Title: DIGITAL IMAGE FORENSICS

Digital Image Forensics

Thomas Gloe, Matthias Kirchner (TU Dresden) 

In our multimedia society, digital images play an important role. The advent of low-cost digital imaging devices as well as powerful and sophisticated editing software gives rise to a wide use of digital images in all areas of our everyday life. Notably, the internet allows a fast distribution of digital image material. In the context of forensic profiling, a digital image may reveal information about the image acquisition device used and, consequently, give a link to a single person or a group of persons who probably took the picture. Furthermore, the question whether a digital image shows an original and unaltered scene or whether it was tampered with subsequent to its generation is of high importance, e.g., when analysing images of surveillance cameras. Both, the question of image source identification and the question of securing an image’s integrity, are subsumed by the concept of image authenticity.  

Several approaches to address these questions have been proposed, e.g., digital signatures or digital watermarking. Nevertheless, it is important to note that both digital signatures and digital watermarks have to be generated directly in the imaging device since at a later point the image’s authenticity can no longer be guaranteed. In contrast, methods with come under the relatively new concept of digital image forensics basically rely on particular statistical features, which can be understood as a “natural” and inherent watermark. Consequently, digital image forensics does not require any prior knowledge of the original image.

According to the above-mentioned issues, the area of digital image forensics can be broadly divided into two branches. The first problem linked to digital image forensics is image source identification, which is based on specific characteristics of the image acquisition device or technology. The second field of application is to determine whether a specific digital image has undergone malicious post-processing or tampering. Forensic algorithms of this type are designed to unveil either characteristic traces of image processing operations, or to verify the integrity of particular features introduced in a typical image acquisition process.

To obtain the goals, digital image forensic techniques exploit either device specific characteristics introduced during the image acquisition process or manipulation artefacts introduced during image processing. Additionally, meta information included in an image file, like the date of exposure or the name of the camera model, could be part of a forensic analysis. In contrast to device specific characteristics or manipulation artefacts, meta information can however be easily modified or deleted with easily available image processing toolboxes.  

Figure 4 illustrates the origin of device specific characteristics in the simplified model of a digital camera. Starting with the lens, characteristics like chromatic aberration (Johnson 2006) and radial lens distortion (Choi 2006) are introduced. Chromatic aberration for example is the result of the lens’ incapability to refract light of different wavelengths to the same point at the sensor and becomes visible as coloured artefacts especially on edges and straight lines. Further characteristics are introduced by the sensor, namely, sensor defects and sensor noise. Due to minor inaccuracies during the manufacturing process, these characteristics are unique for each sensor and, therefore, enable not only the separation between different devices but also the determination of a unique imaging sensor. Dependencies between adjacent pixels due to the need of colour interpolation (Popescu 2005) and differences in JPEG compression (Farid 2006) form other typical ingredients for forensic methods. The occurrence of such device specific characteristics in an image under investigation can be estimated to extract information about the source device and, furthermore, can be tested for integrity to detect image manipulations. However, it is also possible to consider the whole image acquisition process as a black box and analyse the device response function (Lin 2005) or macroscopic features of acquired images (Kharazzi 2004).

Figure 4: Origin of device specific characteristics in a simplified digital camera model

Contrary to techniques which rely on device specific characteristics, forensic methods based on manipulation artefacts are applicable without knowledge of the digitisation device used. For example, it is possible to reveal pixel dependencies introduced during resizing or rotation of images (Popescu 2005). Other methods used are, for example, statistics of JPEG coefficients to detect recompression (Lukas 2003), inconsistencies in lighting to detect copy forgeries (Johnson 2005), or analysis of phase congruency to detect image splicing (Chen 2007). 

It is important to note that in the existing body of literature there is a lack of rigorous discussion of robustness against strategic counterfeiters who anticipate the existence of forensic techniques. As a result, the question of trustworthiness of digital image forensics arises. Forensic methods might benefit from research on countermeasures in a similar way as reasoning about attacks in multimedia security in general is useful to improve security. In this sense, attacks on image forensic algorithms can be understood as schemes to systematically mislead the detection methods. In general, such attacks can be assigned to one of the following three objectives: the camouflage of malicious post-processing or tampering of an image, the suppression of correct image origin identification, and furthermore, the forgery of image origin. Initial investigations on attacks against both a source identification scheme (based on sensor noise) and a manipulation detector (based on resampling artefacts) showed that it is in general possible to achieve these goals by spoofing the specific characteristics used (Gloe 2007).

Consequently, current forensic methods, which doubtlessly show very promising results, should be further investigated and extended to be able to cope with, or at least be sensitive to attacks. Although in the future it might be possible to generate digital signatures or digital watermarks directly during the image acquisition inside the device, digital image forensics will still form an important building block for the authentication of digital images as it allows a highly practicable analysis of digital images with in general no limiting technical constraints.