Attack of the Clones

One of the most common digital photo modifications is adding something to the original. But sometimes bad guys need to remove objects from a photo. And different graphic editors can help them with it. A user can even don’t have any experience of using them – everything can be done automatically. Even if a piece of such software can’t do modification automatically, there are lots of tutorials in the Web that can help our bad guys to do it manually. The most common technique for removing unwanted objects is cloning parts of the image near it. Sometimes cloned fragments need to be scaled or or their brightness and contrast need to be modified in order cloned object to match the main background.

The main technique used by forensic professionals here is called clone detection.

Different forgery detection suites contain utilities capable of clone detection. For example, you can use Amped Authenticate [1], or MATLAB Code written in Image and Communication Lab and available publicly.

Ok, let’s check some practical examples. This one is created by amateur photoshopper:

One of available clone detection algorithms shows the following result (matched parts are circled in red):

The other algorithm shows different results, some are false positives (matched parts connected with lines):

And here is the result of manual visual examination of the digital image (matched parts circled with colour):

Curious reader can keep playing “find 10 matches” game, and compare his or her results with the original image after [3]:

To detect forgery it’s enough to find at least one cloned object. Both algorithms have solved the problem. But they couldn’t identify every trace of forgery. What if master of photoshop plays the game?

To find all problem parts clone detection algorithms must count scaling, rotation, flipping and changing of colour and brightness. As you can see, such algorithm will take a lot of computing resources. So now an examiner shouldn’t forget about the computer system he or she has.

References:

1. Amped Software
2. Copy-Move Forgery Detection and Localization
3. Rubtsov Mikhail blog

About the authors:

Serge Petrov

Interests: Digital Video Forensics, Forgery Detection, Audio Forensics

Igor Mikhaylov

Interests: Computer, Cell Phone & Chip-Off Forensics

Oleg Skulkin

Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics