Document Image Forensics: Detecting Digital Manipulation in Documents

Introduction

Document image forensics is the discipline of extracting evidence of manipulation from the pixels of a scanned or photographed document. It draws on decades of research in multimedia forensics and applies it to a specific and demanding domain: documents whose authenticity determines whether people are hired, funded, admitted, or granted legal status.

This article surveys the forensic techniques that matter in practice, explains where each is strong and where each fails, and describes how Veridexa integrates forensic analysis into a broader evidence-based fraud detection pipeline.

What Is Document Image Forensics?

Image forensics analyses the statistical structure of an image to detect operations that left a fingerprint behind. Every digital image is a chain of operations — capture, compression, editing, re-compression, transmission — and each operation modifies the statistical properties of the pixels in characteristic ways.

On documents, forensic analysis focuses on regions attackers most often edit: names, dates, amounts, addresses, stamps, and portraits. The goal is not to reconstruct exactly what the attacker did, but to establish that the pixel history of the document does not match what a legitimate capture-and-storage chain would produce.

Why It Matters

• Documents rarely carry hardware-backed authenticity guarantees.
• OCR-only checks miss visually consistent but pixel-inconsistent edits.
• Metadata can be stripped or forged more easily than pixel statistics.
• Layout and structural checks catch template errors but miss field-level edits.
• Forensics closes the gap that other layers cannot cover on their own.

The Capture Model

Understanding legitimate capture is essential to understanding forensic anomalies.

• A sensor records light through a colour filter array.
• Demosaicing reconstructs a full-colour image from the CFA.
• The image is compressed, typically with JPEG for phone cameras.
• The file is stored, transmitted, and possibly resaved.

Every legitimate document image has a single, coherent capture history. Manipulation breaks that coherence, and forensic techniques exist to detect the break.

Error Level Analysis

ELA compares an image against a re-compressed copy of itself. Regions that have been resaved more times than the rest of the image show different error levels.

• Strong ELA response on a specific field indicates local re-saving.
• Uniform ELA across the image is expected for genuine single-capture documents.
• ELA is diagnostic, not definitive — several benign operations produce responses.

On documents, ELA is most valuable when combined with OCR to focus on the fields that matter — dates, names, amounts, portraits — rather than the entire image.

Noise and PRNU Analysis

Every camera sensor produces characteristic noise. Photo Response Non-Uniformity (PRNU) is a sensor fingerprint that persists through JPEG compression and mild editing.

• Regions with inconsistent noise patterns indicate content pasted from another source.
• PRNU can be used to attribute images to a specific device when a reference is available.
• On documents, local noise inconsistency around a name or number is a strong tampering signal.

Copy-Move Detection

Copy-move forgery duplicates a region of the image and pastes it elsewhere to hide, duplicate, or extend content.

• Block matching identifies image regions with statistically identical content.
• Keypoint methods locate duplicated regions across scales and rotations.
• Copy-move detection is especially valuable on stamps, signatures, and repeating logos.

Splicing Detection

Splicing combines regions from different source images into a single composite. Detection relies on statistical inconsistencies between the spliced region and the surrounding image.

• Colour and illumination inconsistency at the splice boundary.
• Compression history mismatch between the pasted region and the host.
• Edge irregularities and blending artefacts.

Resampling and Interpolation

Resizing or rotating a pasted region requires interpolation, which introduces periodic patterns in the pixel statistics.

• Local peaks in interpolation spectra indicate resampled regions.
• Resampling detection is one of the most reliable field-level tampering signals.
• It is particularly effective on edited dates and amounts.

Compression Artefacts

JPEG compression divides the image into 8x8 blocks and quantises frequency coefficients. Editing typically leaves compression traces that differ from the surrounding image.

• Block boundary discontinuities at the edges of pasted content.
• Localised quantisation table changes.
• Ghost patterns from double compression at different quality factors.

Screen and Print Recapture

Attackers frequently launder edits through a display or a print cycle. Recapture leaves its own fingerprints that can be detected.

• Moire patterns from photographing a screen.
• Screen edges or bezels visible in the capture.
• Paper texture and micro-shadow patterns from printed documents.
• Geometric distortion consistent with off-axis photography.

For document workflows, detecting recapture is often as valuable as detecting the underlying edit.

Double JPEG Compression

Double JPEG compression is one of the most well-studied forensic signals. Images that have been decompressed, edited, and re-saved show characteristic double compression patterns in their DCT histograms.

• Non-aligned double JPEG detection reveals localised edits.
• Aligned double JPEG detection reveals whole-image re-saves.
• Absent double JPEG on a claimed camera capture is itself a signal.

CFA and Demosaicing Patterns

Camera CFA interpolation leaves a periodic pattern across the image. Regions that break that pattern indicate content that did not come from the same capture.

• CFA analysis is powerful on lightly compressed images.
• It degrades under heavy compression and after print-and-rescan cycles.
• Combining CFA with resampling and noise analysis improves reliability.

Limits of Forensic Analysis

• Heavy compression suppresses many pixel-level signals.
• Print-and-rescan cycles erase most digital fingerprints but introduce recapture fingerprints.
• Attackers who understand forensics can suppress specific signals.
• Some signals require reference data (PRNU) not always available at scale.
• Standalone forensic verdicts should be avoided in high-stakes decisions.

These limits are why forensics belongs inside a multi-layer pipeline that combines pixel, metadata, structural, and cross-evidence analysis.

Forensic Workflow

• Ingest the original file and preserve a hash.
• Run OCR and locate high-value regions such as dates and amounts.
• Run ELA, noise, resampling, and copy-move analysis focused on those regions.
• Detect recapture and double compression across the whole image.
• Combine findings into structured evidence for downstream risk scoring.

Industry Applications

Identity and Onboarding

Forensics catch altered dates of birth, portraits, and expiry fields on identity documents.

Financial Underwriting

Forensics detect edited balances, amounts, and totals on bank statements, invoices, and payslips.

Insurance Claims

Forensics identify manipulated repair estimates, invoices, and photographic evidence.

Legal and Litigation Support

Forensics support disputes about document authenticity in civil and criminal proceedings.

Public Sector

Forensics support fraud detection in benefits, procurement, and licensing workflows.

Best Practices

• Preserve originals — forensic analysis on compressed or resized copies loses signal.
• Focus forensics on OCR-identified high-value fields.
• Combine forensic findings with metadata and cross-evidence checks before scoring.
• Treat single-signal forensic verdicts with caution; require converging evidence.
• Expose the specific signals used in each finding so reviewers can adjudicate.

Veridexa Analysis

Veridexa runs an integrated forensic stack over every submitted document. ELA, noise analysis, copy-move detection, resampling detection, compression analysis, and recapture detection execute in parallel, focused on the fields that OCR flagged as high-value.

Findings are combined with metadata inspection, structural checks, and cross-evidence reasoning inside a single explainable risk model. Every anomaly is surfaced with its location, the underlying signal, and its contribution to the final decision — so reviewers can trace exactly why a document was accepted, held, or rejected.

Conclusion

Document image forensics is neither a silver bullet nor a marketing accessory. It is a rigorous, well-understood layer of evidence that, combined with OCR, metadata, and cross-evidence reasoning, makes document fraud detection defensible at scale.

Veridexa treats forensics as one indispensable pillar of an evidence-based methodology, not as a standalone verdict engine.

Frequently Asked Questions