Forensic Joint Photographic Experts Group (JPEG) Watermarking for Disk Image Leak Attribution: An Adaptive Discrete Cosine Transform–Discrete Wavelet Transform (DCT-DWT) Approach

This paper presents a novel forensic watermarking method for digital evidence distribution in non-cloud environments. The approach addresses the critical need for the secure sharing of Joint Photographic Experts Group (JPEG) images in forensic investigations. The method utilises an adaptive Discrete Cosine Transform–Discrete Wavelet Transform (DCT-DWT) domain technique to embed a 64-bit watermark in both stand-alone JPEGs and those within forensic disk images. This occurs without alterations to disk structure or complications to the chain of custody. The system implements uniform secure randomisation and recipient-specific watermarks to balance security with forensic workflow efficiency. This work presents the first implementation of forensic watermarking at the disk image level that preserves structural integrity and enables precise leak source attribution. It addresses a critical gap in secure evidence distribution methodologies. The evaluation occurred on extensive datasets: 1124 JPEGs in a forensic disk image, 10,000 each of BOSSBase 256 × 256 and 512 × 512 greyscale images, and 10,000 COCO2017 coloured images. The results demonstrate high imperceptibility with average Peak Signal-to-Noise Ratio (PSNR) values ranging from 46.13 dB to 49.37 dB across datasets. The method exhibits robust performance against geometric attacks with perfect watermark recovery (Bit Error Rate (BER) = 0) for rotations up to 90° and scaling factors between 0.6 and 1.5. The approach maintains compatibility with forensic tools like Forensic Toolkit FTK and Autopsy. It performs effectively under attacks including JPEG compression (QF ≥ 60), filtering, and noise addition. The technique achieves high feature match ratios between 0.684 and 0.690 for a threshold of 0.70, with efficient processing times (embedding: 0.0347 s to 0.1187 s; extraction: 0.0077 s to 0.0366 s). This watermarking technique improves forensic investigation processes, particularly those that involve sensitive JPEG files. It supports leak source attribution, preserves evidence integrity, and provides traceability throughout forensic procedures.