Digital Camera Forensics

Link from Binghamton University in New York:

Quote:

---

...a stunning new technology in development at Binghamton University, State University of New York, that can reliably link digital images to the camera with which they were taken, in much the same way that tell-tale scratches are used by forensic examiners to link bullets to the gun that fired them.

---

This would allow forensic examiners to link digital images to digital cameras, by examining a form of noise in the images that resembles a fingerprint. There are some limitations, the examiner would have to have multiple other images taken by the camera to compare with, or understandably, the camera itself.

Other interesting points in the article include:

Quote:

---

...the absence of the expected digital fingerprint in any portion of an image that provides the most conclusive evidence of image tampering.

---

Quote:

---

In the near future, Fridrich's technique promises to find application in the analysis of scanned and video imagery. There it can be expected to make life more difficult for forgers, or any others whose criminal pursuits rely on the misuse of digital images.

---

Thats insane... Technology just keeps getting better and better. :D
Thats interesting how they can match "noise" to a certain camera.

Finger print your camera? .. I joke not... I think a program you could look at is Hotspot..me thinks thats the name....

I am sure that what these guys are doing goes a little further than this..

areas of noise..
sensitivity noise in the CCD Sensor
Sensor electrical noise (sensor and associated driver electronics)
Conversion noise
Compression noise..

Being able to get the noise fingerprint from a number of sample images sound cool..

/edit: Bit out on the program name: pixelzap and thumber... oops

http://www.tawbaware.com/pixelzap.htm
http://www.tawbaware.com/thumber.htm

I've read several reports on this technology and became instantly intrigued. I called a few friends over at NIST and sure enough, this is the real McCoy. I'm heading to the first forensics course offered on this technique.

--TH13

Quote:

---

In the near future, Fridrich's technique promises to find application in the analysis of scanned and video imagery. There it can be expected to make life more difficult for forgers, or any others whose criminal pursuits rely on the misuse of digital images.

---

But give it some time and the criminal scene will most likely find a new technique to get around it somehow..

But it does indeed sound like something very interesting to read more about. :)

cheers
f2B

Quote:

---

But give it some time and the criminal scene will most likely find a new technique to get around it somehow..

---

edit the image before posting to your kiddy porn friends.. ie a little blur a sharpen,, convert from TIFF to JPG, a de-speckle or two.. .. oh and dont use the same technique on each image.. probably pay to edit your images with different progs and on different computers... or better yep replace your camera every 1 or 2 hundred images, destroy the old camera.. change brands of memory cards..hmmmm better replace memory cards every few hundred images as well.. BURN the old cards..

Imagine the automation possibilities...

You could take this technology and have it crawl the web, looking for a matching image from the same camera... and what if that matching image found a myspace account? :p

Would be an interesting use of technology. :)

Also... what if one could forge the noise to be id'd with another camera?

Can't say I'm surprised. Fingerprinting hardware isn't new.

http://www-edlab.cs.umass.edu/cs691i...summary04.html

Can it be as simple to get round as running each image through photoshop or similar. Would the package perform the same action on each image leaving a fingerprint of sorts?

Quite a few eclectic sports photographers profile the noise profiles of their cameras all of the time with several applications such as NoiseNinja, Noiseware, or pre-programmed profiles built into various RAW converters such as C1-Pro, Pixmantic RawShooter, or Adobe Camera Raw / DNG Converter. It is well known that a given camera model has a paticular 'look' to its noise characteristics. Their goal is to remove / hide / blur the noise their camera naturally produces so they can have a nice smooth image of an athlete catching a football, etc. (they say it prints better...I run grainy B&W images in dungeons known as gyms in the newspaper just fine though). Personally I think a few people take it too far producing images that definately look unrealistic and blotchy...but that's another story...

As far as taking an arbitrary image from the internet and figuring out whose camera took it...you're generally working with a 640x480 pixel image that was produced by resizing a 2560x1920 pixel image. It is 4x smaller in each dimension than the original image, so you're working with 1/16th the original surface area of the image, or about 6.25% of the original image. The rest of the data was dropped, and whatever emerges is just an estimation from combining neighboring pixels. In short, noise is hidden, and you'll be hard-pressed to get very far in figuring out whose camera took the picture...



Basically there are many ways to 'hide' a paticular camera's signature. This software doesn't take an arbitrary image on the Internet and determine whose camera it was taken with (there's too many cameras out there, too few pixels in an image posted online). What it does is let you take your digital image and your camera to court, and show (hopefully beyond a resonable doubt) that your image's content was not edited in photoshop after taking the picture, ie., that the image was taken with that camera.

And on the scenario proposed by the article (which is a shocking scenario, though I don't see anything authoritive saying it was actually used in such a case)...by the time law-enforcement confiscates stuff, I have no idea how much impact saying "it was taken with this camera" has when there is probably already a mountain of evidence showing that the crime(s) took place. I'd imagine that other evidence for the most part would say the same thing. But it is nice to think that this kind of analysis will one day be used to further prove beyond a shadow of a doubt that the guilty are infact guilty of their crime(s).

lol, when I first read it I thought they could detect fingerprints off of the lense of the camera, with a few photo's maybe you could? that would be impressive since you could very quickly find out the culprit if they have a criminal record.

That is an amazing article. Its really at its infant stages, which I can see how it could develop quickly. Just the fact that it took 300 pictures per camera to distinguish between 9 different cameras is kinda disheartening. I know the article emphasized the 100% accuracy of it all but I'm wondering with the number of cameras out there how many could have the same noise overlay.
It's just a variance in pixels right?
And if there are multiple exact replicas, will it be an industry standard for cameras to emit their own noise overlay? Possibly encoding a distinct pattern, causing camera manufacturers to insert certain noise patterns to allow an actual photo fingerprint?

I agree with the idea that running it through a photo editor could change it, but as Und3ertak3r said you couldn't alter it the same way lest each image get traced back somehow.

so if you were to attempt to make your own (rough but ready) fingerprinter where would you start..

I think the term noise is not very precise.. the nature of noise is random.. but like audio, where you have Pink and white noise, You can find "simularities" in the noise patterns.

My first step would be to setup a program to compare images and subtract what is different..
I would do this first with a series of TIFF's then on the JPG'ed images and see what changes (lots).. but to see what can be used to speed up the process..

ok what next?

I don't know if someone else mentioned this, but you can also you tools like Restoration to recover deleted files from the slack space. I've used this on Flash media before to get back deleted images.

I think the noise mentioned here is refering to in the basic sense flaws in the pixelation.

So, I think the next step would be to get a bunch of cameras (or images known to be taken from specific cameras) all of the same make and model and test tons of images till you could find a similarity in all of them, This would be like the caliber that you would use to describe in tracing a bullet back to the original gun. Of course the downside would be that you would need to do this for each model of camera. But once you have the general variations you would always have those as blueprints.

Then after you find the similarities or a constant thread that is only found in that specific camera model you can start to decipher between each camera of that model. Now just like guns you really don't need to have an analysis of each camera, just so you can tell between the brands as far as big noise (flaws) and then the more specific noise (unique to only a single camera).

Esentially telling between multiple brands of cameras would be the easy part. Deciphering between two or three cameras of the same brand and model is where the real forensics comes in to play. Especially after you factor in the thousands of cameras there are for each model.

There are several forms of noise that can affect a digital camera. Some noise is very consitant through images, some noise becomes more visible depending on the conditions, some noise is entirely environmental, and some noise is a result of a camera's image processing.

• The consitant noise is commonly known as 'dead pixels' or 'hot pixels' or 'stuck pixels'. Basically this is a manufacturing flaw that is common in high-resolution consumer cameras due to the practicalities and physical limitations involved in fitting 6-8 million subpixel-sensors inside of an area the size of your pinkey finger's nail. When you enlarge the image you might see a certain area that is always red or blue or green, no matter what the picture is of (though most visible when it appears in the middle of a sea of black). This noise isn't very useful for determining if an image was tampered with because it only affects relatively localized areas of the sensor (and editing can avoid those spots), but it can help you determine which camera it came from since relatively few cameras share the same 'hot pixels'. Somewhat recently camera manufacturers (at least in the DSLR market) have begun a process called 'mapping out' these pixels, where working pixels around a defective pixel donate their data to hide the flaw.
  
• The noise that becomes more visible depending on the conditions of a camera is what most people think of when they hear 'noise'. As there is less light and the gain is increased on the image sensor this noise becomes more visible. Also as the temperature increases this noise tends to increase. As the integration-time (exposure time) is extended to the 1+ second range this noise can become more visible. Since this noise generally affects the entire sensor/image area it is more useful to see if an image was tampered with. But since it depends on environmental conditions it requires images taken in specific conditions to positively identify a camera. Also some of these noise characteristics are rumored to change over time and become more pervasive as the camera ages, but unless a camera's sensor is physically damaged (ie, 30-second exposures of the sun at high-noon on a clear bright day) these changes are mild.
  
• Noise that is purely environmental is something like taking pictures near a microwave radio tower. Weird electro-magnetic interactions can occur and produce a very strong and consistant pattern through images. I've only seen a handful of examples with this effect, and it is very weird. It doesn't happen very often either. In the space/satellite environments there is other radiation that can affect images, but they take special measures such as baking-out a CCD to remove heavy-ion buildup on the sensor.
  
• Some noise is caused by the camera's image processing. Generally you can find 'halos' surrounding edges in images, which is an effect from sharpening. JPEG compression is also something the camera does, and the effects here are visible (but difficult to predict). Finally there is data quantization that is performed to the sensor's image values during the conversion to JPEG's gamma curve. Generally a consumer camera will only produce a 24-bit JPEG image w/ 8-bits per channel. Professional cameras can produce a 14-bit RAW image w/ 14-bits per color that can be stored in a 48-bit TIFF image w/ 16-bits per channel. Some professional cameas (most notably Nikon's Compressed NEF/RAW format on the Nikon D70) perform a type of quantization to compress/drop data in the 'highlights' and produce gaps in the highlights (specalized software is needed to even notice these gaps, but some image-quality crazy guys found this after being unsatisfied with regular processing of their images). It is unlikely that this can be used to identify images on the internet since 8-bit JPEG images can't even represent such sublte changes and performs even more quantization in the first place... Overall you can only get an idea of the camera manufacturer from this kind of noise and won't usually be able to identify a specific camera, but every little bit apparently helps....and if a camera produces a 'RAW' image you can create a JPEG image that looks a lot like that camera's normal JPEG images, but you can't do a whole lot to an already processed JPEG without being easily identified as being edited.

If you have 300 images per camera and can identify most of these major kinds of noise among a large sample of images you could organize them by noise characteristics. Then when you have a camera to produces similar noise characteristics you can strongly say that the images were taken with that camera.

The problem is identifying noise...with professional DSLR cameras in good-light conditions though there is relatively no visible noise in images. But as there becomes less light noise becomes more visible and can be used to identify images. Many consumer point-and-shoot cameras have visible noise and lens abberations in nearly all of their images, and are relatively easy to identify. With a good understanding you should be able to identify the differences between a Digital P&S and a DSLR camera and get at least 10 right in this quiz (note, you need to understand the differences between lenses in these formats to do well in the quiz): DSLR or Digicam

I have noticed that one thing they haven't mentioned is whether they identified individual cameras of the same model or different models. I've noticed that, at least to the naked eye (I know, they mention that it's not visible to the naked eye, but still) one photograph from my Canon EOS 300D looks about the same as another photograph taken with the same lens, ISO settings, light etc. Also, the lens can be a source of quite a bit of distortion that may or may not affect the noise pattern on the camera. Therefore I'm kinda sceptical about how far you can actually go with this technique. On the other hand, dead pixels (if there are any) can be fairly diagnostic, since the chances of two cameras having a dead pixel in exactly the same place are remote.

Cheers,
cgkanchi