What is Image Forensics

Image forensics is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters.

Major sub-disciplines of forensic image analysis with law enforcement applications include: Photogrammetry, Photographic Comparison, Content Analysis, and Image Authentication. SWGDE Guidelines for Forensic Image Analysis Ver. 1.0 2017

The following webpage is designed to inform and educate a layperson to the major sub-disciplines of forensic image analysis.

THREE CATEGORIES OF IMAGE FORENSIC SCIENTISTS:

TECHNICIAN

Intake of the evidence, copies and converts media, performs preliminary enhancements and other assessments.

ANALYST

Includes all technician skills, performs photographic comparison, photogrammetry, content analysis and image authentication.

EXPERT WITNESS

Includes all technician and analyst skills, provides consultation with litigators, generates formalized reports, peer/technical review, formulating opinions, evidence recovery.

With the rapid advancements in digital image technology, devices that capture digital images are becoming less expensive, more common and necessary to capture events used as evidence. With surge in DVR (digital video recording) technology, images produced by video recordings may require forensic image analysis when being used in litigation. After all, a digital video is a series of digital images played rapidly.

WHAT TYPES OF RECORDERS CREATE DIGITAL IMAGE EVIDENCE?

DIGITAL IMAGE FORMATS

Digital image evidence is most commonly captured by a digital camera in the following types of formats:

LOSSY FORMAT

Data reduction process that is not completely reversible, and some original data is irretrievably lost. This format is the most common for images obtained from mobile devices, SLR & DSLR cameras, social media and the internet. Lossy formats include but are not limited to JPG, JPEG, HEIC,

LOSSLESS FORMAT

A data reduction process that is completely reversible, such that all of the original data can be retrieved in its original form. Examples include: TIF, GIF, PNG,

IMAGES FROM VIDEO

Video recordings are simply still images played in rapid succession. The human brain interprets continuous movement in a video image because of an illusion called "persistence of vision". Becuase videos contain still images in sequences called GOP's (group of pictures) forensic image analysis is applicable.

COURTROOM READY FORMAT

A copy of the video recording that is easily playable in a court of law using a computer, projection system, or large television.

PROPRIETARY FORMAT

A proprietary format is a file format of a company, organization, or individual that contains data that is ordered and stored according to a particular encoding-scheme. Examples include: PSD, .AI, .CDR

RAW FILE FORMAT

RAW Image Files (.raw, .cr2, .nef, .orf, .sr2, and more)

PRESERVATION OF IMAGE INTEGRITY

The integrity of digital imagery plays an important role in the process of forensic investigation. In the current legal system, there are standards and expectations for proving that digital imagery has been maintained in a forensically sound manner. In the absence of integrity, the evidence may be inadmissible or deemed unreliable. With the preservation of integrity, the evidence is shown as accurate and consistent without requiring testimony from all personnel who had custody of the imagery. Additionally, when the reexamination of imagery is required, integrity provides a method to ensure the original evidence is available and admissible.

The Role of Image Integrity

As digital media technologies allow for image alteration and counterfeiting, having accurate images can be crucial evidence in court. Deep fakes, photo editing and many other practices can misrepresent an event that is critical to an investigation. A thorough examination and trustworthy data on the original image are essential. To address this need, image forensics offers a careful review of relevant photos to provide an unbiased assessment of the evidence.

Forensic experts may analyze digital image data to determine the accuracy of the information in several different circumstances. To determine if an image represents a circumstance or location accurately, experts may assess color level anomalies and landmarks to identify the image’s authenticity or a suspect’s whereabouts. Experts can apply deconvolution to the file to identify a person in the photo if an image includes a blurred or otherwise obscured identity.

Criteria for Image Integrity

Maintaining the integrity of digital media according to rigorous standards is the primary concern of the digital image forensics analysis process. The Scientific Working Group on Digital Evidence (SWGDE) lists best practices that are required to reliably preserve image integrity. Examples include:

File forms at acquisition: The files’ compression for storage, any losses or changes of metadata and documentation at acquisition or generation are vital factors in preserving the images’ integrity.
Protective maintenance: Maintaining appropriate protection for image evidence is also critical — analysts must meet distinct criteria related to its physical security, documentation and encryption.
Methods of analysis: Digital image forensics requires adherence to proper analysis methods to ensure the information is credible in court.

IMAGE FORENSIC DISCIPLINES

PHOTOGRAMMETRY

“Photogrammetry is the art, science, and technology of obtaining reliable information about physical objects and the environment through the processes of recording, measuring, and interpreting photographic images and patterns of electromagnetic radiant energy and other phenomena.” SWGDE Guidelines for Forensic Image Analysis Ver. 1.0 2017

Although photogrammetry has been widely used for engineering and forensic purposes, it is also being made more available for aerial mapping of terrain from drones or aircrafts. In the forensic application, photogrammetry can be extremely helpful when making determinations about a suspect’s height, the measurement of objects within a frame, or estimating vehicle speeds.

PHOTOGRAPHIC COMPARISON

The forensic image comparison investigation is the process of comparing digital images, or digital images extracted from video recordings to determine the probability that the people or objects depicted in these images are the same or different. The forensic image comparison investigation is most accurate when the images or videos are of sufficient quality, and they meet the forensic comparison criteria.

It is considered that the most prolific source of evidence for police investigations is from video recordings. Image forensics tells us that all video recordings are not an accurate medium because digital compression removes information and adds information that wasn’t originally included. It is because of these reasons that a forensic image analyst must be able to interpret the images and video recording in order to present the events as they occurred and compare these and analyze the results.

Because of the unreliability of images and video presented as evidence, a forensic image analyst must also be able to qualify the events to ensure that the people or objects presented has sufficient detail and pixel information for an accurate forensic image comparison investigation. In some cases, when the objects or people displayed are not clear, we perform a forensic video enhancement in order to see the details of the images more clearly for an accurate comparison.

IMAGE CONTENT ANALYSIS

The process of drawing conclusions about an image. Targets for content analysis include, but are not limited to, the subjects/objects within an image; the conditions under which, or the process by which, the image was captured or created; the physical aspects of the scene (e.g., lighting or composition); and/or the origin of the image. SWGDE Best Practices for Image Content Analysis Ver. 1.0 2017

IMAGE CLARIFICATION/ENHANCEMENT

The objective of forensic image enhancement is to clarify or enhance the events as they occurred. This is done using non-destructive techniques to preserve the video evidence integrity and pixel quality. Clarifying or enhancing the events as they occurred assists the trier of fact in weighing the video evidence and its relevance to the litigation.

As image forensic experts, we are often asked to enhance CCTV surveillance video recordings for court. We are also asked to provide video image enhancement for identification purposes. We create customized filtering to sharpen the video image and remove video noise for identification and enhancement of the images in the surveillance video.

Below are some of the most popular clarification and enhancement techniques that can be applied to an investigation.

Scaling/Pixel Interpolation: Re-size, or scale an image or video to a larger resolution to further identify suspects.
Sharpening: Enhances the edge contrast of an image or video.
Shadow and Highlight Adjustments (Exposure): Reveals subtle detail in the shadow and/or highlight areas of your images.
Frame Averaging: Increase the quality of the image by combining data from surrounding frames as well as a better signal to noise ratio (SNR) in your images or videos.
Pixel Aspect Ratio Calibration: Adjusting the ratio that describes how the width of a pixel in a digital image compares to the height of that pixel
White Balance Correction: Color corrective process that adjusts the color of an image by establishing a value of white in relation to natural light color temperature.
Color Correction: Color corrective process that adjusts the exposure, contrast, saturation and sharpenes of an image to improve the authenticity of the events as they were originally captured.

Forensic enhancement and analysis tools include software and hardware that are implemented and used on a powerful desktop computer. Methods applied to this scientific examination must be executed in a systematic and accurate nature. Our image forensics services are sought after by law enforcement agencies, attorneys, and government agencies. Opinions and conclusions drawn by the video forensic expert must follow best practices. A forensic report is created on completion that exhibits all activity performed in the lab as well as forensic processes performed. In that case, any other qualified image forensic expert can follow our steps multiple times and establish the same conclusions and opinions. Our image forensic processes are executed with the utmost accuracy as we testify in court on our opinions and conclusions.

IMAGE AUTHENTICATION

Image authentication is the process of substantiation that the data is an accurate representation of what it purports to be. Authentication can be performed by the person harvesting the data through first-hand knowledge, or by an examiner in the lab. The criteria for image authentication usually involve the interpretability of the data and not simple format changes that do not alter the meaning or content of the data.

Examples include:

Determining the degradation of a transmitted image;
Evaluating the degree of information loss in an image saved using lossy compression.
Determining whether an image contains feature-based modifications such as the addition
or removal of elements in the image (e.g., adding bruises to a face).

SWGDE Guidelines for Forensic Image Analysis Ver. 1.0 2017

Why Trust a Professional for Image Forensics?

In an era of deep fakes and advanced image editing techniques, ascertaining an image file’s reliability can be critical for an investigation. To ensure accuracy, an investigation in which images play a key role must include an experienced digital image forensics professional.

In many cases, image forensics may be an essential part of the evidence to reveal the truth, and credible field expertise is necessary to assess it. An investigation may rely on a digital image forensics professional to conduct analysis and identify photo editing or manipulation of image files — signs that may be impossible to notice without professional expertise and analytical equipment.

Accurately analyzing and interpreting the evidence requires field experience and an expert understanding of forensics methodologies. It is essential that a professional examine the evidence objectively while meeting the rigorous scientific standards for methodology and analysis. The analyst must present carefully examined, credible data to uphold the highest scientific standards and be trustworthy in a court of law.

EXPERT WITNESS TESTIMONY

An image forensic expert has the scientific knowledge, training, and expertise necessary to enhance and authenticate images that are being used in a criminal or civil court case. The expert witness has previous courtroom experience testifying and helps the trier of fact understand the image evidence that is offered in litigation.

An expert witness is crucial to offer an in-depth understanding of the evidence and the qualifications to present the information accurately in court. The testimony provides an objective, scientific analysis of the evidence as it pertains to the case.

CONTACT PRIMEAU FORENSIC FOR IMAGE FORENSIC SERVICES

For more than 35 years, Primeau Forensics has provided expert image forensic services to litigators, law enforcement agencies and the U.S. government. We have extensive experience investigating evidence from hundreds of cases, and we continue our commitment to our standards of investigative integrity today.

Primeau Forensics is a team of experts who seek to find the truth through rigorous scientific investigations. Our goal is to help our clients answer complex questions about audio, visual and video evidence. We provide thorough analysis and expert testimony that you can count on to hold up in court. Contact us today to learn more about our services.