Digital Forensic of JPEG Images

Since JPEG is the de facto image format adopted in most of the digital cameras and image editing software, tampered image will be often a recompressed JPEG image. As JPEG works on 8 by 8 block cosine transform most of the tampering correlation inherited by tampered image may get destroyed, making forgery detection difficult thus it is common practice followed by forger to hide traces of resampling & splicing. JPEG forgery detection techniques try to identify inconsistencies in the artifacts introduced in image due to 8 by 8 block DCT transform. The original image on which forgery is created may be compressed or uncompressed image, similarly area pasted may belong to compressed or uncompressed image. Since both will be having different compression history JPEG forgery detection techniques try to identify the difference in compression history which may be in the form of shifting of DCT block alignment, difference in primary quantization table or ghost detection.