System, method and computer program product for analyzing JPEG images for forensic and other purposes

1. A forensic method for identifying at least some forged documents, the method comprising, for each of a stream of incoming JPEG images from among which forgeries are to be identified:

using a processor configured for determining whether at least one individual JPEG image in said stream is a replacement forgery by determining whether a first portion of said individual image which resides at a known location (known as a location likely to be replaced by a forger) within at least the individual JPEG image has or has not been doctored aka replaced, including:

computing a double-compression indicator, aka face-DJPG aka F 1 , for the first portion at said known location;

computing a double-compression indicator, aka nonface-DJPG aka F 2 , for a second portion of said individual image which resides at a comparison location within the individual JPEG image which is known as a location unlikely to be replaced by a forger; and

determining whether face-DJPG and nonface-DJPG fulfill at least one predetermined logical criterion and deciding whether or not the individual JPEG image is a replacement forgery accordingly.

2. A method according to claim 1 wherein said first portion comprises one of the following group: facial photograph, bar code, date field.

3. A method according to claim 2 wherein the locations of the first and/or second portions is/are known from a data repository which stores knowledge regarding locations of specific image portions, in images with pre-known recognizable formats.

4. A method according to claim 3 wherein said pre-known recognizable formats comprise at least one of: a country-specific and/or version specific passport format, a country-specific and/or version specific driving license, a financial institution-specific cheque format.

5. A method according to claim 1 wherein said computing a double-compression indicator comprises, for at least one portion P (said first and/or second portions of said individual image):

a. computing a DQ (Double quantization) indicator in said portion P thereby to yield an f 1 value, aka “before-disturb” DQ indicator;

b. disturbing the resonance of said portion P, thereby to generate a resonance-disturbed image, and re-computing the DQ indicator including computing the DQ indicator of the resonance-disturbed image thereby to yield an f 2 value, aka “after-disturb” DQ indicator; and

c. combining said “before-disturb” DQ indicator f 1 and “after-disturb” DQ indicator f 2 values thereby to yield the double-compression indicator.

6. A method according to claim 5 wherein said disturbing comprises changing the number of instances of at least one row/column in said portion P.

7. A method according to claim 6 wherein said disturbing comprises changing the number of instances of exactly one row/column from said portion P.

8. A method according to claim 6 wherein said changing comprises removing at least one row/s, thereby to reduce the number of instances of at least one row from 1 to 0.

9. A method according to claim 6 wherein said changing comprises adding at least one row/s.

10. A method according to claim 2 wherein the locations of first and/or second portions is/are determined by finding location/s within the image possessing known characteristics of the portion/s.

11. A method according to claim 10 wherein the portion's known characteristic is that the portion includes an image of a human face and wherein said finding location/s comprises performing automatic human face detection at plural locations in said image.

12. A method according to claim 10 wherein the portion's known characteristic is that the portion includes a bar-code and wherein said finding location/s comprises performing automatic bar-code detection.

13. A method according to claim 9 wherein said adding at least one row/s comprises duplicating at least one row/s, thereby to increase the number of instances of at least one row from one to at least two.

14. A method according to claim 1 wherein said at least one logical criterion comprises

whether or not face-DJPG and nonface-DJPG are on opposite sides of a predetermined resonance threshold T and

whether face-DJPG and nonface-DJPG differ to a predetermined extent delta

and wherein said deciding comprises deciding that the individual JPEG image is a replacement forgery if face-DJPG and nonface-DJPG are on opposite sides of resonance threshold T and face-DJPG and nonface-DJPG differ to predetermined extent delta.

15. A method according to claim 5 wherein said combining comprises computing a ratio of said “before-disturb” DQ indicator f 1 and “after-disturb” DQ indicator f 2 values.

16. A method according to claim 5 wherein said the DQ indicator comprises a sum of peak heights computed over all peaks exceeding a predetermined threshold V, in a graph of a Fourier transform of a DCT coefficient histogram of a matrix representing a gray level image generated from an image or image portion to be tested for double JPEG compression.

17. A method for identifying double-compressed JPEG images, the method comprising:

determining whether at least one individual JPEG image is double-compressed by computing a double-compression indicator, aka F, including:

a. computing a DQ indicator in said image thereby to yield an f 1 value, aka “before-disturb” DQ indicator;

b. disturbing the resonance of said image thereby to generate a resonance-disturbed image and re-computing the DQ indicator including computing the DQ indicator of the resonance-disturbed image thereby to yield an “after-disturb” DQ indicator f 2 value, aka “after-disturb” DQ indicator; and

c. combining said “before-disturb” DQ indicator f 1 and “after-disturb” DQ indicator f 2 values thereby to yield the double-compression indicator; and

determining whether F fulfills at least one predetermined logical criterion and deciding whether or not the at least one individual JPEG image is double-compressed accordingly.

18. A method according to claim 17 wherein said combining comprises computing a ratio of “before-disturb” DQ indicator f 1 and “after-disturb” DQ indicator f 2 and said logical criterion comprises that said ratio is predeterminedly distant from 1.

19. A forensic system for identifying at least some forged documents, the system comprising:

a processor configured to perform, for each of a stream of incoming JPEG images from among which forgeries are to be identified:

determining whether at least one individual JPEG image in said stream is a replacement forgery by determining whether a first portion of said individual image which resides at a known location (known as a location likely to be replaced by a forger) within at least the individual JPEG image, has or has not been doctored aka replaced, including:

computing a double-compression indicator, aka face-DJPG aka F 1 , for the first portion at said known location;

computing a double-compression indicator, aka nonface-DJPG aka F 2 , for a second portion of said individual image which resides at a comparison location within the individual JPEG image which is known as a location unlikely to be replaced by a forger; and

determining whether face-DJPG and nonface-DJPG fulfill at least one predetermined logical criterion, and deciding whether or not the individual JPEG image is a replacement forgery accordingly.

20. A computer program product, comprising a non-transitory tangible computer readable medium having computer readable program code embodied therein, said computer readable program code adapted to be executed to implement a forensic method for identifying at least some forged documents, the method comprising, for each of a stream of incoming JPEG images from among which forgeries are to be identified:

using a processor configured for determining whether at least one individual JPEG image in said stream is a replacement forgery by determining whether a first portion of said individual image which resides at a known location (known as a location likely to be replaced by a forger) within at least the individual JPEG image, has or has not been doctored aka replaced, including:

computing a double-compression indicator, aka face-djpg aka F 1 , for the first portion at said known location;

computing a double-compression indicator, aka nonface-DJPG aka F 2 , for a second portion of said individual image which resides at a comparison location within the individual JPEG image which is known as a location unlikely to be replaced by a forger; and

determining whether face-DJPG and nonface-DJPG fulfill at least one predetermined logical criterion and deciding whether or not the individual JPEG image is a replacement forgery accordingly.