Digital forensic techniques for the reverse engineering of image acquisition chains

In recent years a number of new methods have been developed to detect image forgery. Most forensic techniques use footprints left on images to predict the history of the images. The images, however, sometimes could have gone through a series of processing and modification through their lifetime. It is therefore difficult to detect image tampering as the footprints could be distorted or removed over a complex chain of operations. In this research we propose digital forensic techniques that allow us to reverse engineer and determine history of images that have gone through chains of image acquisition and reproduction. This thesis presents two different approaches to address the problem. In the first part we propose a novel theoretical framework for the reverse engineering of signal acquisition chains. Based on a simplified chain model, we describe how signals have gone in the chains at different stages using the theory of sampling signals with finite rate of innovation. Under particular conditions, our technique allows to detect whether a given signal has been reacquired through the chain. It also makes possible to predict corresponding important parameters of the chain using acquisition-reconstruction artefacts left on the signal. The second part of the thesis presents our new algorithm for image recapture detection based on edge blurriness. Two overcomplete dictionaries are trained using the K-SVD approach to learn distinctive blurring patterns from sets of single captured and recaptured images. An SVM classifier is then built using dictionary approximation errors and the mean edge spread width from the training images. The algorithm, which requires no user intervention, was tested on a database that included more than 2500 high quality recaptured images. Our results show that our method achieves a performance rate that exceeds 99% for recaptured images and 94% for single captured images.Open Acces

Image source camera attribution

Orientador: Anderson de Rezende RochaDissertação (mestrado) - Universidade Estadual de Campinas, Instituto de ComputaçãoResumo: Verificar a integridade e a autenticidade de imagens digitais é de fundamental importância quando estas podem ser apresentadas como evidência em uma corte de justiça. Uma maneira de se realizar esta verificação é identificar a câmera digital que capturou tais imagens. Neste trabalho, nós discutimos abordagens que permitem identificar se uma imagem sob investigação foi ou não capturada por uma determinada câmera digital. A pesquisa foi realizada segundo duas óticas: (1) verificação, em que o objetivo é verificar se uma determinada câmera, de fato, capturou uma dada imagem; e (2) reconhecimento, em que o foco é verificar se uma determinada imagem foi obtida por alguma câmera (se alguma) dentro de um conjunto limitado de câmeras e identificar, em caso afirmativo, o dispositivo específico que efetuou a captura. O estudo destas abordagens foi realizado considerando um cenário aberto (open-set), no qual nem sempre temos acesso a alguns dos dispositivos em questão. Neste trabalho, tratamos, também, do problema de correspondência entre dispositivos, em que o objetivo é verificar se um par de imagens foi gerado por uma mesma câmera. Isto pode ser útil para agrupar conjuntos de imagens de acordo com sua fonte quando não se possui qualquer informação sobre possíveis dispositivos de origem. As abordagens propostas apresentaram bons resultados, mostrando-se capazes de identificar o dispositivo específico utilizado na captura de uma imagem, e não somente sua marcaAbstract: Image's integrity and authenticity verification is paramount when it comes to a court of law. Just like we do in ballistics tests when we match a gun to its bullets, we can identify a given digital camera that acquired an image under investigation. In this work, we discussed approaches for identifying whether or not a given image under investigation was captured by a specific digital camera. We carried out the research under two vantage points: (1) verification, in which we are interested in verifying whether or not a given camera captured an image under investigation; and (2) recognition, in which we want to verify if an image was captured by a given camera (if any) from a pool of devices, and to point out such a camera. We performed this investigation considering an open set scenario, under which we can not rely on the assumption of full access to all of the investigated devices. We also tried to solve the device linking problem, where we aim at verifying if an image pair was generated by the same camera, without any information about the source of images. Our approaches reported good results, in terms of being capable of identifying the specific device that captured a given image including its model, brand, and even serial numberMestradoCiência da ComputaçãoMestre em Ciência da Computaçã