Multimedia Tools and Applications

, Volume 77, Issue 10, pp 12805–12835 | Cite as

JPEG image classification in digital forensic via DCT coefficient analysis

  • Nadeem Alherbawi
  • Zarina Shukur
  • Rossilawati Sulaiman


From the digital forensics point of view, image forgery is considered as evidence that could provide a major breakthrough in the investigation process. Additionally, the development of storage device technologies has increased storage space significantly. Thus a digital investigator can be overwhelmed by the amount of data on storage devices that needs to be analysed. In this paper, we propose a model for classifying bulk JPEG images produced by the data carving process or other means into three different classes to solve the problem of identifying forgery quickly and effectively. The first class is JPEG images that contain errors or corrupted data, the second class is JPEG images that contain forged regions, and the third is JPEG images that have no signs of corruption or forgery. To test the proposed model, some experiments were conducted on our own dataset in addition to CASIA V2 image forgery dataset. The experiments covered different types of forgery technique. The results yielded around 88% accuracy rate in the classification process using five different machine learning methods on CASIA V2 dataset. It can be concluded that the proposed model can help investigators to automatically classify JPEG images, which reduce the time needed in the overall digital investigation process.


Digital investigation Data carving JPEG image forgery DCT coefficient analysis JPEG image classification 



Credits for the use of the CASIA Image Tempering Detection Evaluation Database (CAISA TIDE) V2.0 are given to the National Laboratory of Pattern Recognition, Institute of Automation, Chinese Academy of Science, Corel Image Database and the photographers.


  1. 1.
    Alherbawi N, Shukur Z, Sulaiman R (2013) Systematic literature review on data carving in digital forensic. Procedia Technol 11:86–92CrossRefGoogle Scholar
  2. 2.
    Alherbawi N, Shukur Z, Sulaiman R (2017) Current techniques in JPEG image authentication and forgery detection. J Eng Appl Sci 12(1):104–112. Google Scholar
  3. 3.
    Bianchi T, Piva A (2012) Image forgery localization via block-grained analysis of jpeg artifacts. IEEE Trans Inf Forensics Secur 7(3):1003–1017CrossRefGoogle Scholar
  4. 4.
    Bianchi T, Rosa AD, Piva A (2011) Improved DCT coefficient analysis for forgery localization in JPEG images. Acoustics, Speech and Signal … pp 2444–2447Google Scholar
  5. 5.
    Chen Y, Thing VL (2013) Image content analysis for sector-wise JPEG fragment classification. J Vis Commun Image Represent 24(7):857–866CrossRefGoogle Scholar
  6. 6.
    Garfinkel S (2007) Carving contiguous and fragmented files with fast object validation. Digit Investig 4:2–12CrossRefGoogle Scholar
  7. 7.
    Garfinkel SL (2006) Forensic feature extraction and cross-drive analysis. Digital investigation 3, Supplement:71 – 81, the proceedings of the 6th annual digital forensic research workshop (DFRWS ’06)Google Scholar
  8. 8.
    Garfinkel SL (2010) Digital forensics research: the next 10 years. Digital investigation 7, Supplement:S64 – S73. doi: 10.1016/j.diin.2010.05.009,, the proceedings of the tenth annual {DFRWS} conference
  9. 9.
    Garfinkel SL (2013) Digital media triage with bulk data analysis and bulk-extractor. Comput Secur 32:56–72CrossRefGoogle Scholar
  10. 10.
    Haines R F, Chuang s L (1992) The effects of video compression on acceptability of images for monitoring life science experiments. Tech. rep., NASA Technical DocumentsGoogle Scholar
  11. 11.
    He J, Lin Z, Wang L, Tang X (2006) Detecting doctored JPEG images via DCT coefficient analysis. Computer Vision ECCV 2006:423–435Google Scholar
  12. 12.
    Lin Z, He J, Tang X, Tang CK (2009) Fast, automatic and fine-grained tampered JPEG image detection via DCT coefficient analysis. Pattern Recogn 42 (11):2492–2501CrossRefzbMATHGoogle Scholar
  13. 13.
    Miano J (1999) Compressed image file formats: JPEG, PNG, GIF, XBM, BMP. ACM Press/Addison-Wesley Publishing Co., New YorkGoogle Scholar
  14. 14.
    Pan X, Yan B, Niu K (2010) Multiclass detect of current steganographic methods for jpeg format based re-stegnography. In: 2010 2nd international conference on advanced computer control, vol 4, pp 79–82, doi: 10.1109/ICACC.2010.5486869 Google Scholar
  15. 15.
    Popescu AC, Farid H (2004) Exposing digital forgeries by detecting duplicated image regions. Dartmouth College pp 1–11Google Scholar
  16. 16.
    Popescu AC, Farid H (2005) Statistical tools for digital forensics. Springer, Berlin, Heidelberg, pp 128–147Google Scholar
  17. 17.
    Richard G, Roussev V, Marziale L (2007) In-Place File carving. Springer, New York, pp 217–230Google Scholar
  18. 18.
    Sahani A, Srilatha K (2014) Image forgery detection using svm classifier. In: IEEE sponsored 2nd international conference on innovations in information embedded and communication system, pp 7551–7556Google Scholar
  19. 19.
    Vaida F (2005) Parameter convergence for EM and MM algorithms. Stat Sin 15:831–840MathSciNetzbMATHGoogle Scholar
  20. 20.
    Wang Y, Liu J, Zhang W, Lian S (2010) Reliable JPEG steganalysis based on multi-directional correlations. Signal Process Image Commun 25(8):577–587CrossRefGoogle Scholar

Copyright information

© Springer Science+Business Media, LLC 2017

Authors and Affiliations

  1. 1.Research Center for Software Technology and Management, Faculty of Information Science and TechnologyUniversiti Kebangsaan MalaysiaBangiMalaysia

Personalised recommendations