Skip to content

JPEG Ghost Analysis

Definition

A technique (Farid, 2009) that identifies double-compressed patches by resaving a composite JPEG at multiple quality levels and identifying the quality at which the difference between the composite and the resaved version is minimised for a localised region.

Author
Hany Farid
Published
2009
Method
Multi-quality resave comparison
Detects
Localised double-compressed or spliced regions

Common questions

What does a 'ghost' look like in the analysis output?+

A region where the difference between the original and a resaved version is minimised at a JPEG quality level distinct from the rest of the image, appearing as a differently shaded patch across the sequence of resaves.

What is a key limitation of the technique?+

It works best when the pasted region was originally saved at a lower JPEG quality than the final composite, and becomes less reliable when the qualities are close together or the image has been resized.

Related terms

ByteRange
A four-integer entry in a PDF digital signature dictionary specifying which byte ranges of the file were hashed when the signature was...
Content-Aware Fill
An image editing feature (Photoshop from CS5; AI-driven from version 22.0) that replaces a masked region with synthesised pixel content matching the...
Copy-Move Detection
A class of image forensics algorithms that search for duplicated regions within a single image, indicating a patch-and-conceal manipulation. Implemented via block...
Cross-Reference Table (Xref)
The index structure at the end of a PDF file that maps each object number to its byte offset. Multiple xref sections...
Error Level Analysis (ELA)
A technique that re-compresses a JPEG at a controlled quality setting and maps the pixel-level difference between the re-compressed and original images....
EXIF (Exchangeable Image File Format)
A metadata standard embedded in JPEG and TIFF files by capture devices. EXIF fields record camera make and model, lens data, exposure...
Incremental Update
The PDF mechanism by which an editing application appends new or modified objects to the end of an existing file without overwriting...
PRNU Fingerprint
Photo Response Non-Uniformity: the unique pattern of pixel-level sensitivity variations in a camera sensor, which acts as a device fingerprint. Used to...
XMP Metadata
Extensible Metadata Platform (ISO 16684), an XML-based metadata stream embedded in many PDF and image files alongside the information dictionary. Discrepancies between...

Explained in

Your journey to becoming a forensic professional starts here.

Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.