## 1 Introduction  
In digital forensic investigations, maintaining the integrity of digital evidence is essential [1]. JPEG images are often central in cases involving child sexual abuse material (CSAM) and must be handled securely to prevent unauthorised access, tampering, or data leakage [2, 3]. Hashing techniques verify file integrity, as any modification alters the hash value [4]. However, hashing only confirms whether a file has been altered; it provides no mechanism to trace leak sources [5]. Evidence leakage risk increases substantially when JPEG images circulate beyond secure, controlled environments such as encrypted cloud systems. An effective forensic infrastructure ideally operates within a cloud environment [3]. This setup ensures that all evidence, including sensitive JPEGs embedded within a disk image, remains encrypted and accessible exclusively to authorised personnel. It also enables the maintenance of the chain of custody, as law enforcement retains full control over data access and handling. Encryption protocols protect the original, unaltered version of the evidence the _gold copy_, i.e., the canonical reference image that remains read-only throughout the investigation while all access attempts and modifications are closely monitored and comprehensively logged. Furthermore, secure cloud platforms support best practices in evidence management by centralising archiving, sharing, and monitoring processes that preserve data integrity throughout the investigation. However, situations arise in which JPEGs must be shared with external parties, such as legal teams, external investigators, or expert witnesses, who may operate outside the controlled environment [6]. In such cases, investigators relinquish direct oversight of how files are stored, accessed, or transferred, and this can increase the risk of unauthorised use or data compromise. To mitigate these vulnerabilities, robust tracking methods become essential where cloud protection cannot be extended. This technical gap requires solutions that provide accountability without requiring cloud infrastructure. Many forensic teams operate without access to cloud infrastructure [1]. In such settings, investigators often share JPEG images in less controlled environments to isolate and distribute specific files instead of full disk images. This introduces a technical challenge: ensuring secure transmission of JPEGs while maintaining data integrity and accountability. The proposed system addresses this gap by embedding unique traceable watermarks in each JPEG prior to distribution. Although these watermarks slightly modify the images and alter the hash, the original, unmodified _gold copy_ remains encrypted and securely stored. Watermarking surpasses hashing in non-cloud contexts by encoding identifiable information directly into files. Unlike hashing, which is limited to verifying whether a file has been altered, watermarking encodes identifiable information directly into the file itself. This process creates a persistent digital fingerprint that links each distributed copy to a specific recipient, which enables investigators to trace leaks to their source. In forensic investigations that involve multiple external stakeholders, such traceability remains essential. Authorised administrators maintain oversight, track each copy, and uphold accountability in cases of unauthorised access or redistribution. This paper presents a forensic watermarking approach for digital evidence distribution outside cloud environments. Two scenarios are addressed:  
1. Watermark JPEGs within forensic disk images for full disk sharing;
2. Watermark stand-alone JPEGs for external distribution. This study bridges the limitations of current forensic infrastructures and ideal cloud-based systems. It facilitates the secure sharing of JPEG evidence with external stakeholders as law enforcement agencies continue their transition to cloud integration. Key contributions of this work include the following. 1.