JPEG Compression Artifacts and Error Level Analysis

JPEG compression proceeds in several stages. First, the image is converted from RGB to a luminance-chrominance colour model. Then each channel is divided into 8x8 pixel blocks. Each block is transformed by the Discrete Cosine Transform into 64 frequency coefficients: the DC coefficient at position (0,0) captures the average brightness of the block, and the 63 AC coefficients at increasing frequencies capture progressively finer detail. The human visual system is more sensitive to luminance changes at low frequencies and less sensitive at high frequencies, so JPEG exploits this by applying larger quantisation divisors to high-frequency coefficients.

Quantisation divides each DCT coefficient by a step size from a quantisation table and rounds the result to an integer. The JPEG quality setting, typically a number from 1 to 100, is a shorthand for scaling the entire quantisation table: quality 95 uses small step sizes, preserving most information; quality 50 uses large step sizes, discarding much of it. The rounding step is where information is lost permanently. When the file is later decoded, each quantised coefficient is multiplied back by the step size, but the original pre-rounding value is not recoverable.

On a second save, the decoded pixel values, already affected by rounding from the first save, go through the same process again. But now the DCT coefficients are already close to multiples of the step size, because they were generated by multiplying quantised integers. Re-quantising them introduces only a small additional error. This is the convergence effect: each save reduces the remaining information in the file, and after enough saves the image reaches a state where re-saving changes almost nothing. The residual falls to near zero.

Performing ELA requires four steps. First, obtain the original image file, ideally as a bit-for-bit copy with provenance documentation. Do not accept a screenshot or a re-saved copy as the starting point, because doing so introduces an additional compression cycle and erases the history difference you are trying to detect. Second, re-compress the image at a chosen reference quality, typically between 70 and 95, using the same JPEG codec baseline DCT mode. Third, compute the absolute pixel difference between the re-compressed image and the original, channel by channel. Fourth, scale or amplify the result for visual display, because raw differences may be too small to see without magnification.

The choice of reference quality matters. If you choose a reference quality lower than the original save quality, all residuals will be large, obscuring the relative differences you want to see. If you choose a reference quality close to the original save quality, genuine history inconsistencies are most visible. In practice, many analysts use quality 95 as a default reference for an image they believe was originally saved near that level, and experiment with adjacent values to confirm that a suspect region consistently stands out across the range. The FotoForensics web tool and the open-source jpegsnoop utility can both report the quantisation tables embedded in the original file, which gives an estimate of the original quality setting.

Display amplification is the final step. Differences of a few pixel values become visible only when multiplied by a scaling factor, typically 10 to 20 times. This scaling is purely for visualisation; it does not change the underlying measurement. Analysts should report the reference quality and scaling factor used so that another analyst can reproduce the map exactly.

The first rule of ELA interpretation is that bright areas do not mean tampering. High-frequency content, including sharp edges, text, fine fabric patterns, and foliage, always produces high residuals regardless of whether the image has been edited. This is because the DCT coefficients for those regions are spread across many frequency channels, and quantisation rounding affects more of them. An ELA map of a completely authentic portrait photograph will show bright residuals around hair, eyelashes, and clothing texture. That brightness is normal.

What is meaningful is relative brightness within the same image, holding image content constant. If a smooth sky background shows uniformly low residuals across the entire image, but a small patch of that sky shows residuals as high as the sharp edges, that patch is anomalous. It has a compression history different from the surrounding smooth region. That anomaly warrants further investigation. Conversely, if a region within a complex texture shows residuals substantially lower than the surrounding texture, that is also anomalous: the region may have been sourced from a more-compressed original.

A related trap is comparing two images without controlling for the reference quality. An ELA map produced at quality 95 and an ELA map produced at quality 80 are on entirely different scales. Investigators who look at two such maps side by side and compare absolute brightness levels will reach unreliable conclusions. Within a single analysis, use one reference quality and report it.

Three systematic errors recur in published ELA misreadings, and they share a common cause: applying ELA without understanding that it measures compression history, not content authenticity.

The first misreading is false positives from inherent high-frequency content. An analyst unfamiliar with how JPEG encodes fine detail sees bright residuals around text embedded in an image and concludes it was overlaid after the original photograph was taken. In many cases, text rendered into an image at save time produces exactly the same ELA signature as text composited later, because both are high-frequency features that resist quantisation convergence. Without corroborating evidence, such as metadata inconsistency or shadow direction mismatch, bright residuals at a text overlay are not diagnostic.

The second misreading is false negatives from a low-quality original. If the original image was saved at quality 50, all regions are already near the quantisation floor. A spliced region sourced from quality 50 content will show the same near-zero residuals as the authentic background, and ELA will not differentiate them. ELA is most sensitive when the original quality is high and the tampered region comes from a substantially different quality source. It is least sensitive when all source materials have similar compression histories.

The third misreading is comparison failure across resaved copies. Social media platforms, messaging applications, and content management systems routinely recompress images on upload. A forensic analyst who obtains a JPEG from a social media download is typically working with a platform-recompressed copy, not the original. ELA on that copy reveals the platform's compression history, not the author's. Presenting that ELA map as evidence of tampering in the original is methodologically wrong. The chain of custody for the digital file is as important as the chain of custody for a physical exhibit.

No single image forensic method is reliable in isolation. ELA detects compression-history inconsistencies. Copy-move and splicing detection finds duplicated or cloned regions within the same image. Noise inconsistency and lighting analysis identifies regions where the sensor noise pattern or illumination geometry is inconsistent with the rest of the frame. Metadata analysis checks whether EXIF timestamps, GPS data, and camera model strings are internally consistent. Each method has blind spots that another method covers.

A finding of compression-history inconsistency from ELA is strengthened when the same region also shows: an implausible noise level relative to adjacent regions; shadow geometry that does not match the light sources visible elsewhere in the frame; a copy-move detection match with another part of the image; or an EXIF modification timestamp more recent than the capture timestamp. When multiple independent methods agree on the same region, the convergent evidence is far more credible than any single method alone.

The inverse is also true. If ELA shows an anomaly but every other method shows no inconsistency, the ELA finding requires a more conservative interpretation. Possible explanations include JPEG resave at a different quality for legitimate purposes, intentional selective editing with quality-matched tools, or simply inherent content characteristics. A forensic report that presents ELA findings without acknowledging the null findings of other methods is incomplete and may be challenged successfully in court.

When ELA evidence is presented in court, the admissibility question turns on whether the method meets the jurisdiction's standard for reliable expert methodology. In the United States, Federal Rules of Evidence Rule 702 (as interpreted through Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579, 1993) requires that the method rest on sufficient facts, be the product of reliable principles and methods, and be applied reliably to the facts of the case. ELA's theoretical basis in JPEG quantisation is sound, but its limitations in high-frequency regions and its dependence on an unmodified original mean that an expert witness must address those limitations explicitly.

In the United Kingdom, expert evidence in criminal proceedings is governed by Criminal Procedure Rules Part 19 and the associated Criminal Practice Direction. The expert must state the substance of all material facts, including any that undercut the opinion, and must acknowledge where the opinion is uncertain. Under this framework, an expert who presents ELA as conclusive proof of tampering without discussing the method's inherent limitations faces a strong cross-examination challenge.

In India, digital evidence is governed by the Bharatiya Sakshya Adhiniyam 2023, which replaced the Indian Evidence Act 1872. The Act requires that electronic records be produced with a certificate attesting to the integrity and proper functioning of the computer system and the accuracy of the output. An ELA analysis output meets this requirement only if the analyst can certify the integrity of the input file, the software used, and the process. Courts in the European Union apply similar principles under national evidence rules informed by the EU's e-IDAS Regulation framework for electronic evidence. Across all these jurisdictions, the practical requirement is the same: document the acquisition, the method, the reference parameters, and the limitations.