Return to Digital Photography Articles
JPEGsnoop - Identifying Edited Photos
by Calvin Hass © 2009
Details regarding the use of JPEGsnoop to detect edited photos
Return to JPEGsnoop Main Page
Ever wondered if that UFO photo or sasquatch sighting is a fake? ... or if that camera manufacturer's sample images have been touched up?
Simply open an image in JPEGsnoop and scroll down to the section titled, *** Searching Compression Signatures ***. This option can be enabled/disabled with the Signature Search item in the Options menu.
The utility will compare the compression characteristics of the photo against an internal database of thousands of camera "signatures" to locate a match. If a match is found, the matching digital camera or editor is shown. If the signature matches a photo editor (such as Photoshop), then there is a good chance that the photo has been edited (i.e. not original!).
The assessment line indicates one of four possible outcomes:
- Class 1 - Image is processed/edited
- Class 2 - Image has high probability of being processed/edited
- Class 3 - Image has high probability of being original -- NOTE: Please see description below!
- Class 4 - Uncertain if processed or original
![]() |
Image is Authenticated as very likely original |
What is "Original"? How confident can we be?
It is virtually impossible for any software to ever guarantee with absolute certainty that a file or image has not been modified in some way. Even files that have an integrated cryptographic hash (eg. SHA-1 or MD5) could theoretically be altered to give a false positive integrity check, albeit unlikely. Apart from the use of cameras providing tightly-integrated authentication features (such as the Canon 1Ds / 1D mk II with the Data Verification Kit DVK-E1 / DVK-E2), it becomes a formidable task to prove that an image is guaranteed to be in its original, unaltered state. It is a much easier task to prove with certainty that an image has been processed / edited (ie. not original).
JPEGsnoop can be used with reasonable confidence in identifying "processed" images, but what can we draw from the tool's assessment that an "Image has a high probability of being original"? ... only that the JPEG compression "signatures" and certain metadata elements match those expected from the indicated camera model(s). Note that assessment "Image is Original" is not used, for this reason.
Is this sufficient information to prove that an image is "original"? In a word, no.
Important Note: For this, and related reasons, the tool should not be used as direct evidence for legal investigations!
It would take a very specialized set of tools to create a false positive "original" from an altered image. It is possible, and I have proven this in my own development. However, in most circumstances, it is highly unlikely that a set of JPEG analysis tools have been used to produce such a fabrication. Even if the compression signatures and metadata were altered carefully to match, there is an array of advanced image content analysis techniques (eg. statistical noise analysis, etc.) that could then be applied to further identify possible alterations.
In-Camera Editing
More interesting perhaps, is that some new digicams allow for a limited set of in-camera editing facilities. These digital cameras may allow for an externally edited photo to be brought back into the camera for resaving (via the editing functions). This mechanism may indeed enable an image to present all of the hallmarks of an "original" image (matching metadata and quantization tables), but bare no relationship to the original captured image.
Video Frame Analysis
JPEGsnoop's image assessment functions are not designed to be performed on JPEG frames extracted from video files (eg. AVI MJPG). In most cases, these will report as "Processed/Edited".
Conclusions
Therefore, while JPEGsnoop cannot absolutely guarantee an image's authenticity, it can be used to indicate with reasonable probability that an image has not been modified. If authenticity must be "proven", further analysis methods would be required. On the other hand, disproving an image's authenticity is accomplished quite easily (provided that the original image camera's signatures have been captured in the database)
Images that are not "Original"
There are many reasons that images may be flagged as being likely "processed / edited", including: the image was altered in a photo-editing program (such as Photoshop), resized before emailing, re-compressed for submission to a website, or simply processed from another image source such as RAW. Note that RAW images are generally converted to JPEG (via ACR or other software) for general-purpose output. The fact that the camera itself didn't encode the JPEG image is what leads it to be marked as processed / edited. Of course converting from RAW does not necessarily mean that any modifications were made to the image content. Nonetheless, there is no way to prove that from the resulting JPEG, so it is marked as being "processed".
You would be surprised at how many images on the web are apparently original, but are quickly revealed as being edited / post-processed. For example, even some of the "Sample Images" on Canon's official website have been edited in Photoshop, using Save As quality 10. The following is one such example #3.
In this example, Canon may have simply enhanced the sharpness or increased the saturation, but one could easily see how it could be misused.
![]() |
Canon's Sample Image example was edited! |
Compression Signatures
Matching IJG Library Signatures
In some cases, JPEGsnoop may determine that the image's signature matches the digital fingerprint characteristic of IJG's compression quality scale. This scale is based on a formula that generates DQT tables based on a quality value from 1-100. The majority of image editors that provide a quality scale across this range use the same formula to generate their compression tables.
Once JPEGsnoop has determined a match, it will list out several known editors that use this particular scale, as they are all candidates and can produce the same signature.
Submit your own Compression Fingerprint / Signature!
While the built-in database includes thousands of signatures, not all digital cameras or software editors have been analyzed. If JPEGsnoop does not recognize the digicam or software editor, you have an opportunity to submit the compression signature to the JPEGsnoop database (stored on your computer and in the shared database).
If you know the origin of a file (i.e. you took a file direct from your digital camera, or the file is direct from saving within a photo editor / image processing program), then you are invited to submit the compression signature with the Add Camera/SW to DB... command. A dialog box will display the calculated compression signature unique to that file, along with a request for some additional details:
- What is the source of the file? Was it direct from your digital camera or has the file been processed / edited?
- The name of the software (e.g. Adobe Photoshop), if the file has been processed (i.e. no longer original).
- The image quality setting. In this field, you are requested to enter the quality setting (if you happen to know it). Digicams generally provide the user with a selection of up to three image quality modes (e.g. superfine, fine, normal). Similarly, if you have edited / processed a file with software, you are often given the choice of JPEG quality (e.g. high, medium, low, 70, etc.).
When submitting the compression signature to the database, no identifying information or image content is captured -- only the compression signature (a long series of digits) and setting info.
Local User Database
When you add a camera / editor to your database, it is included in all future searches for compression signatures when processing photos. If you want to modify or clear this list (for example, if you entered information that was invalid), then you can use the Manage User DB option.
JPEGsnoop stores the local user database (and configuration options) in the following location:
<Profile Drive>/Documents and Settings/<User Name>/Application Data/JPEGsnoop/
In Windows 95/98 (or in operating systems where the User Profiles haven't been configured), the data file is stored in the same directory as the executable.
Reader's Comments:
Please leave your comments or suggestions below!there are suggestions to detect double JPEG compression by looking at histograms of certain DCT coeficients. (You will easily find papers on this when searching for these key words.) Could you incorporate such histograms in JPEGsnoop? Do you know of any free software that can readily perform this job?
Kind regards
Wolfgang
How I can change compression signature of my Camera(Photo)?
Maybe exist the spacial programs that have Advanced settings of compression
From the little I have seen, it seems like applications such as Uproov might provide for a more robust strategy, given the foundation upon the bitcoin blockchain concept. While people can use ProofOfExistence.com to perform a similar record of their photos, having the digest generated at the time of image capture is a natural step and presumably more difficult to compromise.
When I add my camera and software with [Tools->Add Camera to DB], shouldn't that add the P510's compression signature to the current database?
First thanks for your previous responses. We have cited JpegSnoop in our orphaned jpeg fragment carving article. And, now, we are looking for new tracks about image fingerprinting.
So, I want to ask that what is the criterions while you are extracting image signatures?
Best regards
For image signature / fingerprinting, I am generating a cryptographic hash on a combination of the extracted DQT tables (could be several of them) and the chroma subsampling ratio.
The signature could be made more specific with other image metadata (eg. resolution) but I had decided against doing that at this stage.
All the best, Cal.
No, this is not true, my image is revealed from RAW, who are you to say is processed / edited? I shoot in RAW so I reveal my images. Do you want an example?
To help clarify this, I have updated the text on the page to draw attention to this point. I thought I had raised this important detail elsewhere, but it was worth making it more clear. Thanks for raising the question!
If i want to find out if the same camera was used to take 2 different photos, where should i compare? Sorry for my ignorance on this.
Please tell us why the primary signature frames may differ from final frames video from a DVR? The video has not been edited.
If the assessment of the photo shows a Class 3, what does a line underneath the assessment mean that says "Note that EXIF Software Field is set (typically conatins Firmware version)"?
Thank you for your time and for this fantastic program!!!
i only want huffmancode from images to test the neural network ,can anybody help me to give a solution for it .i only want to extract huffman code from images to test them.
Well, I've tried JPEG snoop, and every image of mine that I've tested it on says Cat 1, even on those I have not in any way altered.
Any advice?
I'm working on my master's thesis regarding detecting alterations on digital images and I found JPEGsnoop very interesting in the field of digital ballistic based on quantization matrix of every camera and model.
I also found the work of H. Farid "Digital Image Ballistics from JPEG Quantization" about the same technique. In that paper he listed lots of cameras and models. Is that information already contained in JPEGsnoop?
My idea is that eventually we could have a default signature that can be validated and taken for granted for specific camera and model, alas NIST's signature DB for applications.
I think it is a fantastic idea to have a fully-validated signature database. This has come up many times with my friends in the forensics field. The challenge is that it would probably require physical access to a large selection of digital cameras or some other means of truly validating the sample files.
I have considered adding a feature to JPEGsnoop that will allow users to load and save their own separate signature databases, which may help enable such a process. If you or anyone else is seriously interested in building a validated database, let me know and I can adjust JPEGsnoop to automate much of the process.
You have given a comment for Francisco's query made on 30-06-2009 which has been reproduced below:
"JPEGsnoop does not currently offer any methods to localize an image edit. However, there are several techniques available that can help determine where an image may have been modified: objective/statistical methods such as error level analysis, double-compression, replication detection, etc. and subjective methods such as lighting / highlight analysis, etc. I have plans to explore some of the objective methods in future releases of JPEGsnoop."
Can you please provide me the useful links of objective/statistical methods such as error level analysis, double-compression, replication detection, etc. and subjective methods such as lighting / highlight analysis, etc.at the above e-mail id.
I shall be obliged if you could provide links to other techniques also (if any).
Thanking You.
Arindam
JPEGsnoop really helped me. it works well.
I have 3 photographs which was used to scam me. I do not know how to go about finding out who the person in the photographs is and whether there is a way to identify him, because it seems that it may be possible that they have been stolen and have been tampered with.
Is there any way you could help?
Thanks
Annatjie
Il faut écrire les commentaires en anglais, c'est plus commode pour avoir une réponse de la communauté et en particulier de l'auteur.
A priori tu peux utiliser JPGsnoop pour reconnaitre si une image a été prise par un appareil photo ou logiciel (pour faire simple) car c'est écrit dans le fichier jpeg. Si l'image jpeg contient des traces de la sauvegarde d'un logiciel tu peux te douter que l'image a été modifié. Par contre tu ne peux pas savoir ce qui a été modifié.
Hi,
I answer to martine who ask if JPGsnoop can detect if a photo has been modified. So i explain to her that JPGsnoop can help her to know if the jpeg file was saved by a device or by a software so if a software was used we can bet the photo was edited.
Thomas
je suis une neophite en la matiere, mais j'aimerais beaucoup apprendre.
thankfully,
Aline
Thanks for your assistance.
Many Thanks
I've got two questions:
1. I would like to reference a great response you gave me for a college paper I'm writing. May I do that, and how would you like it formatted; e.g., your name + website name + hyperlink...etc
2. I have been using Photoshop since version #5. I did an experiment to see what, if any, differences exist between CS2 and CS3 in the file sizes they save (I always retain my prior versions of software).
I have noticed, anecdotally, that CS3 tends to produce a smaller sized file than CS2. To make the tests equal, I scanned a color document into both versions and saved each one as a PSD file. The first thing I noticed was that CS3 produced a smaller-sized PSD file than CS2.
I then opened the CS3 file with CS2, and vice versa. I saved them again as PSD files and compared the results.
The CS2 file opened and saved in CS3 produced a smaller PSD file than the CS3 opened and saved in CS2.
I cannot account for the differences. What is CS3 doing that CS2 will not?
Jules
if i have a list of cameras and software under Searching Compression Signature, does it mean that the photo has been taken/edited with any of these cameras/software? can i exclude others cameras/software?
is there a way to detect if a photo is a digital photo or it is a scanned photo (from a print or a film)? if i have some cameras under Searching Compression Signature, does it mean that the photo is certainly digital?
thanks
In general, the subsampling should match for the signature to be a reliable match.
The list of cameras and software under the signature search are all ones that have the same signature as the one identified in the image. It means that those other cameras and software tools could have also produced images with the same signature, not that someone used multiple cameras or software programs to produce the image.
However, with regards to your question: "is the photo digital"... By this I think you mean that someone took a photo with a digital camera of a scene versus taking a photo with a digital camera of a printed/film photo. One cannot tell this by the signatures alone.
If you can email me a copy of this image, I can provide more insight into the result or refine upcoming releases of the software. Thanks!
NOTE: Image repair requests are not accepted. Thanks for your understanding.