Double Compression Analysis in Video

To understand why double compression leaves a detectable trace, start with what happens to a single 8x8 pixel block during compression. The DCT converts the block's 64 pixel values into 64 frequency coefficients. The codec then divides each coefficient by its quantisation step (QS1 for the first encoding) and rounds to the nearest integer. On decompression, the rounded integer is multiplied back by QS1, but the rounding has permanently discarded information. The reconstructed pixel block is a slightly blurred approximation of the original.

Now consider what happens when this decompressed block is re-encoded at a different quality setting with quantisation step QS2. The input coefficients to the second encoder are not arbitrary: they are multiples of QS1, because decompression multiplied the rounded integers by QS1. When QS2 divides these values and rounds, the outcome depends on how QS1 and QS2 relate. If QS2 is not a multiple of QS1, some output integers correspond to coefficient values that could not have come from a single compression pass. The histogram of all coefficients across the video will show dips at positions that were emptied by the first rounding step. These dips are spaced QS1 apart.

In practice, forensic tools extract the DCT coefficients from the video bitstream (without full decoding), compute a histogram for each AC coefficient position across all I-frame macroblocks, and then measure the periodicity of dips using a Fourier transform or a correlation method. A strong periodic signal at frequency 1/QS1 indicates double compression. The estimated QS1 value can be compared against the known quantisation tables of common camera models or encoding presets, helping analysts determine whether the first encoding was likely an original camera recording or a subsequent transcode.

DCT histogram analysis works at the coefficient level. Macroblock statistics provide a complementary view at the coding-decision level. When a video is encoded for the first time, the encoder's rate-distortion optimiser chooses between intra and inter coding for each macroblock based on the raw source content. When the same video is decoded and re-encoded, the encoder is now working from reconstructed frames, not the original sensor data. The reconstruction artefacts from the first pass alter the spatial texture in ways that bias the second encoder's coding decisions.

The most studied macroblock-level indicator is the intra-macroblock ratio in P-frames. In a singly encoded video, P-frames typically have a low proportion of intra-coded macroblocks because the encoder finds good motion-compensated predictions from reference frames. In a doubly encoded video, the blocking artefacts introduced by the first pass create artificial high-contrast edges at block boundaries. These block-boundary edges look like genuine motion to the second encoder, leading to a higher-than-expected rate of intra-coded macroblocks in what should be highly predictable regions.

A second macroblock-level indicator is the motion vector distribution. In singly encoded video, motion vectors cluster smoothly around the dominant motion of the scene. In doubly encoded video, the block structure of the first encoding can introduce motion vector values that correspond to multiples of the block size (16 pixels), because the re-encoder's motion search is partially guided by the artificial grid introduced by the first pass. This is a subtle effect and is less reliable than the DCT histogram method, but it can provide supporting evidence.

Forensic analysts must document the conditions under which the double compression signature may be absent or misleading, because a tampered video might show no signature, and an untampered video might, in unusual circumstances, produce a pattern that resembles one.

The strongest suppression condition is quantisation step alignment: if QS2 is a whole-number multiple of QS1 (for example, QS1 = 4 and QS2 = 8), the second quantisation rounds the already-rounded values to the same grid and the histogram dips disappear. A re-encoder trying to defeat forensic analysis might choose QS2 deliberately to be a multiple of QS1. In practice, most re-encoding tools use different quality scales and do not align steps this precisely, so accidental alignment is uncommon but possible.

Spatial processing between the two encoding passes also attenuates the signature. If the video was rescaled, denoised, or had a sharpening filter applied between the first and second encoding, the coefficient values entering the second encoder are no longer clean multiples of QS1. The histogram dips become shallower and may not cross the detection threshold. Analysts should check for resolution changes and spatial processing artefacts when the DCT method returns a borderline result.

High-motion content weakens the I-frame-based detection because macroblocks in high-motion regions already have high quantisation residuals in a single encoding pass. The forensic signal is diluted. Analysts can mitigate this by restricting the histogram analysis to low-motion I-frame macroblocks, identified by their low residual energy.

When double compression is detected, the period of the DCT histogram dips provides an estimate of QS1, the quantisation step of the first encoding pass. This is forensically useful because it allows comparison against the known encoding parameters of candidate source devices or editing tools.

The estimation procedure is: extract the per-coefficient histograms from I-frame macroblocks; apply a Fourier transform to each histogram to find its dominant periodicity; the reciprocal of that frequency is the estimated QS1 for that coefficient position. Different coefficient positions (corresponding to different spatial frequencies) may have different quantisation steps, because most codecs use a quantisation matrix that applies coarser quantisation to high-frequency coefficients. The estimated quantisation matrix can then be matched against published matrices for known cameras, broadcasting standards (such as MPEG-2 broadcast profiles), or common editing software presets.

A practical limitation is that the estimate is only as precise as the histogram's statistical resolution. With a short video clip (fewer than a few hundred I-frame macroblocks), the histogram bins are sparsely populated and the periodicity measurement is noisy. Analysts should report confidence intervals around QS1 estimates rather than single-point values, and should note the number of macroblocks used in the analysis.

In some cases, comparing the estimated QS1 against the QS of the submitted file's second encoding is itself informative. If QS1 is lower (higher quality) than QS2, the video was originally encoded at higher quality and then transcoded to lower quality, which is consistent with a post-capture re-encoding. If QS1 is higher (lower quality) than QS2, the video was originally encoded at lower quality and then re-encoded at higher quality, which is unusual for authentic camera footage and warrants investigation.

Several software tools are used by practitioners to perform double compression analysis. No single tool is universally accepted as the reference implementation, and different tools may produce different outputs depending on how they handle motion estimation, chroma channels, and short clips. Forensic reports must specify the tool, version, and parameters used.

Amped FIVE is a commercial video forensics suite widely used by law enforcement in Europe and North America. Its codec analysis module extracts quantisation tables and DCT coefficient statistics, providing automated double compression flags and QP estimation. Forensic Toolkit (FTK) and Cellebrite's video analysis modules offer similar capabilities. The open-source ffmpeg toolkit can extract bitstream statistics that form the basis for manual DCT histogram analysis, and the video forensics community has published Python scripts that implement the Bianchi-Piva double quantisation detector on top of ffmpeg-extracted data.

For macroblock-level analysis, the H.264 bitstream can be parsed to extract macroblock type maps using tools such as h264bitstream or the codec's own debug output mode in ffmpeg. Visualising the intra-macroblock pattern across P-frames allows analysts to identify spatially localised anomalies, such as a region within a frame that shows elevated intra-coding while the surrounding region is normal. This spatial localisation can indicate that a specific region was edited rather than the entire video being re-encoded.

Metadata analysis complements signal-level methods. Tools such as ExifTool and MediaInfo extract codec parameters, creation timestamps, and encoder identifiers from the container. A video claiming to come from a specific camera model but encoded with a software encoder's default quantisation matrix is an immediate red flag. The Image File Format Integrity Checks topic covers the broader context of metadata-based authentication.

Double compression analysis is a probabilistic finding, not a binary one. The correct statement of the conclusion is not "this video has been tampered with" but "the statistical properties of this video are consistent with double encoding at an estimated first-pass quality level of QP approximately X, which is inconsistent with a direct recording from [device model] at its default settings." Courts in multiple jurisdictions have required that expert witnesses state their conclusions in probabilistic terms and disclose the conditions under which the signature could be absent or misleading.

In the United States, expert testimony on video forensics is evaluated under the Daubert standard (Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579, 1993), which requires that the method be testable, peer-reviewed, have a known error rate, and be generally accepted in the relevant scientific community. The double quantisation effect is peer-reviewed and the detection method has published error rates, but analysts must be prepared to explain the false-positive sources (in-device transcoding, aligned quantisation steps) in cross-examination.

In the United Kingdom, the Criminal Practice Directions (CPD) and the guidance from the Forensic Science Regulator require a documented quality management framework and a statement of the method's limitations. In India, electronic records are governed by the Bharatiya Sakshya Adhiniyam 2023 (BSA), which replaced the Indian Evidence Act 1872. Section 63 of the BSA addresses electronic records and the certificate of authenticity. Courts increasingly require independent technical verification of digital video evidence, and double compression analysis is a method that can provide or contradict that verification. In the European Union, the EU eIDAS framework and national criminal procedure codes govern digital evidence, with Germany's StPO and France's CPP both requiring the documentary traceability of forensic methods applied to digital exhibits.