Dear Amped friends, welcome to one more tip! Following the recent mini-series about unveiling traces of double JPEG compression, today we’ll show how Amped Authenticate can reveal if a seemingly uncompressed image was actually JPEG compressed in its past. Keep reading to find out more!
Let’s be honest, when we start working on an image, the first thing we look at is the file extension: is it a .JPG file, or is it in a different format? It makes sense since a lot of image forensics methods are based on traces left by JPEG compression. However, when we see that the image is currently in a different format, we should not directly conclude that it has never been JPEG in its past. Perhaps it has just been resaved to a different format. Is there a way we can check this? Of course, there is.
As you probably know (take a look at this previous tip otherwise), JPEG compression works by dividing the image into 8-by-8 pixel blocks and compressing each block independently. This is the reason why strong JPEG compression normally causes the annoying “blocking artifacts” shown below.
When the compression is mild, you’ll hardly see those blocks so evidently, but still, a periodic disturbance is introduced in the image. Even if your eyes cannot see it, Amped Authenticate’s Correlation Plot can make it stand out. Let’s see a practical example: this is the correlation plot of a never compressed JPEG image (shown with Log scale activated):
As expected, the black plot has peaks superposed on the green vertical helper lines. Those green lines mark the positions of the correlation plot where we expect to find traces of internal camera processing (such as CFA demosaicking). Noticeably, however, there are no black peaks superposed to blue vertical lines.
Now, if we compress the image to JPEG at quality 95 (very mild compression) and load the resulting JPEG file, this is what we see:
Compared to before, we now see peaks of the black plot also in correspondence of the blue helper lines. Those lines mark the position where peaks left by JPEG compression are expected to be (indeed, they are at position 1/8, 2/8, 3/8, etc.)
Now, even if we resave this JPEG image to an uncompressed format, the correlation plot will remain the same, as shown below!
So, if you load a PNG or BMP image, take a look at the Correlation Plot: if there are peaks over the blue lines, that strongly suggest that JPEG compression is part of that image’s lifecycle.
The Correlation Plot is not the only filter that can help you spot traces of JPEG compression in uncompressed images. For example, let’s use the JPEG Ghost Plot filter on the same JPEG-resaved-to-bitmap file used above:
Do you see that downward peak at quality 90? It’s telling us that this BMP file was probably a JPEG file before, and it’s also revealing to us the compression quality that was used!
There’s one more tool that possibly reveals traces of JPEG compression in images stored in uncompressed formats: the JPEG Dimples filter. If an image is affected by the JPEG Dimples artifact, re-saving it to an uncompressed format won’t take away such artifact. Here is an example of a dimples-affected image resaved to bitmap and analyzed with the JPEG Dimples tool:
Surely we don’t expect JPEG dimples to be present in an uncompressed image, and so once more we’ve spotted an inconsistency.
And that’s all for today! We’ve seen one more way to unveil traces of previous processing with Amped Authenticate.
