DCT Block Boundaries and Quantisation Grid Analysis

JPEG compression begins by dividing the image into a tiling of 8x8 pixel blocks. Each block is transformed to the frequency domain using the DCT, producing 64 coefficients. These coefficients are then divided by the corresponding entries in the quantisation table and rounded to the nearest integer. The rounding step is where information is discarded, and it is also where the forensic signature is created.

When the image is decoded, the quantised coefficients are multiplied back by the quantisation table values and inverse-transformed. The reconstructed pixel values differ from the originals by a rounding error bounded by half the quantisation step. At block boundaries, adjacent blocks were quantised independently, so the boundary between two reconstructed blocks is typically not smooth: there is a small but measurable discontinuity. This discontinuity, the blocking artifact, has a fixed spatial period of 8 pixels and a phase determined by where the grid origin was placed during encoding.

The quantisation table is stored in the JPEG file header in the DHT and DQT marker segments. A forensic analyst can read it directly using any JPEG parser. Matching the quantisation table to known profiles for specific cameras, software applications, or social media platforms is a fast first step that narrows the provenance question before any pixel-level analysis begins.

When a manipulator cuts a region from one JPEG image and pastes it into another, the pasted region brings its own block grid phase. Unless the manipulator takes deliberate steps to realign the grid (which requires working in a lossless format and re-saving with an identical origin), the pasted region and the host image will have blocking artifacts at different horizontal and vertical offsets. The phase difference is one of the most reliable indicators of a composite image.

The detection procedure works by computing a local measure of blocking artifact strength across the image at each of the 64 possible phase offsets (8 horizontal times 8 vertical). For each small analysis window, the dominant phase is estimated by comparing the variance at block boundaries versus mid-block positions for each candidate phase. A consistent dominant phase across a region means that region was encoded with that phase. A sudden change in the dominant phase map indicates a boundary between regions from different sources.

The localisation resolution of the phase estimator depends on the size of the analysis window. A small window gives fine spatial resolution but noisy phase estimates; a large window gives stable estimates but blurs the boundary location. Practical implementations use overlapping windows of 64x64 pixels or larger, then apply spatial filtering to the phase map. The result is a map that identifies suspicious regions but typically cannot precisely determine the boundary at single-pixel resolution.

Double JPEG compression is a necessary consequence of any editing workflow that loads and re-saves a JPEG. It is not by itself proof of tampering: legitimate workflows such as adjusting metadata, rotating an image, or passing a file through a social media platform all introduce a second compression pass. What matters forensically is whether the double compression is consistent with the claimed provenance of the file and, crucially, whether it is uniform across the image or present only in some regions.

When the first and second compression passes use the same 8x8 grid alignment (aligned double compression), the DCT coefficients after the second pass show a characteristic histogram pattern. DCT coefficients that were already quantised to multiples of the first quantisation step Q1 are now quantised again at step Q2. If Q2 divides Q1, the histogram is largely unchanged. If Q2 does not divide Q1, the histogram shows periodically missing values: integers that would require fine DCT precision to produce cannot survive the first quantisation. Detectors based on this effect are sometimes called DQ (double quantisation) detectors.

Misaligned double compression occurs when the image is shifted or cropped between the two compression passes, so the second-pass grid does not coincide with the first-pass grid. This scenario produces stronger forensic evidence. The first-pass blocking artifacts are at phase P1; the second pass introduces new artifacts at phase P2. The decoded image contains blocking patterns at both phases simultaneously, which is physically impossible in a single-compression image. Measuring the power spectral density of the luminance channel at 8-pixel periodicity reveals two distinct phase peaks.

The JPEG ghost technique, described by Hany Farid in 2009, provides a different angle on the same problem. Instead of analysing the blocking artifact pattern directly, it exploits the fact that re-compressing an image at its original quality factor reduces the blocking artifacts to near zero, while re-compressing at a different quality factor introduces new artifacts. An image that contains a spliced region saved at quality Q will show minimum distortion in that region when re-compressed at Q, but higher distortion in the surrounding area (which was saved at a different quality). The spatial map of this difference, computed across a sweep of quality factors, reveals the extent of the pasted region as a ghost.

The procedure is as follows: for each candidate quality factor q from 50 to 99, decode the suspicious JPEG to a bitmap, re-compress it as JPEG at quality q, decode again, and compute the mean squared pixel difference from the original bitmap. A region whose original quality was q will show a local minimum in this difference at q, while surrounding regions with a different original quality will show a local minimum at a different q. A spatial map of which quality factor minimises local difference reveals quality-inconsistent regions.

Limitations of the JPEG ghost include: the method is computationally expensive (requiring one full re-compression per quality factor tested); it is sensitive to any geometric transformation between the source and the pasted region; and it is less reliable when the quality difference between source and host is small (fewer than 5-10 quality points). When the quality difference is large, the ghost is visually clear and easy to interpret. When it is small, quantitative threshold analysis is required.

Block-based DCT compression is not exclusive to still JPEG images. Video codecs including MPEG-2, H.264/AVC, and H.265/HEVC encode intra-coded frames (I-frames) using the same DCT-on-blocks paradigm. For inter-coded frames (P-frames and B-frames), motion compensation is applied before the DCT step, but residual error blocks are still DCT-coded. This means the same blocking artifact analysis methods apply to video, with some important adaptations.

In video tampering, the most common manipulation types are frame deletion, frame insertion, and region replacement within a frame. Frame deletion removes frames from a sequence and causes a discontinuity in the temporal artifact pattern: the blocking artifacts at the cut point show a sudden change in statistical properties. Region replacement within a frame introduces a spatial phase inconsistency within an individual frame, detectable by the same phase estimator used for still images. Frame insertion introduces frames with a different quantisation history into a sequence, visible as a sudden change in the DCT coefficient histogram pattern.

The analysis is complicated by the fact that video codecs apply adaptive quantisation: different regions of the same frame may be quantised at different strengths depending on their motion and complexity. A forensic examiner must use tools that account for the codec's adaptive quantisation map rather than assuming uniform quantisation across the frame. This is covered in more detail in the topic on video double-compression analysis.

DCT block analysis evidence has been presented in criminal and civil proceedings in multiple jurisdictions. In the United States, the admissibility framework under Daubert v. Merrell Dow Pharmaceuticals Inc. (1993) requires that the technique be testable, subject to peer review, have a known error rate, and be generally accepted in the relevant scientific community. DCT-based methods satisfy these criteria: the algorithms are published in peer-reviewed literature, multiple independent implementations exist, and the underlying mathematics of JPEG compression is well established.

In the United Kingdom, forensic image authentication is governed by the Forensic Science Regulator's codes of practice and the guidance of the Chartered Society of Forensic Sciences. Expert witnesses must be able to explain the method to a non-technical jury, quantify their uncertainty, and acknowledge the limitations specific to the image under examination. In EU member states, the standard varies by country but the general requirement for scientific validity and expert qualification is consistent.

Under India's Bharatiya Sakshya Adhiniyam 2023 (which replaced the Indian Evidence Act 1872), electronic records admitted as evidence must satisfy the conditions in Section 63, which requires a certificate from a responsible person and compliance with prescribed procedures. An expert who presents DCT analysis under this framework must document the examination procedure, the tools used, the unaltered state of the file examined (supported by hash values), and the chain of custody, which is addressed more fully in the topic on chain of custody for digital media.

A court-ready DCT report should include: the hash value of the original file, the specific algorithm and tool version used, the parameters applied (window size, quality factor range for JPEG ghost), the output images or maps with clear legends, the finding expressed as an observation rather than a conclusion about guilt (for example, 'the blocking artifact phase in region A is inconsistent with the surrounding image, indicating that region A was encoded in a different compression pass'), and a plain-language summary of what the finding means and what it cannot determine.