Detecting Digital I...
 
Notifications
Clear all

Detecting Digital Image Modifications

23 Posts
9 Users
0 Likes
1,793 Views
(@matrix)
Posts: 21
Eminent Member
Topic starter
 

I've been asked to examine several digital images for signs of modification (item(s) added or removed from the image).

I've read various papers on the subject but it seems that most of the tools are developed in-house or are otherwise unavailable.

I did find one program (JPEGSnoop) but it doesn't tell me where on the image the modification(s) took place. I'm looking for a program that can perform a robust match and/or apply an expectation/maximization algorithm to the image. Identification of inconsistencies in lighting would also be of great help.

Does anyone know of a MS Windows-based program that can display where on the image a suspected modification may have been made using the above techniques?

 
Posted : 09/03/2009 1:15 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

When you say, "items added or removed", to what you are referring? Steganography?

 
Posted : 09/03/2009 1:24 am
(@matrix)
Posts: 21
Eminent Member
Topic starter
 

Thank you for responding Keydet89.

No, I'm not referring to Steganography. I'm referring to where an object appears in a photo that was not there originally. In this case, the photo shows a person that may not have been there when the picture was taken.

The person is claiming to have been there but other people in the photo are claiming that this person had left prior to the picture being taken. The date/time stamp of the picture (at least the time stamp) matches a wall clock in the photo. The person who took the photo is a friend of the person in question.

 
Posted : 09/03/2009 2:18 am
4n6art
(@4n6art)
Posts: 208
Reputable Member
 

Assuming this is a digital photograph orginally….

Look at the JPEG in a hex viewer and see if there are any tell-tale signs that the image was saved using a program that COULD edit photos. While it will not give you a definitive on whether the photo was altered, one can question why a program like Photoshop or ULead or another photo *editing* program's information shows up in a jpg that was considered to be "original" and "unaltered".

Images that I have edited using Photoshop or Ulead have those program names in the HEX. Those that were unaltered did not - they had the camera information.

Just a thought….
-=ART=-

 
Posted : 09/03/2009 2:53 am
(@matrix)
Posts: 21
Eminent Member
Topic starter
 

Thanks 4n6art. I've already checked the metadata and as far as I can tell, everything looks fine. Of course there are programs that will strip the metadata out and store it into a file. You can then do all the changes you want and then reload the metadata back into the file. That is why I need a program that will detect inconsistencies in lighting or apply an expectation/maximization algorithm to the image to identify any modifications.

 
Posted : 09/03/2009 3:22 am
(@bithead)
Posts: 1206
Noble Member
 

Rigour

 
Posted : 09/03/2009 3:38 am
(@bithead)
Posts: 1206
Noble Member
 

^^^ However from some quick reading I see that most examiners use Photoshop and just manually examine the images looking for digital smudges, pixels that are a different size, halos around pixels, etc.

 
Posted : 09/03/2009 3:48 am
(@matrix)
Posts: 21
Eminent Member
Topic starter
 

Thanks BitHead.

That's the type of program I need. One thing, the progran may be called Rigour but rigor mortis almost set in when I saw the price!

 
Posted : 09/03/2009 3:51 am
(@bithead)
Posts: 1206
Noble Member
 

The price is certainly not for the faint of heart. But hey, the desktop/server combo is on sale. lol

 
Posted : 09/03/2009 3:53 am
(@matrix)
Posts: 21
Eminent Member
Topic starter
 

Faint of heart? I don't think someone strong of heart could take the desktop/server combo! Thanks for the Photoshop idea BitHead, I had already reserved "Photoshop Cs3 For Forensics Professionals" from the local library.

Does anyone else have any suggestions that are not so cardiac arresting? BTW - Rigour looks like a great forensic tool and if I had more call for it, it may be worth considering.

 
Posted : 09/03/2009 4:34 am
Page 1 / 3
Share: