29 Jun

Source Camera Identification Using Forensic Image Analyser

Source Camera Identification Using Forensic Image Analyser (FIA) 

The Problem

Police Forces, intelligence agencies and digital forensic investigators recover huge amounts of images from laptops, mobile phones, storage devices (hard drives, pen drives) and the internet. Often these images need to be analysed to ascertain the source device (camera, cell phone) that was used to photograph the image(s), especially when investigating child sexual abuse (CSE) content.

A suspect might claim he/she didn’t photograph an illegal image(s) and simply downloaded the content by accident. For example in the recent Lee Mathews case http://www.forensic-pathways.com/new-forensic-image-technology-achieves-success-in-major-child-abuse-case/. Or, an investigator in a case may recover 500 illegal images on a hard drive and needs to quickly ascertain which of the images were photographed by the same device. In counter terrorism cases a suspect might be arrested with potential intelligence on their cell phone, for example ‘hate symbols’. These are just some examples where the ability to link images to devices is critical.

Currently Police Forces use ‘meta data’ to identify the make and model of the device that photographed an image(s).  However, meta and exif data can be removed and/or edited by suspects and criminal networks.  Furthermore, the process cannot distinguish between two devices that are the same make/model.

Another technique being used by analysts to classify images is the use of ‘hash sums’. However, if an image ascertain has been edited in any way the hash sum will change. This is not ideal when images are shared in their millions each day and automatically edited by internet sites. Consequently Police Forces need a robust and scientifically proven methodology for linking ‘images to devices’ and ‘images to images’.

The challenge for law enforcement is being able to speed up investigations, improve efficiencies and reduce unnecessary costs. Consequently, Forensic Pathways has developed a software http://www.forensic-pathways.com/forensic-image-analyser/ tool that can automatically identify the source device (camera, mobile phone) that photographed a particular image(s).

The Solution

Forensic Pathways Limited (FPL) has developed a peer reviewed, scientifically proven methodology for identifying the source device that photographed a particular images(s). The algorithm has been used successfully in a number of UK child sexual exploitation cases.  See www.forensic-pathways.com for more information. 

Forensic Image Analyser (FIA) extracts a latent feature, known as, Sensor Pattern Noise (SPN) from digital images. SPN occurs due to the natural imperfections in the silicon chip and varying pixel sensitivity to light in the sensor of the camera. The uniqueness of these defects makes SPN a natural digital ‘fingerprint’. Importantly, SPN can be used to differentiate between imaging devices of the same model. For example, the software can distinguish between the camera fingerprints of two iPhone 6 devices.  It is important to note that these SPN fingerprints contain no content. Thus the fingerprints can be shared without compromising security.

‘Standard SPN’ fingerprints are contaminated by scene details in the image, which leads to misidentifications. This is not at all helpful in forensic terms. Therefore, the use of standard SPN in forensics will not produce the required results. FPL has developed a unique ‘SPN enhancer’ (patents GB2467767, GB2486987, EU 2396749, USA8565529) that removes contamination from the standard SPN fingerprints and allows for higher identification rates.

There are two scenarios where FIA can be applied, namely image identification and image classification.  These are described below.

Identifier: 

An example where the FIA Identifier can be used is when an investigator has recovered a memory stick with a number of illegal images and a smart phone from a suspect. The suspect denies that the illegal photos were taken using the phone. The investigator can use the Identifier to create a fingerprint for the camera and extract the digital fingerprint for each image. The Identifier will then match all the fingerprints obtained from the images against the camera fingerprint.

The FIA Identifier allows users to link digital media to imaging devices.

Screen Shot 2016-06-29 at 11.43.47

Classifier: 

A second scenario occurs when an investigator has recovered a laptop, memory stick and external hard drive, all containing digital photos. Some of these photos contain illegal content while others are innocent photos that were taken by the suspect’s camera. The FIA Classifier can be used to group all the images recovered according to the imaging device that created them. If both the illegal and innocent images are placed in the same group, it will show that they were taken from the same camera.Screen Shot 2016-06-29 at 11.43.53

The FIA Classifier allows users to group together images that were created by the same imaging device.

For more information or to arrange a FREE TRIAL please contact ben.leary@forensic-pathways.com

Share this

Leave a reply