Digital Image Forensics

[Ipsy]

_{(I moved this here from where I originally posted it after realizing the "images resource from JTP" thread was probably the wrong place for it.)}

I've been reading this paper (www.cs.dartmouth.edu/farid/publications/apthesis05.pdf) posted on the website of Hany Farid, a member of Dartmouth College Computer Science Department and an expert in digital image forensics.

The paper discusses approaches to image analysis based on a statistically detectable feature of images from digital camera CCDs. Due to the arrangement of red, green and blue color filters on a ccd, there are twice as many green as there are red or blue. The image pixels must be interpolated from the ccd captured data by a process called "demosaicing." (http://electronics.howstuffworks.com/digital-camera5.htm) Since the arrangement of pixels on the ccd is not equal between red, green, and blue, the pixels created by demosaicing exhibit a mathematical relationship to one another.

This technique involves a first step of identifying the relationships between pixels by creating a probability map. When Fourier transformation is applied to the probability map, an authentic image yields a non-periodic Fourier transform map. Any manipulation at all results in a periodic Fourier transform map displaying dots, or peaks around the center of the map.

This looks like an incredibly revealing technique. A drone photo passing this test would almost have to prove a 99.999% chance of being real. Since it's now a fact the the Raj location is real, and the photos show a real telephone pole, we know the pole is not CGI. If the drone in the raj photos is not a real object, then the image would have to have been manipulated, which would be detectable with this technique.

Take a look at Figure 3.7 (page 63) in the PDF referenced above for an example of what the results of this test would look like. By performing this test on different areas of the photo, it's very clear where the image has been tampered with.

I would love to see the results of this analysis on the raj photos. It would provide almost indisputable proof of authenticity.

[Ipsy]

BUMP.

Any thoughts?

[algae]

BUMP.

Any thoughts?

BUMP? As in "bring up my post?" 

One thing that occurred to me is that Farid's student, Alin C. Popescu, the author of the paper, might be able and willing to do some of the drone photo analysis that Farid himself won't. Try contacting Popescu; at the very least you'll earn a karma point or two!

algae

[Ipsy]

Good idea ...and so obvious!

I will attempt to contact Alin Popescu and begin a dialog. Perhaps he can analyze a couple photos. I will post back to this thread when I get in touch with him.

[Ipsy]

I wasn't able to get in touch with Mr. Popescu, but I have been corresponding with Professor Farid. He does consulting work for digital forensic cases. He was already familiar with the drone photos, but has not analyzed them. He seemed to take the matter seriously, but did not offer an opinion. He did give me an estimate of his fee for forensic analysis, but I'm afraid the cost will exceed the budget of the investigative team.

I've read the papers that he has published on the topic of forensic examination of digital images. The math is over my head, but I understand the principals that it is based on. I honestly believe the techniques described would put an end to the CGI debate. A thorough analysis Professor Farid, would likely produce a very clear yes or not on authenticity of the photos. Results that could stand up in court.

[algae]

I've been reading this paper (www.cs.dartmouth.edu/farid/publications/apthesis05.pdf) posted on the website of Hany Farid, a member of Dartmouth College Computer Science Department and an expert in digital image forensics.

The paper discusses approaches to image analysis based on a statistically detectable feature of images from digital camera CCDs...

Popescu calls those "Manipulated CFA Images," and that technique could be useful for detecting altered camera photos. But there's way more. He's got techniques for detecting:
      Resampled Images (evidence of cut-and-paste)
      Double JPEG Compression (evidence of photoshopping)
      Duplicated Image Regions (use of cloning tool)
      Inconsistent Noise Patterns (splice boundary detection)
There's a total of five powerful methods for detecting tampering, and he has spelled it all out for us! (Except for the code ).

Elevenaugust or Onthefence should be able to say whether these techniques could be adopted. If so, we ourselves would be able to apply them to the photos.

[onthefence]

Elevenaugust or Onthefence should be able to say whether these techniques could be adopted. If so, we ourselves would be able to apply them to the photos.

Don't wait for me

[algae]

Don't wait for me

Actually, I was thinking that the perfect candidate for the work would be an avowed skeptic with access to Mathcad. Does this description fit anyone we know?

[algae]

The math is over my head, but I understand the principals that it is based on.

It's not that the math is difficult, but it is terse and formal, as befits a PhD thesis paper (He uses the word "quincunx," fer chrisakes). Luckily for the interested, Popescu has provided a step-by-step algorithm, almost metacode, for the CFA technique:
http://home.comcast.net/~algae/CFA Procedure.jpg

I believe the reason you're not getting more support from the forum members on this subject is that they have been down this road before. Check the OMF Drone threads, and you will be as amazed as I am at the analyses they did in 2007. I've just spent five weeks reading about 29000 drone posts there, and my eyes are still bleeding.

As recent dronies, it's our job to entertain the old folks until something new comes along. A new photo analysis would qualify, so PM me if you need help with the math. Again, someone with access to Mathcad would be a big help here.

algae

[Ipsy]

Yeah, I was thinking this too. Someone within this community with the time, and skills, could just take the formula's from his paper and perform this analysis themselves.

I don't know Mathcad, but I enjoy programming, and if I had time, I would love to tackle this project. I think I could trudge through the math and eventually come up with the software tools to do this analysis. Free time is just something I have very little of.

If I'm completely honest with myself about it, I believe the odds of the photos being real is pretty slim. But I can't shake the gut feeling that they are real. The CFA, and Resampled Images techniques appear to me, at least, to be extremely telling. Don't you think an analysis with these techniques would almost HAVE to prove or disprove the authenticity of the photos?

[algae]

Yeah, I was thinking this too. Someone within this community with the time, and skills, could just take the formula's from his paper and perform this analysis themselves.

Not just our community. Forensics, even commerce, could benefit from tamper-detection software. Thanks to Farid and Popescu it'll be a windows app soon! (IMO. The idea has to percolate for a while).

[nekitamo]

Interesting source, thanks!

We already mentioned one other rich source of digital forensics literature in this forum, but perhaps too obscurely - here it is again, if someone's interested:
http://www.ws.binghamton.edu/fridrich/publications.html

[algae]

I wasn't able to get in touch with Mr. Popescu...

Dartmouth has him working for Renesys Corp R&D in Hanover, NH, so he's probably out of reach. Looks like we're on our own here.

(Edit to add) Sorry, I don't mean "Mathcad," I mean "Matlab." It has built-in functions for matrix math and add-ons for photo analysis. It costs about $60 for students but $500 for the rest of us.

[algae]

Haven't checked this out, but the price is right: http://www.izitru.com/

[onthefence]

Haven't checked this out, but the price is right: http://www.izitru.com/

Thanks.

I just tried the PICT0016.jpg Raj image in a Steven/Jenna image, and one Canon EOS image from the web.
The drone images produced this result:
Result: Potential file modification
Reason: Our forensic tests suggest this file has been re-saved since initial capture. Because this file is not a camera original, it is possible that it was modified.

The Canon image from some other person showed "High Trust".

My conclusion: All images from the drone case have been modified unnecessarily even the Jenna-submitted Stephen image which was submitted as a camera original.