Digital Camera Forensics

[c0br4]

lol, when I first read it I thought they could detect fingerprints off of the lense of the camera, with a few photo's maybe you could? that would be impressive since you could very quickly find out the culprit if they have a criminal record.

[rmlj63]

That is an amazing article. Its really at its infant stages, which I can see how it could develop quickly. Just the fact that it took 300 pictures per camera to distinguish between 9 different cameras is kinda disheartening. I know the article emphasized the 100% accuracy of it all but I'm wondering with the number of cameras out there how many could have the same noise overlay.
It's just a variance in pixels right?
And if there are multiple exact replicas, will it be an industry standard for cameras to emit their own noise overlay? Possibly encoding a distinct pattern, causing camera manufacturers to insert certain noise patterns to allow an actual photo fingerprint?

I agree with the idea that running it through a photo editor could change it, but as Und3ertak3r said you couldn't alter it the same way lest each image get traced back somehow.

[Und3ertak3r]

so if you were to attempt to make your own (rough but ready) fingerprinter where would you start..

I think the term noise is not very precise.. the nature of noise is random.. but like audio, where you have Pink and white noise, You can find "simularities" in the noise patterns.

My first step would be to setup a program to compare images and subtract what is different..
I would do this first with a series of TIFF's then on the JPG'ed images and see what changes (lots).. but to see what can be used to speed up the process..

ok what next?

[Irongeek]

I don't know if someone else mentioned this, but you can also you tools like Restoration to recover deleted files from the slack space. I've used this on Flash media before to get back deleted images.

[rmlj63]

I think the noise mentioned here is refering to in the basic sense flaws in the pixelation.

So, I think the next step would be to get a bunch of cameras (or images known to be taken from specific cameras) all of the same make and model and test tons of images till you could find a similarity in all of them, This would be like the caliber that you would use to describe in tracing a bullet back to the original gun. Of course the downside would be that you would need to do this for each model of camera. But once you have the general variations you would always have those as blueprints.

Then after you find the similarities or a constant thread that is only found in that specific camera model you can start to decipher between each camera of that model. Now just like guns you really don't need to have an analysis of each camera, just so you can tell between the brands as far as big noise (flaws) and then the more specific noise (unique to only a single camera).

Esentially telling between multiple brands of cameras would be the easy part. Deciphering between two or three cameras of the same brand and model is where the real forensics comes in to play. Especially after you factor in the thousands of cameras there are for each model.

[Tim_axe]

There are several forms of noise that can affect a digital camera. Some noise is very consitant through images, some noise becomes more visible depending on the conditions, some noise is entirely environmental, and some noise is a result of a camera's image processing.

• The consitant noise is commonly known as 'dead pixels' or 'hot pixels' or 'stuck pixels'. Basically this is a manufacturing flaw that is common in high-resolution consumer cameras due to the practicalities and physical limitations involved in fitting 6-8 million subpixel-sensors inside of an area the size of your pinkey finger's nail. When you enlarge the image you might see a certain area that is always red or blue or green, no matter what the picture is of (though most visible when it appears in the middle of a sea of black). This noise isn't very useful for determining if an image was tampered with because it only affects relatively localized areas of the sensor (and editing can avoid those spots), but it can help you determine which camera it came from since relatively few cameras share the same 'hot pixels'. Somewhat recently camera manufacturers (at least in the DSLR market) have begun a process called 'mapping out' these pixels, where working pixels around a defective pixel donate their data to hide the flaw.
  
• The noise that becomes more visible depending on the conditions of a camera is what most people think of when they hear 'noise'. As there is less light and the gain is increased on the image sensor this noise becomes more visible. Also as the temperature increases this noise tends to increase. As the integration-time (exposure time) is extended to the 1+ second range this noise can become more visible. Since this noise generally affects the entire sensor/image area it is more useful to see if an image was tampered with. But since it depends on environmental conditions it requires images taken in specific conditions to positively identify a camera. Also some of these noise characteristics are rumored to change over time and become more pervasive as the camera ages, but unless a camera's sensor is physically damaged (ie, 30-second exposures of the sun at high-noon on a clear bright day) these changes are mild.
  
• Noise that is purely environmental is something like taking pictures near a microwave radio tower. Weird electro-magnetic interactions can occur and produce a very strong and consistant pattern through images. I've only seen a handful of examples with this effect, and it is very weird. It doesn't happen very often either. In the space/satellite environments there is other radiation that can affect images, but they take special measures such as baking-out a CCD to remove heavy-ion buildup on the sensor.
  
• Some noise is caused by the camera's image processing. Generally you can find 'halos' surrounding edges in images, which is an effect from sharpening. JPEG compression is also something the camera does, and the effects here are visible (but difficult to predict). Finally there is data quantization that is performed to the sensor's image values during the conversion to JPEG's gamma curve. Generally a consumer camera will only produce a 24-bit JPEG image w/ 8-bits per channel. Professional cameras can produce a 14-bit RAW image w/ 14-bits per color that can be stored in a 48-bit TIFF image w/ 16-bits per channel. Some professional cameas (most notably Nikon's Compressed NEF/RAW format on the Nikon D70) perform a type of quantization to compress/drop data in the 'highlights' and produce gaps in the highlights (specalized software is needed to even notice these gaps, but some image-quality crazy guys found this after being unsatisfied with regular processing of their images). It is unlikely that this can be used to identify images on the internet since 8-bit JPEG images can't even represent such sublte changes and performs even more quantization in the first place... Overall you can only get an idea of the camera manufacturer from this kind of noise and won't usually be able to identify a specific camera, but every little bit apparently helps....and if a camera produces a 'RAW' image you can create a JPEG image that looks a lot like that camera's normal JPEG images, but you can't do a whole lot to an already processed JPEG without being easily identified as being edited.

If you have 300 images per camera and can identify most of these major kinds of noise among a large sample of images you could organize them by noise characteristics. Then when you have a camera to produces similar noise characteristics you can strongly say that the images were taken with that camera.

The problem is identifying noise...with professional DSLR cameras in good-light conditions though there is relatively no visible noise in images. But as there becomes less light noise becomes more visible and can be used to identify images. Many consumer point-and-shoot cameras have visible noise and lens abberations in nearly all of their images, and are relatively easy to identify. With a good understanding you should be able to identify the differences between a Digital P&S and a DSLR camera and get at least 10 right in this quiz (note, you need to understand the differences between lenses in these formats to do well in the quiz): DSLR or Digicam

[cgkanchi]

I have noticed that one thing they haven't mentioned is whether they identified individual cameras of the same model or different models. I've noticed that, at least to the naked eye (I know, they mention that it's not visible to the naked eye, but still) one photograph from my Canon EOS 300D looks about the same as another photograph taken with the same lens, ISO settings, light etc. Also, the lens can be a source of quite a bit of distortion that may or may not affect the noise pattern on the camera. Therefore I'm kinda sceptical about how far you can actually go with this technique. On the other hand, dead pixels (if there are any) can be fairly diagnostic, since the chances of two cameras having a dead pixel in exactly the same place are remote.

Cheers,
cgkanchi