Compression History Estimation in Video Streams

Every H.264 and H.265 encoder organises a video into groups of pictures, each starting with an I-frame that is coded entirely from its own spatial content without reference to other frames. The I-frame interval, commonly 1 or 2 seconds at typical frame rates, is a parameter set by the encoder. In a single-generation recording, I-frames appear at the configured interval and nowhere else, and the proportion of intra-coded macroblocks in P-frames and B-frames is low, typically driven only by scene changes or fast motion.

When that video is re-encoded, the second encoder processes content that has already been through one lossy cycle. At frame positions that coincide with the first generation's I-frames, the spatial content changed more abruptly than the inter-frame prediction can account for, because the first encoder refreshed all blocks at those positions. The second encoder finds that intra-coding is more efficient at those positions than inter-prediction from a reference frame that was itself a P or B frame. The result is an elevated count of intra-coded macroblocks at frame indices that are multiples of the first generation's I-frame period. This signal, called the intra-refresh artefact, can be extracted without access to the original recording by parsing the macroblock mode data from the bitstream.

The detection method works by computing, for each frame, the fraction of macroblocks coded in intra mode. The resulting series is then analysed for periodicity using a Fourier transform or autocorrelation. A periodic spike in the intra-MB fraction at interval T indicates that a prior generation used a GOP length of T frames. The signal is clearest when the first-generation QP was high (strong compression) and degrades when re-encoding is at very high quality, because the second encoder has more bit budget to absorb the residuals without reverting to intra-coding.

The quantisation parameter controls the step size applied to DCT coefficients before entropy coding. Large QP values produce small files with visible blocking and ringing artefacts; small QP values produce large files with high perceptual quality. In a single encoding from raw content, the DCT coefficients before quantisation come from the raw pixel differences. After quantisation and dequantisation, the reconstructed coefficients fall at multiples of the quantisation step. The distribution of non-zero coefficients forms a characteristic comb-like histogram with peaks at those multiples.

When the video is re-encoded, the second encoder's DCT operates on content that is already quantised. The input coefficients are concentrated at multiples of the first-generation step size. After the second quantisation, the resulting histogram retains traces of the first step size as secondary peaks or systematic gaps in the distribution. These are the same artefacts exploited in double-JPEG detection, adapted to the video context where both the spatial and temporal prediction residuals carry the signal.

A practical complication is that most modern encoders use rate control to vary QP across frames and across macroblocks within a frame. This means the QP trace from a single-generation video already shows variation, and the examiner must distinguish the legitimate variation from the distortions introduced by re-encoding. Methods based on the QP trace typically model the expected variance for a given encoder and bit-rate target and then test whether the observed trace is consistent with that model. The double-compression signature is the residual variance that cannot be explained by the expected rate-control behaviour.

Statistical analysis of individual features such as the intra-MB fraction or the DCT histogram can detect double compression but struggles when re-encoding quality is high or when the first and second generation QPs are close together. Machine-learning approaches treat encoding history estimation as a classification or regression task, combining many features to improve discrimination.

The most common feature sets draw from three levels of the bitstream. At the frame level, features include the temporal distribution of intra-MB fractions, the frame-level QP sequence, and the ratio of I-frame to non-I-frame size. At the macroblock level, features include the partition mode histogram (the distribution of 4x4, 4x8, 8x4, 8x8, 8x16, 16x8, and 16x16 prediction partitions) and the distribution of motion vector magnitudes. At the DCT level, features include the coefficient histogram shape, the proportion of zero coefficients by frequency band, and the BDCT (block DCT) artefact measure.

Random forest classifiers trained on these features can distinguish single-generation from double-generation H.264 video with accuracy above 90% on benchmark datasets when the first-generation QP is 28 or higher. Accuracy falls when the first-generation QP is 18 or below, because the high-quality first encode discards little information and the second encoder sees content close to raw. Convolutional neural networks applied to the residual frames in the DCT domain can capture spatial patterns that the hand-crafted feature sets miss and achieve similar or better accuracy without manual feature engineering. H.265 regressors require separate training because the CTU structure and the larger partition space produce different feature distributions from H.264 macroblocks.

H.264 (AVC) and H.265 (HEVC) share the same fundamental architecture: transform coding with DCT, quantisation, and entropy coding, combined with motion-compensated inter-prediction. The differences that matter for compression history estimation are the coding unit structure, the increased partition flexibility in H.265, and the differences in the default encoder settings used in practice.

In H.264, the basic coding unit is the 16x16 macroblock. Macroblocks can be split into smaller prediction units down to 4x4 pixels. The intra-refresh artefact in H.264 manifests at the macroblock level and can be measured by counting intra-coded 16x16 blocks per frame. In H.265, the basic unit is the coding tree unit (CTU), which can be up to 64x64 pixels and is recursively split into coding units, prediction units, and transform units. The greater flexibility means the second encoder can adapt its coding structure more finely to the re-encoded content, which slightly reduces the intra-refresh artefact at any given level of analysis. Methods for H.265 typically operate at the CTU or coding unit level rather than a fixed macroblock size.

The QP range also differs: H.264 uses QP values 0 to 51, while H.265 uses 0 to 51 for luma and applies separate scaling factors for chroma. The DCT coefficient analysis must account for the chroma QP offset when analysing H.265 content. In both codecs, encoding parameters such as the reference frame count and the sub-pixel motion estimation precision affect how strongly inter-prediction suppresses the intra-refresh artefact. High reference-frame counts in H.264 allow the second encoder to find good reference matches across longer temporal distances, partially masking the refresh boundary.

A compression history examination begins with acquiring a verified copy of the evidence file and confirming its hash value before and after any analysis step. The file is then characterised: container format, codec, resolution, frame rate, bit rate, and encoder tag. The encoder tag recorded in the container metadata may identify the software that produced the final generation. When this tag matches the claimed recording device, it is a consistency check, not a confirmation, because the tag is trivial to alter or remove.

Bitstream-level analysis requires a tool capable of reading the raw encoded data without decoding to pixel values. FFprobe (part of FFmpeg) can output per-frame and per-packet statistics including frame type (I, P, B), frame size, and QP values for H.264 content. Full macroblock-level analysis requires a specialised parser; open-source options include the H.264 bitstream analyser in the JM reference implementation and custom scripts built on the openh264 or libavcodec APIs. For H.265, the HM reference decoder can output CTU-level coding decision data.

After extracting the per-frame and per-macroblock features, the examiner applies the statistical or ML-based detection method. Any detected periodicity in the intra-MB fraction is compared against the claimed recording frame rate and GOP settings. QP histogram analysis is performed on a representative sample of frames, avoiding the first few frames of each scene cut where the encoder behaviour is atypical. The findings are documented as a written report with the tool names, version numbers, input hash, output data tables, and the statistical basis for any conclusion.

A key link to the broader authentication workflow is that compression history findings should be integrated with other analysis streams: metadata and container integrity checks, noise consistency analysis, and frame deletion or insertion detection. No single method is definitive on its own. Compression history estimation is one element of a multi-method assessment.

Compression history evidence has been presented in criminal and civil proceedings in multiple jurisdictions. The analysis is based on published peer-reviewed methods, which satisfies the scientific literature criterion under US Federal Rule of Evidence 702 (as interpreted after Daubert v. Merrell Dow Pharmaceuticals, 1993). UK courts apply the Criminal Practice Directions and consider the Law Commission 2011 guidance on the admissibility of expert evidence, which requires the method to be sufficiently established to pass scrutiny by an independent expert. EU member states vary in their civil-law treatment of expert evidence, but most require the expert to demonstrate formal qualifications and a documented methodology.

In India, expert evidence in digital matters is assessed under the Bharatiya Sakshya Adhiniyam 2023 (BSA), which replaced the Indian Evidence Act 1872. Section 79A of the earlier act (and its successor provisions in the BSA) defines an examiner of electronic evidence and sets the basis for certifying digital forensic findings. The Supreme Court of India has addressed the reliability of digital evidence in several cases including Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020), which emphasised that electronic evidence must be accompanied by a certificate under the relevant section. Compression history analysis should be accompanied by a certificate that identifies the tools, methods, and validation basis.

Across all jurisdictions, the expert report should state clearly what the analysis can and cannot conclude. Compression history estimation can establish that a video has been re-encoded, that the prior encoding had a specific QP range or GOP period, and that the encoding history is inconsistent with the claimed recording provenance. It cannot determine the content of any prior generation, reconstruct deleted frames, or establish the identity of who performed the re-encoding. Overstating conclusions is the most common ground for challenge in cross-examination.