Qtable Analyzer is a forensic tool designed to identify the possible source of JPEG images
by analyzing and comparing their quantization tables against a database of known signatures.
Different camera models, smartphones, and image-processing software use distinctive quantization tables,
making them a reliable fingerprint for source identification.

Theoretical Background

What is JPEG?

JPEG (Joint Photographic Experts Group) is a widely used lossy image compression standard,
optimized for natural photographs. The compression process consists of several key stages:

1. Color Space Conversion:
   The image is converted from RGB to YCbCr, separating luminance (Y) from chrominance (Cb, Cr).

2. Block Splitting:
   Each channel is divided into 8×8 pixel blocks.

3. Discrete Cosine Transform (DCT):
   Each block is transformed into the frequency domain, where most visual information
   is concentrated in the lower frequencies.

4. Quantization:
   The DCT coefficients are divided by values from predefined quantization tables,
   reducing precision and removing visually negligible data.
   JPEG typically stores two tables:

   • Luminance (luma)
   • Chrominance (chroma)

5. Entropy Coding:
   Quantized coefficients are then compressed using Huffman or arithmetic coding.

---

Quantization Tables as Forensic Evidence

Quantization tables directly affect image quality and compression ratio.
Because each manufacturer or software implementation tends to use custom or scaled tables,
these matrices can serve as a unique signature to identify the origin of a JPEG file.

By comparing an image’s quantization tables to a database of known signatures,
we can infer the most probable device or software used to create or process the image.

---

Installation

git clone https://github.com/gabrielerandazzo/Qtable-Analyzer.git

cd Qtable-Analyzer

pip install -r requirements.txt

---

Adding New Signatures

Each signature consists of the luminance and chrominance quantization tables extracted from a JPEG image and associated with a specific brand or device.

To add a new signature:

python extract.py <image.jpg> <device_name>

Example:

python extract.py ./samples/canon.jpg Canon

This command extracts the quantization tables from the image and stores them as a JSON file inside the data/ directory.

Example output (Canon.json):

{
    "name": "Canon",
    "tables": {
        "luma": [16, 11, 10, 16, ...],
        "chroma": [17, 18, 24, 47, ...]
    }
}

---

GUI

Launch the application with:

python main.py

---

Analysis Process

Implemented in analysis.py, the identification process follows these steps:

-Load all known signatures (JSON files in data/).

-Extract quantization tables from the input image using Pillow.

-Compute the total absolute difference between image and signature tables:

$$\text{diff} = \sum |L_{img} - L_{sig}| + \sum |C_{img} - C_{sig}|$$

Identify the closest match: the signature with the smallest total difference is reported as the most probable source.