PDF Forensic Report - Job Reference

Transcription

1 PDF Forensic Report - Job Reference Final report of for Dated: Specialist field: Photography Forensics On behalf of the claimant: On the instruction of: Subject matter: The client is looking to establish whether a photograph has been digitally manipulated Investigator information Name: Address: Data Recovery Services Ltd, Unit 1 Avon House, 19 Stanwell Road, Penarth, CARDIFF CF64 2EZ Telephone no: service@datarecoveryspecialists.co.uk Page 1 of 14

2 1.0 Introduction 1.01 The Writer Name: Experience: I am an experienced investigator in digital photographic forensics and data recording and storage. I have been working in this capacity for 8 years. Prior to this I was a computer programmer and analyst. During my employment with Data Recovery Services Ltd, I have gained considerable experience in numerous forensic tools such as X-Ways Forensic Suite, Image Error Level Analysis, Stellar Phoenix Data Recovery, Access Data FTK Forensic Suite, Adobe CS5 Creative Suite and numerous other applications relevant to my work Summary Background of the Case The Client has engaged us to analyse the digital photograph "xxx.jpg", which is a photograph of a xxx, to establish whether it has been digitally manipulated. A xxx is a is a widely accepted analytical technique used to detect xxx Summary of my Conclusions It is my opinion that these photos look tampered with. As with all digital photos that have been printed or transferred to other programs, there is uncertainty as to the original source. These photos are also very low resolution and high image noise, so our findings cannot be considered absolutely definitive. However, there is significant evidence to support claims that these images have been digitally manipulated. Page 2 of 14

3 1.04 Tools Used Image Error Level Analysis Error level analysis can help you work out if a photo has been digitally altered. Photos in a jpeg file format actually lose quality each time they are resaved. We can take advantage of this to try and work out if an image has been digitally manipulated. Error level analysis allows you to see the difference in quality level, represented by brightness. Things which are very bright have been edited most recently, whilst duller parts have been resaved multiple times. This allows you to see not just which parts of the image have been changed, but in what order the changes occurred. The figures in the Index comprise the original photograph, followed by the image error level analysis and any specific areas of interest. Adobe Photoshop CS5 Adobe Photoshop CS5 photographic manipulation software is used to interrogate pixel aspect ratios and zoom into areas of particular interest. Pixel aspect ratio is a mathematical ratio that describes how the width of a pixel in a digital image compares to the height of that pixel. JPEG Snoop Version JPEG Snoop is a software package that allows a user to identify whether a picture has been retouched. It analyses a range of data and grades an image from Class 1 (definitely processed/edited) to Class 4 (uncertain if edited or original). Whilst it cannot define whether a photo is "original", it can ascertain if it has been tampered with. JPEG Snoop uses an internal database that compares an image against a large number of compression signatures. If the compression signature matches any photo editing software, we can be reasonably certain that the image has been edited. Page 3 of 14

4 2.0 Chain of Custody 2.01 Original Evidence I was given access to the original evidence on the xxx. The original evidence was ed to me at and comprised of a single digital photograph in jpeg format named xxx.jpg 2.02 Imaging and Investigation The investigation of the images was conducted in Image Error Level Analysis software, Adobe Photoshop and JPEG Snoop. The evidence is shown in the Index and comprises the original presented photograph, followed by the image error level analysed image, zoomed screenshots and JEG Snoop logs Evidence Storage and Handling During investigation the original evidence was maintained on an external hard drive with limited physical access. Whilst handling the evidence great care has been taken to ensure that it is not corrupted and that its integrity is maintained. 3.0 Examination Details 3.01 Examination The examination process was completed in accordance with the Association of Chief Police Officers (ACPO) Guidelines for Electronic Evidence and the Civil Procedure Rules. The guidelines consist of four principles: 1. No action taken by law enforcement agencies or their agents should change data held on a computer or storage media which may subsequently be relied upon in court. 2. In exceptional circumstances, where a person finds it necessary to access original data held on a computer or on storage media, that person must be competent to do so and be able to give evidence explaining the relevance and the implications of their actions. 3. An audit trail or other record of all processes applied to computer based electronic evidence should be created and preserved. An independent third party should be able to examine those processes and achieve the same result. 4. The person in charge of the investigation (the case officer) has overall responsibility for ensuring that the law and these principles are adhered to. These guidelines are widely accepted in courts of England and Scotland, but they do not constitute a legal requirement and their use is voluntary. However the Civil procedure Rules are clear in that we must provide a balanced, impartial and unbiased report. Our responsibility is to the Court and we cannot be "lead" by our client. Page 4 of 14

5 4.0 Items of Evidential Value 4.01 Digital Manipulation Image error level analysis shows that there is positive evidence to show that the xxx has been digitally replaced in it's entirety. Figure 1.0 shows the highlighted areas, which suggest digital manipulation. However the algorithms used for error level analysis can be unreliable, especially where images have been rescaled or compressed. Further interrogation shows that the pixel aspect ratio is consistent throughout all the photographs. This would be expected given that the image has been reproduced from a scan. Similarly there are no obvious inconsistencies in the light source or focus. However there are inconsistencies in the colouration surrounding the xxx and also the outline as shown at Figure 2.0. Meta-data to establish creation, modification and access times (known as EXIF information) is only available on the original jpeg file and cannot be interrogated from reproduced or scanned files. Therefore we have no information to establish the history of this file. Lastly when assessed using JPEGsnoop, the image is defined as Class 1 - Image is processed/edited as shown in the logs at Figure Discussion 5.01 Discussion of the Facts Of course, most digital pictures have been compressed at some point, and editing in Photoshop has more or less become normal. Improvements in photo manipulation software such as Photoshop and GIMP have made image alteration both easier to commit and harder to detect. Despite these huge advances, it is still possible to determine whether a photograph has been digitally manipulated. Whilst none of the tools and techniques alone would give us a definitive conclusion, used in conjunction we can provide an expert opinion. All our findings suggest that the yellow label on this image has been digitally manipulated. Page 5 of 14

6 Index Fig Results of Image Error Level Analysis Page 6 of 14

7 Fig Zoom to show inconsistencies in colouration and outline Page 7 of 14

8 Fig Results of JPEG Snoop JPEGsnoop Filename: [xxx.jpg] Filesize: [127561] Bytes Start Offset: 0x *** Marker: SOI (xffd8) *** OFFSET: 0x *** Marker: APP0 (xffe0) *** OFFSET: 0x length = 16 identifier = [JFIF] version = [1.1] density = 72 x 72 DPI (dots per inch) thumbnail = 0 x 0 *** Marker: APP2 (xffe2) *** OFFSET: 0x length = 3160 Identifier = [ICC_PROFILE] ICC Profile: Marker Number = 1 of 1 Profile Size : 3144 bytes Preferred CMM Type : 'Lino' (0x4C696E6F) Profile Version : (0x ) Profile Device/Class : Display Device profile ('mntr' (0x6D6E7472)) Data Colour Space : rgbdata ('RGB ' (0x )) Profile connection space (PCS) : 'XYZ ' (0x58595A20) Profile creation date : :49:00 Profile file signature : 'acsp' (0x ) Primary platform : Microsoft Corporation ('MSFT' (0x4D534654)) Profile flags : 0x Profile flags > Profile not embedded Profile flags > Profile can't be used independently of embedded Device Manufacturer : 'IEC ' (0x ) Device Model : 'srgb' (0x ) Device attributes : 0x _ Device attributes > Reflective Device attributes > Glossy Device attributes > Media polarity = negative Device attributes > Black & white media Rendering intent : 0x Profile creator : 'HP ' (0x ) Profile ID : 0x _ _ Page 8 of 14

9 *** Marker: APP1 (xffe1) *** OFFSET: 0x00000C6E length = 214 Identifier = [Exif] Identifier TIFF = 0x[4D4D002A ] Endian = Motorola (big) TAG Mark x002a = 0x002A EXIF Absolute 0x00000C80 Dir Length = 0x0007 [Orientation ] = Row 0: top, Col 0: left [XResolution ] = 72/1 [YResolution ] = 72/1 [ResolutionUnit ] = Inch [Software ] = "Adobe Photoshop CS5 Macintosh" [DateTime ] = "2011:10:12 22:20:23" [ExifOffset ] 0x00A4 Offset to Next IFD = 0x EXIF Absolute 0x00000D1C Dir Length = 0x0003 [ColorSpace ] = srgb [ExifImageWidth ] = 2000 [ExifImageHeight ] = 1200 *** Marker: DQT (xffdb) *** Define a Quantization Table. OFFSET: 0x00000D46 Table length = Precision=8 bits Destination ID=0 (Luminance) DQT, Row #0: DQT, Row #1: DQT, Row #2: DQT, Row #3: DQT, Row #4: DQT, Row #5: DQT, Row #6: DQT, Row #7: Approx quality factor = (scaling=72.62 variance=1.16) *** Marker: DQT (xffdb) *** Define a Quantization Table. OFFSET: 0x00000D8B Table length = Precision=8 bits Destination ID=1 (Chrominance) DQT, Row #0: DQT, Row #1: DQT, Row #2: DQT, Row #3: DQT, Row #4: DQT, Row #5: DQT, Row #6: DQT, Row #7: Approx quality factor = (scaling=72.61 variance=0.22) Page 9 of 14

10 *** Marker: SOF0 (Baseline DCT) (xffc0) *** OFFSET: 0x00000DD0 Frame header length = 17 Precision = 8 Number of Lines = 1200 Samples per Line = 2000 Image Size = 2000 x 1200 Raw Image Orientation = Landscape Number of Img components = 3 Component[1]: ID=0x01, Samp Fac=0x22 (Subsamp 1 x 1), Quant Tbl Sel=0x00 (Lum: Y) Component[2]: ID=0x02, Samp Fac=0x11 (Subsamp 2 x 2), Quant Tbl Sel=0x01 (Chrom: Cb) Component[3]: ID=0x03, Samp Fac=0x11 (Subsamp 2 x 2), Quant Tbl Sel=0x01 (Chrom: Cr) *** Marker: DHT (Define Huffman Table) (xffc4) *** OFFSET: 0x00000DE3 Huffman table length = Destination ID = 0 Class = 0 (DC / Lossless Table) Codes of length 01 bits (000 total): Codes of length 02 bits (001 total): 00 Codes of length 03 bits (005 total): Codes of length 04 bits (001 total): 06 Codes of length 05 bits (001 total): 07 Codes of length 06 bits (001 total): 08 Codes of length 07 bits (001 total): 09 Codes of length 08 bits (001 total): 0A Codes of length 09 bits (001 total): 0B Codes of length 10 bits (000 total): Codes of length 11 bits (000 total): Codes of length 12 bits (000 total): Codes of length 13 bits (000 total): Codes of length 14 bits (000 total): Codes of length 15 bits (000 total): Codes of length 16 bits (000 total): Total number of codes: 012 Page 10 of 14

11 *** Marker: DHT (Define Huffman Table) (xffc4) *** OFFSET: 0x00000E04 Huffman table length = Destination ID = 0 Class = 1 (AC Table) Codes of length 01 bits (000 total): Codes of length 02 bits (002 total): Codes of length 03 bits (001 total): 03 Codes of length 04 bits (003 total): Codes of length 05 bits (003 total): Codes of length 06 bits (002 total): Codes of length 07 bits (004 total): Codes of length 08 bits (003 total): Codes of length 09 bits (005 total): A1 Codes of length 10 bits (005 total): B1 C1 Codes of length 11 bits (004 total): D1 F0 Codes of length 12 bits (004 total): Codes of length 13 bits (000 total): Codes of length 14 bits (000 total): Codes of length 15 bits (001 total): 82 Codes of length 16 bits (125 total): 09 0A A A A A A A A A A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E1 E2 E3 E4 E5 E6 E7 E8 E9 EA F1 F2 F3 F4 F5 F6 F7 F8 F9 FA Total number of codes: 162 *** Marker: DHT (Define Huffman Table) (xffc4) *** OFFSET: 0x00000EBB Huffman table length = Destination ID = 1 Class = 0 (DC / Lossless Table) Codes of length 01 bits (000 total): Codes of length 02 bits (003 total): Codes of length 03 bits (001 total): 03 Codes of length 04 bits (001 total): 04 Codes of length 05 bits (001 total): 05 Codes of length 06 bits (001 total): 06 Codes of length 07 bits (001 total): 07 Codes of length 08 bits (001 total): 08 Codes of length 09 bits (001 total): 09 Codes of length 10 bits (001 total): 0A Codes of length 11 bits (001 total): 0B Codes of length 12 bits (000 total): Codes of length 13 bits (000 total): Codes of length 14 bits (000 total): Codes of length 15 bits (000 total): Codes of length 16 bits (000 total): Total number of codes: 012 *** Marker: DHT (Define Huffman Table) (xffc4) *** OFFSET: 0x00000EDC Huffman table length = Destination ID = 1 Page 11 of 14

12 Class = 1 (AC Table) Codes of length 01 bits (000 total): Codes of length 02 bits (002 total): Codes of length 03 bits (001 total): 02 Codes of length 04 bits (002 total): Codes of length 05 bits (004 total): Codes of length 06 bits (004 total): Codes of length 07 bits (003 total): Codes of length 08 bits (004 total): Codes of length 09 bits (007 total): A1 B1 C1 Codes of length 10 bits (005 total): F0 Codes of length 11 bits (004 total): D1 Codes of length 12 bits (004 total): 0A Codes of length 13 bits (000 total): Codes of length 14 bits (001 total): E1 Codes of length 15 bits (002 total): 25 F1 Codes of length 16 bits (119 total): A A A A A A A A A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E2 E3 E4 E5 E6 E7 E8 E9 EA F2 F3 F4 F5 F6 F7 F8 F9 FA Total number of codes: 162 *** Marker: SOS (Start of Scan) (xffda) *** OFFSET: 0x00000F93 Scan header length = 12 Number of img components = 3 Component[1]: selector=0x01, table=0x00 Component[2]: selector=0x02, table=0x11 Component[3]: selector=0x03, table=0x11 Spectral selection = Successive approximation = 0x00 Page 12 of 14

13 *** Decoding SCAN Data *** OFFSET: 0x00000FA1 Scan Decode Mode: No IDCT (DC only) NOTE: Low-resolution DC component shown. Can decode full-res with [Options- >Scan Segment->Full IDCT] Scan Data encountered marker 0x0001F247.0 Compression stats: Compression Ratio: 58.27:1 Bits per pixel: 0.41:1 Huffman code histogram stats: Huffman Table: (Dest ID: 0, Class: DC) # codes of length 01 bits: 0 ( 0%) # codes of length 02 bits: ( 35%) # codes of length 03 bits: ( 61%) # codes of length 04 bits: 1390 ( 4%) # codes of length 05 bits: 258 ( 1%) # codes of length 06 bits: 0 ( 0%) # codes of length 07 bits: 0 ( 0%) # codes of length 08 bits: 0 ( 0%) # codes of length 09 bits: 0 ( 0%) # codes of length 10 bits: 0 ( 0%) # codes of length 11 bits: 0 ( 0%) # codes of length 12 bits: 0 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 0 ( 0%) # codes of length 15 bits: 0 ( 0%) # codes of length 16 bits: 0 ( 0%) Huffman Table: (Dest ID: 1, Class: DC) # codes of length 01 bits: 0 ( 0%) # codes of length 02 bits: ( 95%) # codes of length 03 bits: 257 ( 1%) # codes of length 04 bits: 261 ( 1%) # codes of length 05 bits: 302 ( 2%) # codes of length 06 bits: 70 ( 0%) # codes of length 07 bits: 0 ( 0%) # codes of length 08 bits: 0 ( 0%) # codes of length 09 bits: 0 ( 0%) # codes of length 10 bits: 0 ( 0%) # codes of length 11 bits: 0 ( 0%) # codes of length 12 bits: 0 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 0 ( 0%) # codes of length 15 bits: 0 ( 0%) # codes of length 16 bits: 0 ( 0%) Huffman Table: (Dest ID: 0, Class: AC) # codes of length 01 bits: 0 ( 0%) # codes of length 02 bits: ( 39%) # codes of length 03 bits: 6578 ( 5%) # codes of length 04 bits: ( 39%) # codes of length 05 bits: ( 8%) # codes of length 06 bits: 5613 ( 4%) # codes of length 07 bits: 3373 ( 2%) # codes of length 08 bits: 1084 ( 1%) # codes of length 09 bits: 1217 ( 1%) # codes of length 10 bits: 291 ( 0%) # codes of length 11 bits: 239 ( 0%) # codes of length 12 bits: 130 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 0 ( 0%) # codes of length 15 bits: 1 ( 0%) # codes of length 16 bits: 1417 ( 1%) Huffman Table: (Dest ID: 1, Class: AC) # codes of length 01 bits: 0 ( 0%) Page 13 of 14

14 # codes of length 02 bits: ( 77%) # codes of length 03 bits: 1600 ( 6%) # codes of length 04 bits: 2439 ( 8%) # codes of length 05 bits: 1130 ( 4%) # codes of length 06 bits: 777 ( 3%) # codes of length 07 bits: 62 ( 0%) # codes of length 08 bits: 334 ( 1%) # codes of length 09 bits: 114 ( 0%) # codes of length 10 bits: 76 ( 0%) # codes of length 11 bits: 51 ( 0%) # codes of length 12 bits: 0 ( 0%) # codes of length 13 bits: 0 ( 0%) # codes of length 14 bits: 0 ( 0%) # codes of length 15 bits: 0 ( 0%) # codes of length 16 bits: 0 ( 0%) YCC clipping in DC: Y component: [<0= 0] [>255= 0] Cb component: [<0= 0] [>255= 0] Cr component: [<0= 0] [>255= 0] RGB clipping in DC: R component: [<0= 0] [>255= 0] G component: [<0= 0] [>255= 0] B component: [<0= 0] [>255= 0] Average Pixel Luminance (Y): Y=[166] (range: ) Brightest Pixel Search: YCC=[ 1020, 0, 0] MCU[ 0, 0] Finished Decoding SCAN Data Number of RESTART markers decoded: 0 Next position in scan buffer: Offset 0x0001F246.2 *** Marker: EOI (End of Image) (xffd9) *** OFFSET: 0x0001F247 *** Searching Compression Signatures *** Signature: 01C4C08033B3048D429A186989CC9BFE Signature (Rotated): 01643F4E607AAF6ECEF7724A715A00DC File Offset: 0 bytes Chroma subsampling: 2x2 EXIF Make/Model: NONE EXIF Makernotes: NONE EXIF Software: OK [Adobe Photoshop CS5 Macintosh] Searching Compression Signatures: (3327 built-in, 0 user(*) ) EXIF.Make / Software EXIF.Model Quality Subsamp Match? NOTE: EXIF Software field recognized as from editor Based on the analysis of compression characteristics and EXIF metadata: ASSESSMENT: Class 1 - Image is processed/edited Page 14 of 14