owda, “An Experimental Approach for Locating WhatsApp Digital Forensics Artifacts on Windows 10 and the Cloud,” International Journal of Electronic Security and Digital Forensics, vol. 15, no. 1, pp. 281–300, 2023, doi: 10.1504/ijesdf.2023.10051774.
[12]D. Bem, F. Feld, E. Huebner, and O. Bem, “Computer Forensics - Past , Present and Future,” Journal of Information Science and Technology, vol. 5, no. 3, 2008.
[13]L. Wang, R. Zhang, and S. Zhang, “A model of computer live forensics based on physical memory analysis,” 2009 1st International Conference on Information Science and Engineering, ICISE 2009. pp. 4647–4649, 2009, doi: 10.1109/ICISE.2009.69.
[14]S. M. Rahman et al., Multimedia Technologies: Concepts, Methodologies, Tools, and Applications. .
[15]R. Böhme, F. C. Freiling, T. Gloe, and M. Kirchner, “Multimedia forensics is not computer forensics,” Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 5718 LNCS, pp. 90–103, 2009, doi: 10.1007/978-3-642-03521-0_9.
[16]V. L. L. Thing, Y. Chen, and C. Cheh, “An improved double compression detection method for JPEG image forensics,” Proceedings - 2012 IEEE International Symposium on Multimedia, ISM 2012, pp. 290–297, 2012, doi: 10.1109/ISM.2012.61.
[17]C. Chen, Y. Q. Shi, and W. Su, “A machine learning based scheme for double JPEG compression detection,” Proceedings - International Conference on Pattern Recognition, pp. 6–9, 2008, doi: 10.1109/icpr.2008.4761645.
[18]M. Rehman, M. Sharif, and M. Raza, “Image compression: A survey,” Research Journal of Applied Sciences, Engineering and Technology, vol. 7, no. 4, pp. 656–672, 2014, doi: 10.19026/rjaset.7.303.
[19]S. W. Son, Z. Chen, W. Hendrix, A. Agrawal, W. K. Liao, and A. Choudhary, “Data compression for the exascale computing era - survey,” Supercomputing Frontiers and Innovations, vol. 1, no. 2, pp. 76–88, 2014, doi: 10.14529/jsfi140205.
[20]N. I. Cho and S. K. Mitra, “Warped discrete cosine transform and its application in image compression,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 10, no. 8, pp. 1364–1373, 2000, doi: 10.1109/76.889021.
[21]F. Huang, X. Qu, H. J. Kim, and J. Huang, “Reversible Data Hiding in JPEG Images,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 26, no. 9, pp. 1610–1621, 2016, doi: 10.1109/TCSVT.2015.2473235.
[22]Z. Lin, J. He, X. Tang, and C. K. Tang, “Fast, automatic and fine-grained tampered JPEG image detection via DCT coefficient analysis,” Pattern Recognition, vol. 42, no. 11, pp. 2492–2501, 2009, doi: 10.1016/j.patcog.2009.03.019.
[23]J. D. Kornblum, “Using JPEG quantization tables to identify imagery processed by software,” Digital Investigation, vol. 5, no. SUPPL., pp. 21–25, 2008, doi: 10.1016/j.diin.2008.05.004.
[24]Y. Niu, B. Tondi, Y. Zhao, R. Ni, and M. Barni, “Image Splicing Detection, Localization and Attribution via JPEG Primary Quantization Matrix Estimation and Clustering,” pp. 1–14, 2021, [Online]. Available: http://arxiv.org/abs/2102.01439.
[25]F. Galvan, G. Puglisi, A. R. Bruna, and S. Battiato, “First quantization matrix estimation from double compressed JPEG images,” IEEE Transactions on Information Forensics and Security, vol. 9, no. 8, pp. 1299–1310, 2014, doi: 10.1109/TIFS.2014.2330312.
[26]S. Battiato, O. Giudice, F. Guarnera, and G. Puglisi, “Computational data analysis for first quantization estimation on JpEG double compressed images,” Proceedings - International Conference on Pattern Recognition, pp. 5951–5958, 2020, doi: 10.1109/ICPR48806.2021.9412528.
[27]S. Battiato, O. Giudice, F. Guarnera, and G. Puglisi, “Estimating Previous Quantization Factors on Multiple JPEG Compressed Images,” Eurasip Journal on Information Security, vol. 2021, no. 1, 2021, doi: 10.1186/s13635-021-00120-7.
[28]I. International, W. On, M. Learning, and F. O. R. Signal, “DOUBLE JPEG COMPRESSION DETECTION FOR DISTINGUISHABLE BLOCKS IN IMAGES COMPRESSED WITH SAME QUANTIZATION MATRIX Abhinav Narayan Harish Vinay Verma Nitin Khanna Multimedia Analysis and Security ( MANAS ) Lab , Electrical Engineering , Indian Institute of T,” pp. 0–5, 2020.
[29]M.-J. Kwon, I.-J. Yu, S.-H. Nam, and H.-K. Lee, “CAT-Net: Compression Artifact Tracing Network for Detection and Localization of Image Splicing,” no. Figure 2, pp. 375–384, 2021, doi: 10.1109/wacv48630.2021.00042.
[30]Y. Rao, J. Ni, and H. Zhao, “Deep Learning Local Descriptor for Image Splicing Detection and Localization,” IEEE Access, vol. 8, pp. 25611–25625, 2020, doi: 10.1109/ACCESS.2020.2970735.
[31]H. Yao, H. Wei, T. Qiao, and C. Qin, “JPEG quantization step estimation with coefficient histogram and spectrum analyses,” Journal of Visual Communication and Image Representation, vol. 69, p. 102795, 2020, doi: 10.1016/j.jvcir.2020.102795.
[32]C. Kumawat and V. Pankajakshan, “A robust JPEG compression detector for image forensics,” Signal Processing: Image Communication, vol. 89, no. September, p. 116008, 2020, doi: 10.1016/j.image.2020.116008.