Image Forensics

Can we trust what we see?Search on YouTubeBookmarkSaved

Digital images are no longer reliable evidence by default.

• Editing software is easy to get, so forgery has become widespread.
• An altered image is hard to spot with the eye.
• Multimedia forensics can detect signs of tampering: removal of objects, addition of objects, or other alterations.

The deck opens with two photos of the same event. One has been edited. Both look natural, which is the point: visual inspection is not enough.

Types of forgerySearch on YouTubeBookmarkSaved

The deck names three classic forgeries and adds AI-generated images.

Image forensicsSearch on YouTubeBookmarkSaved

Image forensics is a field within digital forensics. It examines and analyses digital images to determine their authenticity, origin and history.

The deck lists six investigative approaches:

1. Metadata analysis
2. Error level analysis (ELA)
3. Statistical analysis
4. Key point based matching
5. PRNU based detection
6. Shadow analysis

Metadata analysisSearch on YouTubeBookmarkSaved

Metadata is hidden information embedded in a digital image. It gives insight into the image's characteristics and history.

Types of metadataSearch on YouTubeBookmarkSaved

EXIF tells you about the image's origin and creation. IPTC and XMP can reveal modifications made over time.

Sample metadataSearch on YouTubeBookmarkSaved

The deck shows exiftool output for a JPEG. Run the same command in the lab:

exiftool IMG001022.JPG            # print all metadata tags
exiftool -a -G1 IMG001022.JPG     # show duplicate tags and the group (EXIF, XMP, IPTC) of each
exiftool -gps:all IMG001022.JPG   # print only the GPS tags

The slide output includes: MIME type image/jpeg, JFIF version 1.1, Make Hewlett-Packard, Camera Model HP PhotoSmart 618, Orientation Horizontal (normal), X/Y resolution 72, Exposure Time 1/125, F Number 3.7, ISO 100, EXIF version 0210, Date/Time Original 2007:05:28 09:19:49, Shutter Speed Value 1/128, Aperture Value 4.0, Subject Distance 0.13 m.

What the findings can showSearch on YouTubeBookmarkSaved

• Conflicting timestamps or GPS coordinates. These can indicate tampering or manipulation.
• Timestamps and GPS coordinates can be cross-verified with web resources. This feeds shadow analysis (sun position at that place and time).
• Missing or altered fields, such as modified camera settings.

ChallengesSearch on YouTubeBookmarkSaved

• Malicious actors can strip the metadata. Images sent through WhatsApp have no metadata, because it is stripped to ease transmission.
• The device can record the geo-location inaccurately, or an attacker can spoof it.
• Time zone differences caused by camera settings.

Best practicesSearch on YouTubeBookmarkSaved

• Always verify metadata together with other forensic techniques.
• Cross-reference metadata with other sources, such as witness statements or other image analysis tools.

Error level analysis (ELA)Search on YouTubeBookmarkSaved

Working principleSearch on YouTubeBookmarkSaved

When an image is saved and compressed several times, the altered or manipulated areas show different levels of compression artifacts from the pixels around them.

How it worksSearch on YouTubeBookmarkSaved

Re-save the image at a known JPEG quality level. Subtract the re-saved image from the original. The result highlights differences in compression level, so manipulated areas stand out.

Identifying tamperingSearch on YouTubeBookmarkSaved

Manipulated areas, such as cloned regions or added objects, often show higher error levels than the authentic parts. These discrepancies point to possible tampering.

Steps in ELASearch on YouTubeBookmarkSaved

1. Load the original image.
2. Apply different levels of compression.
3. Calculate the error between the compressed images.
4. Normalize the error image.
5. Visualize.

from PIL import Image, ImageChops, ImageEnhance

orig = Image.open("suspect.jpg").convert("RGB")
orig.save("resaved.jpg", quality=90)               # step 2: re-save at a known quality
resaved = Image.open("resaved.jpg")
ela = ImageChops.difference(orig, resaved)         # step 3: per-pixel error
max_diff = max(hi for lo, hi in ela.getextrema()) or 1
ela = ImageEnhance.Brightness(ela).enhance(255.0 / max_diff)   # step 4: normalize
ela.save("ela.png")                                # step 5: view it

Reading the deck's ELA samplesSearch on YouTubeBookmarkSaved

Key point based matchingSearch on YouTubeBookmarkSaved

The algorithm finds keypoints: distinctive features such as corners, edges or blobs. Keypoints stay fairly stable under scaling, rotation and illumination changes. Popular detectors:

• SIFT (Scale-Invariant Feature Transform)
• SURF (Speeded Up Robust Features)

How it detects copied regionsSearch on YouTubeBookmarkSaved

1. Find distinctive keypoints that are stable under rotation, scaling and lighting changes.
2. Build a descriptor for each keypoint's surrounding area, like a fingerprint.
3. Compare the descriptors across the same image.
4. Matches between keypoints in odd locations suggest copied regions.
5. Analyse these matches to identify tampering.

This makes keypoint matching the main tool for copy-move forgery detection. The deck's clone samples (sheep, pugs, campus road) show matched lines joining the original and the copy.

SIFT versus SURFSearch on YouTubeBookmarkSaved

PRNU based detectionSearch on YouTubeBookmarkSaved

Multimedia forensics can identify the source of an image or video. PRNU is the most common metric for source identification.

PRNU (Photo Response Non-Uniformity) is the inherent sensor noise pattern present in every image a digital camera captures. It comes from slight variations in the sensitivity of individual pixels on the sensor. These variations are microscopic and unique to each camera, so they act as a digital fingerprint.

PRNU stepsSearch on YouTubeBookmarkSaved

1. Preprocessing. Convert the image to grayscale. PRNU analysis is usually done on grayscale images.
2. Generate a noise reference image. Take a set of images from the same camera under uniform illumination. Average them to create a noise reference image.
3. Extract the noise pattern. Subtract the noise reference image from the original image to get the sensor noise.
4. Filtering. Apply a spatial filter or denoising technique. This enhances the PRNU and suppresses other noise.
5. Normalization. Adjust intensity levels so patterns are consistent across images.
6. PRNU estimation. Calculate the PRNU from the statistics of the noise pattern (mean, variance) across regions.
7. Verification. Compare the estimate with known PRNU patterns, or use it for authentication and tamper detection.

The PRNU slide diagram: images $I_k$ from a camera give noise residuals $W_k$. These combine into the camera fingerprint $\hat{K}$. A test image $I$ gives its own residual $W$. The correlation between $W$ and $\hat{K}$ decides match (tick) or no match (cross).

The deck's sample patterns: a Canon PRNU estimated from 100 samples and a Nikon PRNU from 39 samples. The two look clearly different.

AdvantagesSearch on YouTubeBookmarkSaved

• Shows whether an image comes from a trustworthy source (the claimed camera).
• Shows whether the image is computer generated or not.
• Splicing detection: a pasted region lacks the camera's PRNU, so its local correlation drops.

LimitationsSearch on YouTubeBookmarkSaved

• An accurate PRNU needs a set of authentic images from the same camera under different (controlled) lighting.
• Accuracy depends on the quality and quantity of available images.
• PRNU should be combined with other statistical techniques, such as histograms, for accuracy and robustness.

Statistical analysisSearch on YouTubeBookmarkSaved

Natural images follow statistical patterns in pixel values, noise and correlations. Tampering disturbs these patterns and leaves detectable inconsistencies.

Key approaches:

• Histogram analysis: RGB intensity distributions.
• First- and second-order statistics: mean, variance, correlation.
• Noise pattern analysis: sensor noise mismatch.
• Block-based statistics: JPEG DCT inconsistencies.
• Colour channel correlation.
• Frequency domain statistics: Fourier and wavelet features.

The deck shows red, green and blue histograms for two images (the shark composite and the sunset). Gaps, spikes or comb patterns in a histogram suggest editing such as contrast stretching or splicing.

Shadow analysisSearch on YouTubeBookmarkSaved

Shadows must agree with the light source.

• Outdoors: the sun's azimuth and elevation at a given place and time are known. Use SunEarthTools (https://www.sunearthtools.com/dp/tools/pos_sun.php) to find the sun position for the GPS location and timestamp in the metadata. Check that shadow directions and lengths match. The deck asks you to verify that a sunset photo was taken at the location its metadata claims.
• Indoors or in a scene: draw lines from points on each shadow through the matching points on the objects. For one light source, all lines meet at the light. A spliced object gives a line that misses this point (the cone and table-top examples).

DeepfakesSearch on YouTubeBookmarkSaved

CreationSearch on YouTubeBookmarkSaved

The deck's diagram shows the standard face-swap setup:

• Training: one shared encoder learns common face features. Decoder A learns to rebuild face A. Decoder B learns to rebuild face B.
• Generation: encode a frame of face A, then decode it with decoder B. The output shows person B with A's expression and pose.

DetectionSearch on YouTubeBookmarkSaved

• Facial recognition and analysis
• Behavioural and movement analysis
• Audio analysis
• Consistency and context checks
• Detection by eye blinking (early deepfakes blinked unnaturally or not at all)

As creators refine deepfakes, detection tools must keep evolving.

Choosing the techniqueSearch on YouTubeBookmarkSaved

Quick self-testSearch on YouTubeBookmarkSaved