Double JPEG Compression Analysis: Catching Forged Documents

Double JPEG compression analysis detects forged documents by identifying regions of an image that were compressed twice at different quality levels — the signature left by a composite (a photograph pasted into a scan, a field copied from another file) or by a fraudster who re-scans an already-edited document to erase traces of the first tampering. Unlike error level analysis (ELA), which compares an image against a single re-save quality, this technique sweeps a range of JPEG qualities to pinpoint the original compression level of each region, catching manipulations that ELA alone lets through.

According to the ACFE 2024 Report to the Nations, only 37% of document frauds are caught through internal controls — a ceiling that stays fixed as long as compliance teams rely on a single forensic layer. Double compression analysis closes a specific gap: documents that survived a first ELA check because they were re-scanned or re-exported before submission.

What Double JPEG Compression Is in Document Forensics

Double JPEG compression means an image has been encoded twice under the JPEG algorithm, at two distinct quality levels. Each JPEG pass applies a discrete cosine transform (DCT) to 8×8-pixel blocks and then divides the resulting coefficients by a quantization table specific to the chosen quality setting. When an already-compressed image is edited and re-saved, its DCT coefficients pass through a second division — using a quantization table that differs from the first.

Researcher Hany Farid formalized detection of this effect in "Exposing Digital Forgeries from JPEG Ghosts" (IEEE Transactions on Information Forensics and Security, 2009). His method, known as JPEG ghost detection, re-saves the suspect image at a range of increasing quality levels and computes the mean squared difference against the original at each step. The region that was first compressed at a given quality produces a sharp local minimum at that exact quality level — a "ghost" that betrays its original compression, even after being embedded in an image re-compressed at a different quality.

A second approach, described by Alin Popescu and Hany Farid in "Statistical Tools for Digital Forensics" (2005), exploits the double quantization (DQ) effect: the histogram of DCT coefficients in a re-compressed region shows periodic peaks and valleys never found in a single-pass JPEG. This statistical signature is independent of the final quantization table and stays detectable even when the JPEG ghost itself is faint.

How Double Compression Exposes a Forged Document

A fraudster editing a scanned payslip, bank statement, or invoice almost always follows the same pattern: open the JPEG scan, replace a field (amount, name, date), then re-save the file. Two scenarios leave a double-compression fingerprint:

Inserting a region from another file. A screenshot, a photographed digit from another document, or a separately generated element gets pasted into the target document. That region carries its own compression history, distinct from the rest of the image — the JPEG ghost and the DQ histogram expose it even when colours and fonts match perfectly to the naked eye.

Re-saving the entire composite file. Once the edit is complete, the fraudster saves the forged document as a JPEG. The whole file then undergoes a second, uniform compression pass — but the edited region already went through a first compression cycle at the moment it was created or extracted, at a quality different from the rest of the original document.

The ELA Blind Spot That Double Compression Closes

Error level analysis remains the most widely used forensic technique on JPEG documents, but it has a documented limitation: when a document is re-compressed multiple times — printed and re-scanned, or simply re-exported several times before submission — the ELA map flattens out and the original tampering traces become invisible. Our ELA guide documents this exact phenomenon; fraudsters who know how ELA works exploit this weakness deliberately.

Double compression analysis works differently: instead of hunting for an error-level anomaly against a single reference quality, it sweeps the entire plausible quality range. A document re-scanned after an initial forgery keeps the signature of its first compression cycle in the DCT histogram, even after multiple re-saves — something classic ELA can no longer detect at that stage. This complementarity is why serious forensic platforms never rely on ELA alone.

A related signal worth mentioning is screen recapture detection, which identifies photographs of a screen disguised as photographs of a document. The two techniques often overlap on the same underlying fraud: a document already forged once, then photographed or re-scanned to mask the traces of the first manipulation.

Putting Detection Into Practice

The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 points to rising sophistication in tools available to non-technical threat actors — which makes automating these checks necessary beyond a one-off audit. A workable procedure for a compliance team:

1. Extract DCT blocks and quantization tables. A free, open-source tool such as JPEGsnoop reads embedded DQT tables and flags inconsistencies between segments of the same image.
2. Sweep the quality range to find a JPEG ghost. Re-save the image at increasing quality steps (for example every 5 points from 50 to 95) and compute the mean squared difference at each step; a localized minimum in a specific region signals double compression.
3. Inspect the DCT coefficient histogram. An abnormal periodicity of peaks and valleys in a given region confirms the double quantization effect, independent of the JPEG ghost result.
4. Cross-reference with metadata and ELA. An inconsistent EXIF timestamp or an ELA halo in the same location as a double-compression anomaly strongly reinforces the presumption of forgery.
5. Document the chain of evidence. Record the analysis parameters (quality steps tested, reference quantization table) to support the audit trail required under regulatory review.

None of these techniques alone produces a binary verdict: they feed a bundle of indicators that a compliance team — or an automated platform — must interpret as a whole.

Limits of Double Compression Analysis

Lossless formats. Double JPEG compression analysis only applies to files using JPEG's lossy compression. It is inoperative on native word-processor PDFs, PNGs, or TIFFs, which never went through DCT quantization.

A single convincing compression pass. A fraudster who flattens their composite into one final compression — without ever saving the source elements separately as JPEG — can significantly reduce the JPEG ghost's amplitude, though the double quantization effect generally remains detectable in the DCT histogram.

Close compression qualities. When the first and second compression qualities are very close (within a few points), the JPEG ghost becomes faint and requires a fine-grained sweep to spot.

AI-generated documents. Documents produced by diffusion models or image generators come from no prior JPEG source: they have no first compression to detect, so double compression analysis does not apply to this class of forgery. That family of signals needs a separate detection layer focused on generation artifacts. CheckFile's AI detection surfaces signs of AI-generated content as a complement to your existing controls — no solution achieves 100% detection, but combining layers increases overall coverage.

Combining It With Other Forensic Techniques

A multi-layer analytical approach combining double compression analysis, metadata inspection, and ELA represents the most reliable methodology for identifying re-compressed composite documents. No single technique covers every attack vector.

ELA catches recent pixel-level edits before multiple re-compression cycles — it remains the right first-line check on freshly modified documents.

EXIF metadata analysis (full guide) confirms or contradicts the declared device, capture date, and editing software — a signal independent of the image's compression history.

Our comparison of document forensics tools and AI detection details how these layers combine in a production pipeline: see our forensics tools and AI comparison for the full picture.

Two questions keep coming up on compliance forums. First: "Can a document that's been printed and scanned twice still be caught?" — yes, in most cases, because each print-scan-rescan cycle adds a new generation of JPEG compression that leaves a statistical trace in the histogram, even when the visual ghost fades. Second: "Does double compression analysis work on PDFs sent by email?" — only if the PDF embeds JPEG images internally (common for scanner-generated PDFs); a native text PDF isn't affected and falls under structural file analysis rather than image analysis.

Regulatory Context in Australia

As of 25 September 2026, Australian reporting entities — banks, insurers, remittance providers — are subject to the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), which requires customer due diligence proportionate to risk. AUSTRAC, the Australian Transaction Reports and Analysis Centre, receives suspicious matter reports and supervises compliance, while ASIC oversees corporate and financial services conduct. Neither regulator mandates a single technical method for document verification, but both expect risk-based systems and controls capable of detecting false or altered documents — including those designed to defeat a first-pass ELA check.

On the privacy side, the Privacy Act 1988 and the Australian Privacy Principles (APPs) govern how personal information embedded in analyzed documents is retained and handled. Embedding double compression analysis in a documented forensic workflow, with traceable test parameters, meets the risk-sensitive standard AUSTRAC expects for higher-risk files. Reporting entities should retain the audit trail of these analyses alongside the rest of the customer due diligence file.

For a broader view of document verification practices, see our document verification guide. If your team handles high volumes of files exposed to composite or AI-generated fraud, our dedicated deepfake and AI signal detection page explains how this layer fits alongside your existing controls, using platforms such as CheckFile to automate the process at scale.

Frequently Asked Questions

What is a "JPEG ghost"?

A JPEG ghost is the local minimum in mean squared difference obtained by re-saving a suspect image at multiple JPEG quality levels. That minimum appears exactly at the original compression quality of a given region, revealing that it was compressed once before being embedded in the final document.

Does double compression analysis catch every composite?

No. It is inoperative on lossless formats (native PDF, PNG, TIFF) and loses sensitivity when the two successive compressions use very similar qualities. It also does not apply to AI-generated documents, which never had an original JPEG compression to detect.

Can a document scanned twice escape this detection?

Re-scanning a document reduces the visual JPEG ghost's amplitude but usually leaves a statistical trace in the DCT coefficient histogram (the double quantization effect), detectable with a fine-grained analysis.

What free tools support this analysis?

JPEGsnoop, open source, extracts quantization tables and flags inconsistencies between segments of an image. Commercial document verification platforms typically integrate JPEG ghost detection and DQ analysis into a broader automated pipeline.

How does double compression analysis combine with ELA?

ELA catches recent edits that haven't been re-compressed; double compression analysis catches documents that went through several compression cycles, including those designed to flatten the ELA signal. Used together, they cover a wider fraud spectrum than either does alone.