TECHNICAL DOCUMENTATION NEED HELP? Call us on +44 (0) 121 231 3215 TABLE OF CONTENTS Document Control and Authority.........................................................................................3 Introduction.........................................................................................................................4 Camera Image Creation Pipeline........................................................................................5 Photo Metadata........................................................................................................6 Sensor Identification Technology........................................................................................7 Extraction of Sensor Fingerprint..............................................................................7 Forensic Image Identifier.....................................................................................................9 Device Reference Fingerprint.................................................................................10 Forensic Image Classifier..................................................................................................11 Process Flow for FIA.........................................................................................................12 FIA Project..............................................................................................................12 Default Values for ‘Advanced Options....................................................................13 Types of Images Supported....................................................................................14 Quality of Images....................................................................................................14 Operational Computation..................................................................................................16 SPN Fingerprint Extraction....................................................................................16 Identifier Processing...............................................................................................16 Classifier Processing.............................................................................................17 Appendix A.........................................................................................................................18 AppendixB..........................................................................................................................19 Company Overview.............................................................................................................20 PAGE 2 DOCUMENT CONTROL AND AUTHORITY Approved By FPL Board of Directors Authorised Signatory/Company Officer: ________________________________________ Circulation Date: 05 February 2016 Version Number: v1.05 INTRODUCTION Forensic Pathways has undertaken research to develop a technique for assisting in establishing whether a particular digital image had been produced by a particular camera, camcorder or mobile phone. The outcome of this work is the Forensic Image Analyser (FIA) application, which is a system that performs source imaging device identification. FIA can extract the digital fingerprint of digital photos, using image sensor identification technology, and link them to the camera that took these photos. There are two sections to FIA: 1. Forensic Image Identifier • Creates a camera reference fingerprint • Performs matching of digital photos against the camera reference fingerprint 2. Forensic Image Classifier • Groups a set of photos according to the respective cameras that created these photos The imaging devices that are supported by FIA are: • Digital cameras • Mobile (Cell) phones, smart phones with inbuilt cameras • Tablets with inbuilt cameras • Camcorders The list above is not exhaustive, FIA supports any device that creates digital photos using a camera. FIA supports the two main file formats for digital photographs namely TIFF and JPEG format. If the image is in RAW format, it will need to be converted to either JPEG or TIFF format. The FIA is a Windows based application which runs on Windows 7, Windows 8.X and Windows 10 in 32/64 bit. The minimum system requirements to run FIA are: • 1 gigahertz (GHz) or faster 32-bit (x86) or 64-bit (x64) processor • 1 gigabyte (GB) RAM (32-bit) or 2 GB RAM (64-bit) • Hard disk space dependent on the amount of images being processed Note that the processing of FIA is parallelised and systems with more processor cores will benefit from the parallelisation and perform faster. The system running FIA needs a pdf file format reader application. The two links below provide free pdf readers: • https://get.adobe.com/uk/reader/ • https://www.foxitsoftware.com/products/pdf-reader/ PAGE 4 TECHNICAL DOCUMENTATION // INTRODUCTION CAMERA IMAGE CREATION PIPELINE The physical structure of a digital camera is similar to that of a traditional film camera, whereby the light passes through the lens and is captured inside the camera. The main difference is the technology used to transform the light received to an image, using film or digital sensor for a film camera or a digital camera respectively. Figure 1: Simplified digital camera pipeline Figure 1 shows a simplified version of a digital camera pipeline, with the lens, image sensor and software processing in the camera. The light enters the camera through an aperture in the lens and the light intensity is captured on the sensor. The colours in the light are caught by the CFA (Colour Filter Array) filter, because the sensor stores a grayscale version of the captured image. The camera software processing convert the grayscale image into a digital form and incorporate the image colours back into the digital image. The digital photograph created is then saved either to the camera’s memory or to an external memory card. The three main file formats for digital photos are RAW, TIFF and JPEG respectively. Mid-range and top-end digital cameras can save the RAW and TIFF digital image to the memory of the camera. All digital cameras, including top-end ranges, have the ability to store JPEG images. The RAW and TIFF file formats allow the digital photograph to store all the information captured by the sensor. Whereas, the JPEG format uses a compression technique to make the file size of the digital photo smaller and thus allows more photos to be stored in the memory storage. The JPEG compression eliminates image information that is not sensitive to the human eye. At each stage of the camera processing pipeline some artefacts are embedded in the digital image. These artefacts are formed by specific physical properties of hardware components TECHNICAL DOCUMENTATION // INTRODUCTION and by software properties of the software processing components. The artefacts can be extracted as digital signatures from the photos. FIA uses a sensor identification technology to extract the sensor digital signature (digital fingerprint) from a digital photo. PHOTO METADATA The metadata (Exif data) attached to JPEG photos can be used to identify the make and model of the camera that created the photo. An example of an image with its metadata is shown in Figure 2. The metadata may contain the ISO rating, Exposure time and whether the zoom has been fired among other identifying features of the image. Figure 2: Details of Metadata attached with image. Although the metadata can be used to give an indication of the camera make and model, it is not a reliable method of device identification. The metadata can easily be altered or removed by users or applications. Some online social networking sites (e.g. Facebook) strip the metadata of photos uploaded by users to the site. FIA does extract the metadata of photos while performing the SPN fingerprint extraction, but the metadata is not used in the process of identification or classification of photos. The metadata is provided as an informative component for the user in the classifier’s report. It has been discovered that silicon sensors used in imaging devices (cameras, mobile phones, PAGE 6 SENSOR IDENTIFICATION TECHNOLOGY camcorders) have highly discriminating ‘digital signatures’ or ‘digital fingerprints’. When an image is created the ‘digital fingerprint’ created by the silicon chip is automatically embedded in the image at the time the image is created. This technique is recognised in the scientific field of image forensics as an established and accepted method for determining the source device of an image. The sensor identification technology that is used in FIA is the Sensor Pattern Noise (SPN), which is extracted as the sensor fingerprint of the camera (Figure 3). Sensor Pattern Noise (SPN) will be used interchangeably with sensor Figure 3: Sensor fingerprint throughout the documentation for FIA. SPN occurs due to fingerprint extracted from the natural imperfections of the silicon material in the light absorbing the camera sensor components in sensors. The sensor fingerprint exists due to the variations in conversion of light energy to electrical energy in individual pixels of the camera imaging sensor. SPN can differentiate between sensors from the same camera models, e.g. two Canon EOS 1200D cameras will produce different sensor fingerprints. Hence, SPN created by one ‘Chip’ is different to that of other ‘Chips’. SPN is proportional to the light intensity incident on a pixel, therefore low lighting conditions create weak SPN or no discernible SPN at all. Furthermore, SPN is known not to change over time, i.e. photos taken some