DIGITAL IMAGE AUTHENTICATION
Digital image authentication uses digital image forensics to determine if an image is real or fake.
WHAT IS IMAGE AUTHENTICATION?
Digital image authentication, helps determine the authenticity of images used as evidence. Digital camera images aren’t always an accurate eyewitness, however. As photo editing software and image compression grow more popular, digital image forensics is a necessary tool to determine authenticity. It is important to note that tampered images are always detectable through forensic image analysis.
WE IDENTIFY THE AUTHENTICATION AREAS NEEDED TO VERIFY THE INTEGRITY OF IMAGES USED AS EVIDENCE USING THE FOLLOWING:
- File format analysis: Verifies if the image is a camera-original
- Global Analysis: Examines the image for global modifications: for example if we find traces of image resaving or resizing
- Local Analysis: Examines the image for local modifications: these are modifications which are only found in a specific area of the image
- Camera Identification: Applies camera/photo sensor identification tools to verify if the image has been taken by a certain camera or device
IMAGE AUTHENTICATION SCIENCE
The goal of the digital integrity verification testing is to authenticate the digital integrity of the image evidence format. Throughout this process we examine the digital information embedded within the image to determine if it is consistent with what we would expect to see from an original. A system creates an original recording when it produces a 1st generation copy.
We are trained in the HASH test analysis method. The HASH test is a series of numbers and letters that is considered a digital fingerprint of the digital file. We compare it to other versions of the image to confirm consistency.
We also perform a 4-part digital information test that analyzes camera specifications of the image. This information may include footprints of third party software used to manipulate the digital image, such as Photoshop. Digital integrity verification testing detects malicious editing and tampering.
We also authenticate the images date/time stamp information. Authentication testing may reveal that the date/time stamp information is not accurate under certain circumstances.
We begin all image authentication investigations with a detailed analysis of the original image. This will determine if signs of tampering or other red flags are present. It also allows us to study the images before proceeding to more costly and detailed forensic testing. Our forensic lab is fully automated to complete digital image forensics in an expedited turnaround on large quantities of images.
FILE FORMAT ANALYSIS
The goal of image structure analysis is to authenticate the circumstances around the captured image. Throughout this digital image forensics process, we examine an image’s digital information to determine if it contains similarities or differences with an original image. The original recording produced by the system creates a first generation copy.
Similarly, we perform a 4-part digital information test that analyzes an image’s camera specifications. This information includes footprints of photo editing software used to manipulate the digital image, such as Photoshop. In other words, malicious editing and tampering is detectable through photo tampering detection.
Exemplar comparison of images is also crucial to an investigation. This refers to the comparison of a known image with the unknown sample of evidence. It helps the court understand what a digital original looks like.
In order to create an exemplar accurately, you must determine the equipment (camera) that created the original digital image. You can then obtain access to said equipment and create a test sample for analysis. This is the most accurate way to confirm the authenticity of the digital image if the original evidence is not available.
IMAGE CONTENT ANALYSIS
The image authentication investigation doesn’t stop with the digital structure. We analyze physical aspects of the scene including lighting, scale and composition. We can also analyze photographic conditions, which include focus, depth of field, sharpness, persepctive, gain structure, noise and lens distortion.
For example, cloning or copying physical images results in a loss in quality. In addition, the digital image conversion process detects quality loss when preparing courtroom-ready formats. These formats include JPEG, BMP, TIFF, PDF and many more. Clone detection error levels are highest when images are improperly copied or converted using third party utilities.
If the quality of a digital image is too low due to image compression (jpeg compression), however, it will lack authenticity. In other words, it lacks the necessary criteria to make an accurate identification of a suspect or object. Compression levels, quantization tables, and other tests assist the expert in arriving at a confident conclusion about compression.
EXPERT WITNESS TESTIMONY
In conclusion, an expert can assist the court in determining if a digital image is real or fake using digital image forensics. It is important to help the tier of fact understand the scientific analysis in a simple way.
The experts at Primeau Forensics can generate a formalized report outlining our conditions, authentication methodology, and opinions. This assists the trier of fact to make determinations about the images used as evidence. When we prepare for testimony, we anticipate all possible direct and cross examination questions.
Our image forensic expert, Michael Primeau, has experience testifying as an image expert witness. He has testified in local and state courts across the United States and worked with lawyers around the world.