Most digital cameras export images in the JPEG file format. This lossy compression scheme employs a quantization table that controls the amount of compression achieved. Different cameras typically employ different tables. A comparison of an image\u27s quantization scheme to a database of known cameras affords a simple technique for confirming or denying an image\u27s source. Similarly, comparison to a database of photo-editing software can be used in a forensic setting to determine if an image was edited after its original recording

Farid, Hany

English

Dartmouth Digital Commons (Dartmouth College)

Dartmouth College Dartmouth Digital Commons Computer Science Technical Reports Computer Science 9-1-2006 Digital Image Ballistics from JPEG Quantization Hany Farid Dartmouth College Follow this and additional works at: https://digitalcommons.dartmouth.edu/cs_tr  Part of the Computer Sciences Commons Dartmouth Digital Commons Citation Farid, Hany, "Digital Image Ballistics from JPEG Quantization" (2006). Computer Science Technical Report TR2006-583. https://digitalcommons.dartmouth.edu/cs_tr/291 This Technical Report is brought to you for free and open access by the Computer Science at Dartmouth Digital Commons. It has been accepted for inclusion in Computer Science Technical Reports by an authorized administrator of Dartmouth Digital Commons. For more information, please contact dartmouthdigitalcommons@groups.dartmouth.edu. TR2006-583, Dartmouth College, Computer ScienceDigital Image Ballistics from JPEG QuantizationHany FaridDepartment of Computer ScienceDartmouth CollegeHanover NH 03755AbstractMost digital cameras export images in the JPEG file format. This lossy compression scheme employs aquantization table that controls the amount of compression achieved. Different cameras typically em-ploy different tables. A comparison of an image’s quantization scheme to a database of known camerasaffords a simple technique for confirming or denying an image’s source. Similarly, comparison to adatabase of photo-editing software can be used in a forensic setting to determine if an image was editedafter its original recording.11 IntroductionWhen performing a forensic analysis on a digital im-age, it is often useful to be able to determine its source(e.g., a digital camera, a digital video camera, or aphoto-editing software). Since the JPEG image formathas emerged as a virtual standard, most devices andsoftware encode images in this format. This lossy com-pression scheme allows for some flexibility in howmuch compression is achieved. Manufacturers typi-cally configure their devices differently to balance com-pression and quality to their own needs and tastes.This difference, embodied in the JPEG quantization ta-ble, can be used to identify the source of an image.In related work [3], the authors describe a techniqueto identify a specific camera based on sensor noise.Here, a much cruder identification will be made – atbest, that of identifying the camera make and model.One benefit of this approach is that it can be appliedto any device or software that employs JPEG compres-sion.2 JPEG CompressionJPEG 1 is a standard lossy compression scheme [1, 6].Given a three channel color image (RGB), compressionproceeds as follows. The RGB image is first convertedinto luminance/chrominance space (YCbCr). The twochrominance channels (CbCr) are typically subsampledby a factor of two relative to the luminance channel(Y). Each channel is then partitioned into 8 × 8 pixelblocks. These values are converted from unsigned tosigned integers (e.g., from [0, 255] to [−128, 127]). Eachblock is converted to frequency space using a 2-D dis-crete cosine transform (DCT). Depending on the spe-cific frequency and channel, each DCT coefficient, c, isthen quantized by an amount q:ĉ = round(c/q). (1)This stage is the primary source of information loss. Afinal entropy encoding is then employed.With some variations, the above sequence of stepsare employed by JPEG encoders in digital cameras andphoto-editing software. The primary source of varia-tion in these encoders is the choice of quantization thatsubsequently controls the compression rates and arti-facts. The quantization is specified as a table of 192values – a set of 8 × 8 values associated with each fre-quency, for each of three channels (YCbCr). For lowcompression rates, these values tend towards a valueof 1, and increase for higher compression rates. Shownin Figure 1, for example, is the quantization table em-ployed by a Nikon Coolpix 2500 digital camera. Shown,1The Joint Photographic Experts Group (JPEG) developed an im-age file format known as the JPEG File Interchange Format (JFIF),which is most commonly abbreviated as JPEG.2 1 1 1 1 1 2 11 1 2 2 2 2 2 43 2 2 2 2 5 4 43 4 6 5 6 6 6 56 6 6 7 9 8 6 79 7 6 6 8 11 8 910 10 10 10 10 6 8 1112 11 10 12 9 10 10 102 2 2 2 2 2 5 33 5 10 7 6 7 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 102 2 2 2 2 2 5 33 5 10 7 6 7 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 1010 10 10 10 10 10 10 10Figure 1: A sample JPEG quantization table em-ployed by a Nikon Coolpix 2500 digital camera.from top to bottom, are the luminance and chromi-nance channel tables. As is typical, the quantizationfor the luminance channel is less than for the twochrominance channels, and the quantization level isless for the lower frequency components.With 192 entries, and values ranging typically from1 to 25 there are 10268 possible quantization tables –in practice, this number is much smaller because theentries are not chosen independent of one another.3 BallisticsA single image from each of 204 digital cameras wascollected, Table 5 2. While some cameras have only asingle JPEG quality setting, many others have multiplequality settings. In this current analysis, only a singleimage at the highest quality was examined.The JPEG quantization table was extracted from eachimage and compared for uniqueness. On average, eachcamera matched 1.43 other cameras. 62 of the 204 cam-eras had a unique table. The remaining cameras fallinto equivalence classes of sizes between 2 and 28, Ta-ble 5. In the majority of cases, it is cameras from thesame manufacturer that share the same quantizationtables. In many cases, only two or three cameras areindistinguishable – the Canon PowerShot family is the2Most of the images were downloaded from the digital photog-raphy review site http://www.dpreview.com. The metadata ofeach downloaded image was checked to make sure that the im-age was not subsequently edited in a photo-editing software, whichwould have compromised the original JPEG quantization table.2exception, where 28 cameras have identical quantiza-tion tables. And in several cases, different makes andmodels share the same quantization table, with thelargest diversity finding Kodak, Nikon, Olympus, Pen-tax, and Sony cameras in the same equivalence class.While the JPEG quantization is clearly not perfectlyunique, it is reasonably effective at narrowing the sourceof an image to a single camera make and model or to asmall set of possible cameras (on average, this set sizeis 1.43).3.1 Software BallisticsPhoto-editing software packages (e.g., Adobe Photo-shop, Corel Paint Shop, Microsoft Digital Image Suite,etc.) employ different JPEG quantization tables. Pho-toshop, unarguably the most popular such package,provides 13 levels of compression (12: lowest com-pression & highest quality – 0: highest compression& lowest quality). An image was saved at each ofthese levels for Photoshop CS2 (the most recent ver-sion), Photoshop CS, Photoshop 7, Photoshop 4 andPhotoshop 3. The quantization tables at each compres-sion level were different from one another. Moreover,at each compression level the tables were the same forall five versions of Photoshop 3. More importantly, thetables differed from each the 204 digital cameras listedin Table 5. An image can therefore be linked to a spe-cific software (or possibly a set of software packages).Similar in spirit to forensic techniques for detectingdouble JPEG compression [2, 4], the presence of quan-tization tables unique to a photo-editing software canbe used to determine that an image was previouslyviewed and saved from within a photo-editing soft-ware. The reliability of such a claim will, of course,require the uniqueness of the software tables to holdover a larger set of cameras.3.2 Video BallisticsThe MPEG video standard (MPEG-1 and MPEG-2) em-ploys two basic schemes for compression to reduce bothspatial redundancy within individual video frames andtemporal redundancy across video frames [5]. In aMPEG encoded video sequence, there are three typesof frames: intra (I), predictive (P ) and bi-directionallypredictive (B), each offering varying degrees of com-pression. These frames typically occur in a periodicsequence. A common sequence, for example, is:I1 B2 B3 P4 B5 B6 P7 B8 B9 P10 B11 B12 I13 B14 · · · ,where the subscripts are used to denote time.I-frames are encoded using the JPEG compressionscheme described in Section 2. P -frames are encoded3More recent versions of Photoshop afford more JPEG compres-sion levels. The quantization tables found in older versions, how-ever, are the same as in the most recent versions of Photoshop.using motion estimation. The motion between a P -frame and its preceding I- or P -frame is estimated.A motion estimated version of the next frame is gen-erated by warping the P -frame according to the esti-mated motion. The error between this predicted frame,and the actual frame is then computed. Both the mo-tion vectors and the motion errors are encoded andtransmitted – the motion errors are encoded using JPEGcompression. The encoding of a B-frame is similarto that of a P -frame except that motion estimation forthese frames employ past, future, or both of its neigh-boring I- or P -frames.In an MPEG video sequence, the I-frames and themotion errors for the P - and B-frames are each JPEGencoded. As such, the quantization tables for theseframes may be used to identify the source of a videorecording.4 DiscussionBy choosing a JPEG quantization table camera manu-facturers and software developers are able to balancethe amount of compression and the quality of their im-ages. In so doing, a signature of sorts is embeddedwithin each JPEG image. This simple observation al-lows for a rather crude form of digital image ballistics,whereby the source of an image can be confirmed ordenied.In order for this ballistic technique to be more effec-tive and reliable, it is important to collect data from anever-increasing number of cameras and software. Inaddition, it is important to consider the quantizationtables for each JPEG quality setting afforded by a spe-cific device or software.In collaboration with other ballistic and forensic tools,this technique should prove useful for the forensic ex-amination of digital images and video.5 AcknowledgmentsThanks to Paul McJones and Sean Parent of AdobeSystems for their assistance extracting the JPEG quan-tization tables from older versions of Adobe Photo-shop. Thanks to Jeff Woodward for writing the batchprocessing scripts for extracting JPEG quantization ta-bles.This work was supported by a Guggenheim Fel-lowship, a gift from Adobe Systems, Inc., a gift fromMicrosoft, Inc., a grant (FA8750-06-C-0011) from theUnited States Air Force, and under a grant (2000-DT-CX-K001) from the U.S. Department of Homeland Se-curity, Science and Technology Directorate (points ofview in this document are those of the authors anddo not necessarily represent the official position of theU.S. Department of Homeland Security or the Scienceand Technology Directorate).3References[1] Digital compression and coding of continuous-tone still images, Part 1: Requirements and guide-lines. ISO/IEC JTC1 Draft International Standard10918-1, 1991.[2] J. Lukas and J. Fridrich. Estimation of primaryquantization matrix in double compressed JPEGimages. In Digital Forensic Research Workshop,Cleveland, Ohio, August 2003.[3] J. Lukas, J. Fridrich, and M. Goljan. Digital cameraidentification from sensor noise. IEEE Transactionson Information Security and Forensics, 1(2):205–214,2006.[4] A.C. Popescu and H. Farid. Statistical tools for dig-ital forensics. In 6th International Workshop on Infor-mation Hiding, Toronto, Cananda, 2004.[5] T. Sikora. Digital Consumer Electronics Handbook,chapter MPEG-1 and MPEG-2 Digital Video Cod-ing Standards. McGraw-Hill, 1997.[6] G.K. Wallace. The JPEG still picture compressionstandard. IEEE Transactions on Consumer Electron-ics, 34(4):30–44, 1991.4Canon PowerShot A510 Canon PowerShot A520 Canon PowerShot A620Canon IXUS 50 Canon PowerShot S2 IS Canon PowerShot S70Canon IXUS 55 Canon IXUS 700 Canon IXUS 750Canon IXUS 800 IS Canon PowerShot A20 Canon PowerShot A70Canon PowerShot A700 Canon PowerShot A95 Canon EOS 10DCanon EOS-1D Canon EOS-1D Mark II Canon EOS-1DSCanon Canon Canon EOS 20D Canon EOS 300DCanon EOS 30D Canon EOS 350D Canon EOS 5DCanon EOS D30 Canon EOS D60 Canon PowerShot G1Canon PowerShot G2 Canon PowerShot G3 Canon PowerShot G5Canon PowerShot G6 Canon PowerShot Pro1 Canon PowerShot Pro90 ISCanon PowerShot S10 Canon IXUS Canon IXUS vCanon PowerShot S1 IS Canon PowerShot S20 Canon PowerShot S30Canon IXUS 300 Canon IXUS 330 Canon PowerShot S40Canon IXUS 400 Canon PowerShot S45 Canon PowerShot S50Canon PowerShot S60 Canon IXUS II Canon IXUS 40Casio EX-P700 Casio EX-Z3 Casio EX-Z750Casio QV-3000EX Casio QV-4000 Epson PhotoPC 3000ZFuji FinePix40i Fuji FinePix4700 Fuji FinePix4900Fuji FinePix6800 Fuji FinePix6900 Fuji FinePix F810Fuji FinePix E550 Fuji FinePix F10 Fuji FinePix F30Fuji FinePix F601 Fuji FinePix F700 Fuji FinePix S1ProFuji FinePix S2Pro Fuji FinePix S3Pro Fuji FinePix S500Fuji FinePix S5500 Fuji FinePix S602 Fuji FinePix S7000Fuji FinePix S9500 Fuji FinePix2700 Fuji MX-2900ZOOMHewlett-Packard PhotoSmart C812 Hewlett-Packard PhotoSmart C850 Hewlett-Packard PhotoSmart C935Hewlett-Packard PhotoSmart R707 Kodak DC290 Kodak DC3200Kodak DC4800 Kodak DCS Pro 14N Kodak DX4900Kodak DX7590 Kodak P850 Kodak P880Kodak V610 Kodak Z650 Kodak Z740Konica Minolta MAXXUM 7D Konica Minolta DiMAGE A200 Konica Minolta DiMAGE A2Konica Minolta DiMAGE Z2 Konica Minolta DiMAGE Z5 Kyocera FC-S3Lieca DIGILUX 2 Minolta DiMAGE 5 Minolta DiMAGE 7Minolta DiMAGE 7Hi Minolta DiMAGE 7i Minolta DiMAGE A1Minolta DiMAGE F100 Minolta DiMAGE S304 Minolta DiMAGE S404Minolta DiMAGE X Nikon E2500 Nikon E3100Nikon E4500 Nikon E4800 Nikon E5000Nikon E5200 Nikon E5400 Nikon E5700Nikon E700 Nikon E775 Nikon E7900Nikon E800 Nikon E8400 Nikon E8700Nikon E880 Nikon E8800 Nikon E885Nikon E950 Nikon E990 Nikon E995Nikon COOLPIX P3 Nikon D1 Nikon D100Nikon D1H Nikon D200 Nikon D2HNikon D2X Nikon D50 Nikon D70Olympus C2020Z Olympus C2100UZ Olympus C3030ZOlympus C3040Z Olympus C40Z,D40Z Olympus C5050ZOlympus X-2,C-50Z Olympus C70Z,C7000Z OlympusD C700UZOlympus C8080WZ Olympus E-1 Olympus E-10Olympus E-20 Olympus E-300 Olympus E-330Olympus E-500 Olympus SP310 Olympus SP500UZOlympus uD800,S800 Olympus u-miniD Panasonic DMC-FX01Panasonic DMC-FZ30 Panasonic DMC-FX7 Panasonic DMC-FX9Panasonic DMC-FZ20 Panasonic DMC-FZ3 Panasonic DMC-FZ5Panasonic DMC-LX1 Panasonic DMC-LZ2 Panasonic DMC-TZ1Pentax Optio A10 Pentax ist D Pentax ist DSPentax Optio 330 Pentax Optio 430 Pentax Optio 550Pentax Optio 750Z Pentax Optio S Pentax Optio S5iRicoh GR Samsung Digimax V700 Sigma SD10Sony MVC-CD200 Sony MVC-CD300 Sony DSC-D700Sony DSC-F505V Sony DSC-F707 Sony DSC-F717Sony DSC-F828 Sony DSC-F88 Sony DSC-H1Sony DSC-H2 Sony DSC-H5 Sony DSC-L1Sony DSC-P1 Sony DSC-P150 Sony DSC-P200Sony DSC-P5 Sony DSC-P71 Sony DSC-P9Sony DSC-R1 Sony DSC-S70 Sony DSC-S75Sony DSC-S85 Sony DSC-S90 Sony DSC-V1Sony DSC-V3 Sony DSC-W7 Sony DSLR-A100Table 1: Make and model of 204 cameras.528 Canon PowerShot A510 – Canon PowerShot A520 – Canon PowerShot A620 – Canon IXUS 50 – Canon PowerShot S2 IS –Canon PowerShot S70 – Canon IXUS 55 – Canon IXUS 700 – Canon IXUS 750 – Canon IXUS 800 IS – Canon PowerShot A20– Canon PowerShot A70 – Canon PowerShot A700 – Canon PowerShot G2 – Canon PowerShot G3 – Canon PowerShot G5– Canon PowerShot G6 – Canon PowerShot Pro1 – Canon IXUS v – Canon IXUS 300 – Canon IXUS 330 – Canon PowerShotS40 – Canon IXUS 400 – Canon PowerShot S45 – Canon PowerShot S50 – Canon PowerShot S60 – Canon IXUS II – CanonIXUS 4023 Kodak P850 – Nikon E5400 – Olympus C2100UZ – Olympus C3030Z – Olympus C40Z,D40Z – Olympus C5050Z – Olym-pusD C700UZ – Olympus C8080WZ – Pentax Optio 550 – Pentax Optio 750Z – Sony DSC-F505V – Sony DSC-F707 – SonyDSC-F717 – Sony DSC-H1 – Sony DSC-H2 – Sony DSC-H5 – Sony DSC-P150 – Sony DSC-P200 – Sony DSC-R1 – SonyDSC-S90 – Sony DSC-V1 – Sony DSC-V3 – Sony DSC-W716 Canon EOS 10D – Canon EOS 20D – Canon EOS 300D – Canon EOS 30D – Canon EOS 350D – Canon EOS D30 – CanonEOS D60 – Sony MVC-CD200 – Sony MVC-CD300 – Sony DSC-P1 – Sony DSC-P5 – Sony DSC-P71 – Sony DSC-P9 – SonyDSC-S70 – Sony DSC-S75 – Sony DSC-S858 Konica Minolta DiMAGE Z2 – Minolta DiMAGE F100 – Nikon E2500 – Nikon E4500 – Nikon E5000 – Nikon E5700 – NikonE8800 – Nikon E9907 Nikon D100 – Nikon D1H – Nikon D200 – Nikon D2H – Nikon D50 – Nikon D70 – Panasonic DMC-FX016 Kodak P880 – Nikon D2X – Olympus C3040Z – Olympus C70Z,C7000Z – Olympus SP310 – Olympus SP500UZ6 Konica Minolta DiMAGE A2 – Minolta DiMAGE 5 – Minolta DiMAGE 7 – Minolta DiMAGE 7i – Minolta DiMAGE S304 –Minolta DiMAGE S4045 Kodak DC4800 – Kodak DX4900 – Kodak V610 – Kodak Z650 – Kodak Z7405 Nikon E4800 – Nikon E775 – Nikon E8400 – Nikon E8700 – Sigma SD104 Canon IXUS – Casio EX-P700 – Casio EX-Z750 – Pentax Optio S3 Minolta DiMAGE X – Nikon E7900 – Nikon E9503 Nikon E3100 – Nikon E880 – Nikon E9953 Olympus E-300 – Olympus E-330 – Olympus E-5003 Panasonic DMC-FX7 – Panasonic DMC-FZ20 – Panasonic DMC-FZ52 Canon EOS-1D – Canon EOS-1DS2 Canon EOS-1Ds Mark II – Canon EOS 5D2 Canon PowerShot G2 – Canon PowerShot Pro90 IS2 Epson PhotoPC 3000Z – Konica Minolta DiMAGE A2002 Fuji FinePix S7000 – Fuji FinePix27002 Hewlett-Packard PhotoSmart C850 – Hewlett-Packard PhotoSmart C9352 Minolta DiMAGE 7Hi – Minolta DiMAGE A12 Nikon E5200 – Nikon COOLPIX P32 Panasonic DMC-FZ30 – Panasonic DMC-LX12 Pentax ist D – Pentax ist DS2 Sony DSC-F828 – Sony DSC-F88Table 2: Each entry corresponds to cameras with identical JPEG quantization tables.6

Digital Image Ballistics from JPEG Quantization

https://digitalcommons.dartmouth.edu/cgi/viewcontent.cgi?article=1293&amp;context=cs_tr

Digital Image Ballistics from JPEG Quantization

Abstract

Similar works

Full text

Available Versions

Dartmouth Digital Commons (Dartmouth College)