System, method and computer program product for analyzing jpeg images for forensic and other purposes

Forensic method for identifying forged documents. For each of a stream of incoming jpeg images, using a processor configured for determining whether jpeg image/s is a replacement forgery by determining whether a first portion of individual image which resides at a known location (known likely to be replaced by forger) within the individual jpeg image has been replaced, including: indicator, face-djpg, for the first portion at known location; computing indicator, aka nonface-djpg, for a second portion of individual image which resides at a comparison location within the jpeg image known as unlikely to be replaced by a forger; and determining whether face-djpg and nonface-djpg fulfill predetermined logical criterion and deciding whether the individual jpeg image is a replacement forgery accordingly.