PRNU in Casework: Limitations and Reporting

JPEG compression works by dividing an image into 8x8 pixel blocks, transforming each to the frequency domain with a discrete cosine transform, and quantising the resulting coefficients. High-frequency coefficients (which carry fine spatial detail) are quantised most aggressively. PRNU is a high-frequency spatial pattern, so it lives precisely in the coefficients that JPEG destroys most.

The quantitative effect is well studied. At JPEG quality factor 95 (high quality, close to lossless for visual purposes), PRNU signal loss is small: PCE values for true matches at 12 megapixels might drop from an uncompressed baseline of, say, 3,000 to around 1,500. At quality factor 80, PCE might be around 200-400. At quality factor 70, PCE may fall below 100 for many images, approaching the false-positive threshold region. Below quality factor 60, attribution from individual query images becomes unreliable and multiple independent images are needed before any conclusion is drawn.

When a photograph is uploaded to a social media or messaging platform, the server typically re-encodes it at a reduced quality or resolution before delivering it to recipients. This is a bandwidth and storage optimisation from the platform's perspective and a PRNU-suppression event from the analyst's perspective.

The analyst's first task with any social-media-sourced image is to estimate the quality factor of the actual file (using JPEG quality estimation tools, not the platform's stated quality) and to check whether the image has been scaled. Both compression level and resolution determine how much PRNU signal remains. A 24-megapixel image re-encoded at quality 80 retains more total PRNU signal than a 2-megapixel image re-encoded at quality 85, even though the per-pixel quality is similar.

A practical workaround that applies in some cases is to recover the original upload from the platform via a legal preservation request. Law-enforcement requests to major platforms often yield the original file before server-side re-encoding, which dramatically improves attribution reliability.

PRNU attribution, when it succeeds, identifies one specific camera as the source of a photograph. In many investigations the camera is a personal smartphone and its sole user is the subject of interest. In that scenario the device-to-person link is established by other evidence (account data, network logs, physical possession) and the PRNU result is the image-to-device link. The two together make the chain.

The shared-device scenario breaks that chain. A family where three members use the same tablet, an office where a pool camera is checked out by multiple employees, or a situation where a suspect claims the phone was borrowed: in all of these, proving the image came from Device X is not the same as proving it was taken by Person Y. The PRNU attribution is still valid and useful, but the investigative conclusions it can support are narrower. The analyst must be explicit in the report about what the PRNU result establishes (image origin as a specific device) and what it does not (the identity of the photographer).

Consider the following scenario. An analyst's validated PRNU method has a false-positive rate of 1 per 10,000 comparisons at the chosen PCE threshold. A query image is compared against a reference database of 10,000 cameras. The expected number of false attributions from non-source cameras is 1. If the source camera is in the database, there is one true positive and one expected false positive: the analyst cannot say which is which from the PCE statistic alone.

This is the base-rate problem, and it is identical in structure to the well-known base-rate fallacy in DNA databases and diagnostic testing. The PCE threshold controls the false-positive rate per comparison, not the probability that any given positive attribution is correct. That probability depends on the prior: how many cameras in the pool could plausibly be the source? Bayesian reasoning formalises this. The posterior odds of a correct attribution equal the prior odds multiplied by the likelihood ratio from the PCE test.

The practical answer for casework is to keep the candidate pool as small as the investigation can justify. If the question is whether the image came from one of five phones seized in a specific raid, the base-rate problem is small. If the question is whether the image matches any camera in a national database of confiscated devices, it is large and Bayesian handling is mandatory. Some PRNU software vendors present their tool's results without any base-rate discussion, which is a known source of wrongly confident reports.

Video attribution via PRNU is well established in the research literature and has been used in casework, but video introduces three problems beyond those for still images.

• Inter-frame codec compression: H.264 and H.265 P-frames and B-frames are encoded as prediction residuals relative to reference frames. Their noise statistics are different from still-image JPEG noise, and PRNU content in these frames is significantly lower than in I-frames. Analysts should extract I-frames only (or short GOP-start windows) for attribution.
• Temporal correlation of consecutive frames: even I-frames in a video sequence often capture nearly identical scenes (a nearly static camera). Using consecutive I-frames in reference estimation means the residuals are correlated, and the effective number of independent samples is far less than the raw frame count. Frames should be spaced by at least a few seconds of video.
• Platform transcoding of uploaded videos: social media platforms re-encode uploaded videos more aggressively than photos, often reducing bitrate and resolution significantly. A smartphone video uploaded to a platform and then downloaded may have been transcoded twice (device-to-platform, platform-to-recipient). Bit rates below about 2 Mbps for 1080p content typically reduce PRNU signal to marginal levels.

Notwithstanding these challenges, PRNU attribution of video has been admitted as forensic evidence in several cases involving child exploitation material and protest footage. The key requirement is that the analyst explicitly test whether the specific video format and quality level in the case yields reliable PCE distributions before applying a threshold, rather than assuming that still-image thresholds transfer.

Good PRNU reporting communicates four things clearly: what the attribution result was (PCE value and comparison to threshold), the basis of the threshold (the dataset, false-positive rate, and image conditions it was calibrated on), the factors in this specific case that may have affected signal quality (JPEG quality, re-encoding, resolution), and what the result does and does not establish (device attribution versus person attribution).

• Report PCE for all tested candidates, not just the top match. Showing that one camera has PCE = 840 and the next highest is PCE = 18 is far more informative than stating 'the image was attributed to Camera 3'.
• State the threshold and its provenance. Where was it calibrated, on what dataset, at what false-positive rate? If the threshold was taken from a published study, cite it. If it was calibrated in-house, describe the validation method.
• Document quality-degrading factors. Estimated JPEG quality factor of the query image, any known re-encoding steps, resolution relative to the calibration dataset. If quality was substantially lower than the calibration conditions, state that the threshold may be less conservative than assumed.
• Distinguish device from person. The report should explicitly state that PRNU identifies the camera body, and that associating the camera body with a specific individual requires additional evidence.
• Recommend independent verification for key attributions. For evidence that will be central to a prosecution, a second independent analysis by a different laboratory using a different implementation reduces the risk of systematic error in any single method.