Daily Bulletin

The Conversation

  • Written by Richard Matthews, PhD Candidate, University of Adelaide

For as long as humans have been making images, we have also been manipulating them.

Complex darkroom techniques were once required to modify images but now anyone with a smartphone can apply hundreds of changes using freely available tools.

While this may be convenient for your Instagram feed, it presents a unique challenge for law enforcement. Images cannot always be trusted as an accurate depiction of what occurred.

For example, I recently analysed several photos for the RSPCA showing a duck with a knife embedded in its head to determine if they were photoshopped.

Authorities are increasingly asking images to be verified by forensic experts, but how is this done and where is it headed?

The image pipeline

Analysts currently rely on knowledge of the “image pipeline” to inspect and validate images.

This pipeline is often broken down into six key areas:

  1. Physics: shadows, lighting and reflections
  2. Geometry: vanishing points, distances within the image and 3D models
  3. Optical: lens distortion or aberrations
  4. Image Sensor: fixed pattern noise and colour filter defects
  5. File format: metadata, file compression, thumbnails and markers
  6. Pixel: scaling, cropping, cloned or resaving
image The image pipeline with each section numerically allocated based on features that investigators are likely to analyse. Richard Matthews, Author provided

It is often the unseen that begins our investigation rather than the seen. Here we’ll be focusing on the metadata captured in images (level 5 in the schema above).

File format forensics: metadata

When an image is saved, the file typically contains data about the image, known as metadata.

There are more than 460 metadata tags within the exchangeable image file format for digital still cameras (EXIF 2.3). This specification helps cameras use formats that can be exchanged between devices – for example, ensuring an iPhone photo appears correctly on a Samsung device.

Tags can include image size, location data, a smaller thumbnail of the image and even the make and model of the camera.

Determining which camera took what photo

In a recent investigation, we were able to validate a group of images known as the Byethorne duck.

The images supplied by the RSPCA to The Advertiser showed a duck with a knife impaled into its head. Accusations soon emerged that the image was photoshopped.

image Images of the Byethorne Duck supplied to the RSPCA. RSPCA, Author provided (No reuse)

We inspected the images using Phil Harvey’s ExifTool and were able to determine that four of the images (left above) were taken by one camera, with the remainder taken by another.

This was verified using sensor pattern noise and statistical methods. We extracted a unique fingerprint from each image using signal processing filters and compared how similar they were to each another.

A high value indicates they are very similar and probably correlated, while a low value indicates that they are dissimilar and unlikely to be correlated.

When we compared four of the five image fingerprints, we obtained values well above 2,000. Given they’re correlated, we can say the images likely came from the same camera.

When we tested the fifth image, the similarity value we obtained was close to zero.

image Metadata of one of the images from the left above and the image from the right. These show two separate unique image identifiers which were correlated to a phone camera firmware. Richard Matthews, Author provided

The unique image ID field also contained the camera firmware number. By cross referencing with image and sensor size also contained in the metadata, we suggested that either a Samsung Galaxy S7 or S7 Edge was used to capture the first four images and a Samsung Galaxy S5 was used to capture the fifth.

The time the images were taken was also shown in the metadata, allowing a timeline of when the images were taken and by who to emerge.

image Time the photos were taken and by which camera. Richard Matthews, Author provided

Since the photos were taken by two different cameras across the span of around one hour, it is highly unlikely the images were fake.

An RSPCA spokesperson confirmed it received images of the duck from two separate people, which aligns with these findings. To date, there has been insufficient evidence to determine the identity of a perpetrator.

Finding a person’s location from an image

The camera model isn’t the only thing that can be obtained from metadata.

image A selection of books on the author’s desk. Richard Matthews, Author provided

We can see where my office is located by analysing this image of books taken at my desk.

image Metadata viewed in ExifTool for the bookshelf image. Richard Matthews, Author provided

The GPS coordinates are embedded directly in the image metadata. By placing these coordinates into Google Maps, the exact location of my office is displayed.

image The precise location of Richard’s office at the University of Adelaide is discovered using the metadata contained within the bookshelf photo. Richard Matthews, Author provided

This obvious privacy concern is why Facebook, for example, typically removes metadata from uploaded images.

According to a Facebook spokesperson, information including GPS data is automatically removed from photos uploaded onto the platform to protect people “from accidentally sharing private information, such as their location”.

The future of image forensics

Metadata is never used in isolation.

Authenticating an image to ensure it hasn’t been modified and upholding the chain of custody – the paper trail or provenance documentation that goes along with a piece of evidence – is increasingly important to police.

In the future, tools to assist police with this could include audit logs built directly into the camera, or the insertion of a watermark.

I am currently expanding on previous research that suggests each image sensor (the electronic device that actually takes the image) has a unique fingerprint due to the way it reacts non-uniformly to light.

Next time you take a photo, just think about the story it could tell.

But what happened to the duck? A spokesperson at the RSPCA said:

We believe the knife may have dislodged shortly after the photos were taken. A duck believed to be the same duck in the photograph has been viewed swimming and behaving normally in the days after giving us the belief that the knife did not penetrate deeply enough to cause significant injury.

Authors: Richard Matthews, PhD Candidate, University of Adelaide

Read more http://theconversation.com/explainer-how-law-enforcement-decodes-your-photos-78828

Writers Wanted

Victoria and NSW are funding extra tutors to help struggling students. Here's what parents need to know about the schemes


The mystery of the blue flower: nature's rare colour owes its existence to bee vision


Curb population growth to tackle climate change: now that's a tough ask


The Conversation


Ray Hadley's interview with Scott Morrison

RAY HADLEY: Prime Minister, good morning.    PRIME MINISTER: G’day Ray.   HADLEY: I was just referring to this story from the Courier Mail, which you’ve probably caught up with today about t...

Ray Hadley & Scott Morrison - avatar Ray Hadley & Scott Morrison

Prime Minister's Remarks to Joint Party Room

PRIME MINISTER: Well, it is great to be back in the party room, the joint party room. It’s great to have everybody back here. It’s great to officially welcome Garth who joins us. Welcome, Garth...

Scott Morrison - avatar Scott Morrison

Prime Minister Interview with Ben Fordham, 2GB

BEN FORDHAM: Scott Morrison, good morning to you.    PRIME MINISTER: Good morning, Ben. How are you?    FORDHAM: Good. How many days have you got to go?   PRIME MINISTER: I've got another we...

Scott Morrison - avatar Scott Morrison

Business News

Tips to find the best plastic manufacturing supplier for your needs

Plastics are very much an important part of all of our lives, but they’re particularly valuable to a wide variety of industries that rely on their production for their operations. The industries, ...

News Co - avatar News Co

7 foolproof tips for bidding successfully at a property auction

Auctions can be beneficial for prospective buyers, as they are transparent and fair. If you reach the limit you are willing to pay, you can simply walk away. Another benefit of an auction is tha...

Dominique Grubisa - avatar Dominique Grubisa

Getting Ready to Code? These Popular and Easy Programming Languages Can Get You Started

According to HOLP (History Encyclopedia of Programing Languages), there are more than 8,000 programming languages, some dating as far back as the 18th century. Although there might be as many pr...

News Co - avatar News Co

News Co Media Group

Content & Technology Connecting Global Audiences

More Information - Less Opinion