DIGITAL IMAGE ANALYSIS: ANALYTICAL FRAMEWORK for AUTHENTICATING DIGITAL IMAGES by Scott Dale Anderson B.S., University of Colo
Total Page:16
File Type:pdf, Size:1020Kb
DIGITAL IMAGE ANALYSIS: ANALYTICAL FRAMEWORK FOR AUTHENTICATING DIGITAL IMAGES by Scott Dale Anderson B.S., University of Colorado Denver, 2001 A thesis submitted to the University of Colorado Denver in partial fulfillment of the requirements for the degree of Master of Science Media Forensics 2011 © 2011 by Scott Dale Anderson All rights reserved This thesis for the Master of Science degree by Scott Dale Anderson has been approved by ____________________________________________________ Catalin Grigoras ____________________________________________________ Jeff M. Smith ____________________________________________________ Gregory Walker ____________________________________________________ Richard W. Vorder Bruegge __________________________________ Date Anderson, Scott Dale (M.S., Media Forensics) Digital Image Analysis: Analytical Framework for Authenticating Digital Images Thesis directed by Associate Professor Catalin Grigoras ABSTRACT Due to the widespread availability of image processing software, it has become easier to produce visually convincing image forgeries. To overcome this issue, there has been considerable work in the digital image analysis field to determine forgeries when no visual indications exist. However, while certain manipulation techniques can elude one or more analyses, it may difficult to elude them all. This thesis proposes an analytical framework to help analysts determine the authenticity of digital images by considering the digital file and the image structure. Since statistical models are not possible for all digital image authentication cases, analytical evaluations are sometimes used to determine how observed features in the image structure compare to known characteristics of digital image creation. Chapter 1 explains digital image creation, tasks of an image analyst, and the principles that outline how forensic science is applied to court and the law. Chapter 2 reviews the current literature on digital image forgery detection and how they apply to an image file. Chapter 3 introduces an analytical framework by using case examples to illustrate how this approach can be used to strengthen conclusions when authenticating a digital image. This abstract accurately represents the content of the candidate’s thesis. I recommend its publication. Signed ____________________________________________________ Catalin Grigoras DEDICATION First, I would like to dedicate this thesis to my father, Robert Dale Anderson, who passed away before he could see his son progress on to bigger and better things. He was always a pillar of support and strength, quick to put a smile on your face, and forever loving. Your absence is deeply felt. I would also like to dedicate this thesis to my mother who has continued to love me for as long as I have known and gave me this wonderful gift of life. Last, but certainly not least, I would like to dedicate this thesis to S. C., who has kept me grounded for the past eight years and showed me grace, compassion, love, and beauty, the likes of which I had never imagined possible. Your sacrifice will never go unremembered. I pray you find the peace you seek, and it is worth considerably more than the heavy price that was paid. ACKNOWLEDGEMENT First, I would like to thank GOD, through whom all things are possible. I would like to express my sincerest gratitude to my thesis advisor, Dr. Catalin Grigoras, for his enthusiasm, patience, wisdom and guidance throughout my transition into the world of digital media forensics. He always made himself available to answer any question I had, even if it meant learning Romanian to ask it. The late night master’s sessions were instrumental in a thorough understanding of the subject matter relevant to the field of digital media forensics, and the contents of this thesis. I would also like to thank my thesis committee members for their critique and feedback on a very broad subject. In particular, I would like to thank Richard W. Vorder Bruegge for taking time out of his busy schedule to help ensure that my thesis was thorough, complete, and worthy of his signature. I would also like to thank my mother and grandmother for supporting me during the final years of my education, so that I could concentrate solely on my education. I would like to express gratitude to Mema and my friends for providing support when I needed it most. I could not have done this without each and every one of you. TABLE OF CONTENTS Figures ................................................................................................................................................. x Tables ................................................................................................................................................. xv Chapter 1. Introduction ................................................................................................................................. 1 1.1 Forensic Principles ................................................................................................................. 2 1.2 Digital Photography ............................................................................................................... 5 1.3 Digital Image Analysis ........................................................................................................ 10 1.4 Summary .................................................................................................................................. 15 2. Review of Image Authentication Techniques .............................................................. 16 2.1 File Structure Analyses ...................................................................................................... 18 2.1.1 File Format .......................................................................................................................... 19 2.1.2 Hex Data ............................................................................................................................... 22 2.1.3 EXIF Data.............................................................................................................................. 25 2.1.4 MAC Stamps ........................................................................................................................ 30 2.2 Global Image Structure Analyses ................................................................................... 31 2.2.1 JPEG Compression ............................................................................................................ 32 2.2.2 Interpolation Analysis .................................................................................................... 38 2.2.3 Color Filter Array .............................................................................................................. 42 vii 2.2.4 Quantization Tables ......................................................................................................... 45 2.2.5 DCT Coefficient Analysis ................................................................................................ 49 2.3 Local Image Structure Analyses ..................................................................................... 55 2.3.1 Copy and Paste Detection .............................................................................................. 57 2.3.2 PRNU Comparison ............................................................................................................ 58 2.3.3 JPEG Error Analysis ......................................................................................................... 59 2.4 Source Image Identification ............................................................................................. 63 2.4.1 Sensor Imperfections and Noise ................................................................................. 64 2.4.2 Photo Response Non-Uniformity ................................................................................ 65 2.4.3 Defective Pixels.................................................................................................................. 69 3. Authentication Framework Proposal .............................................................................. 73 3.1 Case Study 1 ........................................................................................................................... 77 3.2 Case Study 2 ........................................................................................................................... 89 3.3 Case Study 3 ......................................................................................................................... 102 4. Conclusion ............................................................................................................................... 115 Appendix A. Hex Data Search Terms ................................................................................................... 121 B. PRNU Validation Study .................................................................................................... 122 C. Case#2 Method of Manipulation .................................................................................. 126 viii D. Case #3 Method of Manipulation ................................................................................ 127 Bibliography ................................................................................................................................. 130 ix LIST OF FIGURES Figure 1 Digital Image Pipeline ...............................................................................................