Get Help Now
    24/7 Support

    Photo Modification Analysis by Digital Forensics – Practical Examples!

    One of the most common digital photo modifications is adding something to the original. But sometimes bad guys need to remove objects from a photo, and digital image forensics often reveals these manipulations. Different graphic editors can help them do it, and a user doesn’t even need experience – many tools work automatically. Even when software can’t perform the modification on its own, countless tutorials online teach offenders how to do it manually. The most common technique for removing unwanted objects is cloning nearby parts of the image. Sometimes cloned fragments must be scaled or have their brightness and contrast adjusted so the altered area matches the main background.

    The main technique used by forensic professionals here is called clone detection.

    Different forgery detection suites contain utilities capable of clone detection. For example, you can use Amped Authenticate [1], or MATLAB Code written in Image and Communication Lab and available publicly.

    Ok, let’s check some practical examples. This one is created by amateur photoshopper:

    1

    One of available clone detection algorithms shows the following result (matched parts are circled in red):

    2

    The other algorithm shows different results, some are false positives (matched parts connected with lines):

    3

    And here is the result of manual visual examination of the digital image (matched parts circled with colour):

    4

    Curious reader can keep playing “find 10 matches” game, and compare his or her results with the original image after [3]:

    5

    To detect forgery it’s enough to find at least one cloned object. Both algorithms have solved the problem. But they couldn’t identify every trace of forgery. What if master of photoshop plays the game?

    To find all problem parts clone detection algorithms must count scaling, rotation, flipping and changing of colour and brightness. As you can see, such algorithm will take a lot of computing resources. So now an examiner shouldn’t forget about the computer system he or she has.

    References:

    1. Amped Software
    2. Copy-Move Forgery Detection and Localization
    3. Rubtsov Mikhail blog

    About the authors:

    Serge Petrov

    Interests: Digital Video Forensics, Forgery Detection, Audio Forensics

    Igor Mikhaylov

    Interests: Computer, Cell Phone & Chip-Off Forensics

    Oleg Skulkin

    Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics



    DISCLAIMER: THIS POST IS FOR INFORMATIONAL PURPOSES ONLY AND IS NOT TO BE CONSIDERED LEGAL ADVICE ON ANY SUBJECT MATTER. DIGITAL FORENSICS CORP. IS NOT A LAWFIRM AND DOES NOT PROVIDE LEGAL ADVICE OR SERVICES. By viewing posts, the reader understands there is no attorney-client relationship, the post should not be used as a substitute for legal advice from a licensed professional attorney, and readers are urged to consult their own legal counsel on any specific legal questions concerning a specific situation.