Forensics v. Photoshop
 

Martin Brown wrote:
On 19/09/2012 22:44, Alan Browne wrote:
On 2012.09.19 03:13 , Martin Brown wrote:
On 18/09/2012 23:52, Alan Browne wrote:

Raise doubts. It's claim is to look at how images are made (signature)
by the camera. If there is a doubt it will be raised. A change to an
image in PS would not pass that.

Only a cack handed amateur would do it that way. It really isn't that
difficult to transplant an arbitrary JPEG stream into a given cameras
signed envelope. Anyone that relies on this tool is an idiot.

Turn off your assumptions. By signature they are looking at what are
essentially artifacts of how various cameras generate their output.

Perhaps "fingerprint" would be a better term.

Certainly if you are working in their firm's marketing department.

There are a handful of independent JPEG implementations - most follow
the original spec closely enough that there is little or no distinction
between them (apart from in PSPro 8 which contained gross errors). It
has to be like that or you would see much worse artefacts if some JPEG
encoders made significant mistakes (as in fact happened with PsP 8).

The only real variation is the exact choice of quantisation table and
Photoshop is distinctive there, but most of the rest use a scaled
version of the canonical JPEG standard Qtables from the original spec.

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

-Wolfgang

Forensics v. Photoshop
 

On 20/09/2012 16:47, Wolfgang Weisselberg wrote:
Martin Brown wrote:
On 19/09/2012 22:44, Alan Browne wrote:
On 2012.09.19 03:13 , Martin Brown wrote:
On 18/09/2012 23:52, Alan Browne wrote:

Raise doubts. It's claim is to look at how images are made (signature)
by the camera. If there is a doubt it will be raised. A change to an
image in PS would not pass that.

Only a cack handed amateur would do it that way. It really isn't that
difficult to transplant an arbitrary JPEG stream into a given cameras
signed envelope. Anyone that relies on this tool is an idiot.

Turn off your assumptions. By signature they are looking at what are
essentially artifacts of how various cameras generate their output.

Perhaps "fingerprint" would be a better term.

Certainly if you are working in their firm's marketing department.

There are a handful of independent JPEG implementations - most follow
the original spec closely enough that there is little or no distinction
between them (apart from in PSPro 8 which contained gross errors). It
has to be like that or you would see much worse artefacts if some JPEG
encoders made significant mistakes (as in fact happened with PsP 8).

The only real variation is the exact choice of quantisation table and
Photoshop is distinctive there, but most of the rest use a scaled
version of the canonical JPEG standard Qtables from the original spec.

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

--
Regards,
Martin Brown

Forensics v. Photoshop
 

On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

--
"There were, unfortunately, no great principles on which parties
were divided – politics became a mere struggle for office."
-Sir John A. Macdonald

Forensics v. Photoshop
 

On 21/09/2012 21:43, Alan Browne wrote:
On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

Not a chance after JPEG encoding.
Too much of the noise signature is lost.

Would you like to buy London Bridge?

--
Regards,
Martin Brown

Forensics v. Photoshop
 

On 2012.09.21 17:34 , Martin Brown wrote:
On 21/09/2012 21:43, Alan Browne wrote:
On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

Not a chance after JPEG encoding.
Too much of the noise signature is lost.

It may be compressed into a narrower range and some will disappear in
the JPG encoding, but some will remain (all JPG's show noise from the
camera). As such enough sample images from a given model will reveal
noise attributes traceable to that camera model (or range of cameras
with the same sensor/a-d/n-r chain).

--
"There were, unfortunately, no great principles on which parties
were divided – politics became a mere struggle for office."
-Sir John A. Macdonald

Forensics v. Photoshop
 

On Fri, 21 Sep 2012 22:34:36 +0100, Martin Brown
wrote:

On 21/09/2012 21:43, Alan Browne wrote:
On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

Not a chance after JPEG encoding.
Too much of the noise signature is lost.

Would you like to buy London Bridge?

Here is the original claim:

"The many signatures arise from the malleability of the JPEG
standard, the format in which nearly all cameras save images.
Different cameras and mobile devices have varying sensor sizes and
resolution settings, and techniques for handling thumbnail pictures
and image metadata. Different cameras and software use different
methods to compress image files. All leave telltale digital
tracks."

The software claims to be able to identify the specific parameters
which link the camera to the JPG image. If there only five parameters
to be identified and there are fourteen variations of each then it is
not hard to end with 70,000 different unique combinations. Of course
its not quite that simple. The claim sounds credible. That's not the
same as saying it is correct.
--

Regards,

Eric Stevens

Forensics v. Photoshop
 

On 22/09/2012 05:05, Eric Stevens wrote:
On Fri, 21 Sep 2012 22:34:36 +0100, Martin Brown
wrote:

On 21/09/2012 21:43, Alan Browne wrote:
On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

Not a chance after JPEG encoding.
Too much of the noise signature is lost.

Would you like to buy London Bridge?

Here is the original claim:

"The many signatures arise from the malleability of the JPEG
standard, the format in which nearly all cameras save images.
Different cameras and mobile devices have varying sensor sizes and
resolution settings, and techniques for handling thumbnail pictures
and image metadata. Different cameras and software use different
methods to compress image files. All leave telltale digital
tracks."

The software claims to be able to identify the specific parameters
which link the camera to the JPG image. If there only five parameters
to be identified and there are fourteen variations of each then it is
not hard to end with 70,000 different unique combinations. Of course
its not quite that simple. The claim sounds credible. That's not the
same as saying it is correct.

The claim is credible from the point of view that if everyone is
completely honest never puts a foreign JPEG stream inside another
cameras signed envelope their software can identify from the choice of
compression parameters and the quirks in the interpretation of the
dreadful ambiguous Exif "standard" which camera or app it came from.

(there are roughly speaking about 500 distinct Qtables in use but less
than 100 are common and fewer than 10 make up the bulk of all images)

I have already pointed at freeware that does exactly this using the same
methodology. But it is not forensically sound. An expert can too easily
fake the headers to for example make it look like Neil Armstrong was
stood on the moon and photographed with an Ixus V.

--
Regards,
Martin Brown

Forensics v. Photoshop
 

On Sat, 22 Sep 2012 09:10:07 +0100, Martin Brown
wrote:

On 22/09/2012 05:05, Eric Stevens wrote:
On Fri, 21 Sep 2012 22:34:36 +0100, Martin Brown
wrote:

On 21/09/2012 21:43, Alan Browne wrote:
On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

Not a chance after JPEG encoding.
Too much of the noise signature is lost.

Would you like to buy London Bridge?

Here is the original claim:

"The many signatures arise from the malleability of the JPEG
standard, the format in which nearly all cameras save images.
Different cameras and mobile devices have varying sensor sizes and
resolution settings, and techniques for handling thumbnail pictures
and image metadata. Different cameras and software use different
methods to compress image files. All leave telltale digital
tracks."

The software claims to be able to identify the specific parameters
which link the camera to the JPG image. If there only five parameters
to be identified and there are fourteen variations of each then it is
not hard to end with 70,000 different unique combinations. Of course
its not quite that simple. The claim sounds credible. That's not the
same as saying it is correct.

The claim is credible from the point of view that if everyone is
completely honest never puts a foreign JPEG stream inside another
cameras signed envelope their software can identify from the choice of
compression parameters and the quirks in the interpretation of the
dreadful ambiguous Exif "standard" which camera or app it came from.

(there are roughly speaking about 500 distinct Qtables in use but less
than 100 are common and fewer than 10 make up the bulk of all images)

I have already pointed at freeware that does exactly this using the same
methodology. But it is not forensically sound. An expert can too easily
fake the headers to for example make it look like Neil Armstrong was
stood on the moon and photographed with an Ixus V.

I don't know anything about the JPG file structu I've never
bothered to find out. I think I will have to go away and study the
subject.
--

Regards,

Eric Stevens

Forensics v. Photoshop
 

On Sat, 22 Sep 2012 20:33:19 +1200, Eric Stevens
wrote:

On Sat, 22 Sep 2012 09:10:07 +0100, Martin Brown
wrote:

On 22/09/2012 05:05, Eric Stevens wrote:
On Fri, 21 Sep 2012 22:34:36 +0100, Martin Brown
wrote:

On 21/09/2012 21:43, Alan Browne wrote:
On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

Not a chance after JPEG encoding.
Too much of the noise signature is lost.

Would you like to buy London Bridge?

Here is the original claim:

"The many signatures arise from the malleability of the JPEG
standard, the format in which nearly all cameras save images.
Different cameras and mobile devices have varying sensor sizes and
resolution settings, and techniques for handling thumbnail pictures
and image metadata. Different cameras and software use different
methods to compress image files. All leave telltale digital
tracks."

The software claims to be able to identify the specific parameters
which link the camera to the JPG image. If there only five parameters
to be identified and there are fourteen variations of each then it is
not hard to end with 70,000 different unique combinations. Of course
its not quite that simple. The claim sounds credible. That's not the
same as saying it is correct.

The claim is credible from the point of view that if everyone is
completely honest never puts a foreign JPEG stream inside another
cameras signed envelope their software can identify from the choice of
compression parameters and the quirks in the interpretation of the
dreadful ambiguous Exif "standard" which camera or app it came from.

(there are roughly speaking about 500 distinct Qtables in use but less
than 100 are common and fewer than 10 make up the bulk of all images)

I have already pointed at freeware that does exactly this using the same
methodology. But it is not forensically sound. An expert can too easily
fake the headers to for example make it look like Neil Armstrong was
stood on the moon and photographed with an Ixus V.

I don't know anything about the JPG file structu I've never
bothered to find out. I think I will have to go away and study the
subject.

Wow!

Having looked at Wikipedia on the subject I've come away more than a
little gob-smacked. There are so many ways to construct a JPG file it
would be surprising if any two cameras produced identical finger
prints from their files.
--

Regards,

Eric Stevens

Forensics v. Photoshop
 

On 2012.09.22 04:10 , Martin Brown wrote:
On 22/09/2012 05:05, Eric Stevens wrote:
On Fri, 21 Sep 2012 22:34:36 +0100, Martin Brown
wrote:

On 21/09/2012 21:43, Alan Browne wrote:
On 2012.09.21 03:12 , Martin Brown wrote:
On 20/09/2012 16:47, Wolfgang Weisselberg wrote:

So there's no variation in noise between camera types, sensor
technology and pixel sizes? There's no different JPEG denoising
between cameras?

Cameras making JPEG files are only writing the JPEG stream. There
might
be tiny differences in the exact sensor demosaicing code but that will
largely be hidden when the file is saved JPEG 2x1 chroma
subsampled. I'd
give better odds for recognising a full RAW file with all the sensor
calibration info still in it.

What W said is the real point of it: what leaks through the physics
into
the image - raw or JPG - will fingerprint the camera design. Look at
enough image samples and it comes out.

Sensor noise might allow you distinguish a few *very* old and
thermally
noisy cameras but that is about all. The odd camera has insane default
settings usually oversharpened which would also be easy to spot.

Given the statistical methods used by them even new "quieter" cameras
will in the end give up their signatures - even via JPG.

Not a chance after JPEG encoding.
Too much of the noise signature is lost.

Would you like to buy London Bridge?

Here is the original claim:

"The many signatures arise from the malleability of the JPEG
standard, the format in which nearly all cameras save images.
Different cameras and mobile devices have varying sensor sizes and
resolution settings, and techniques for handling thumbnail pictures
and image metadata. Different cameras and software use different
methods to compress image files. All leave telltale digital
tracks."

The software claims to be able to identify the specific parameters
which link the camera to the JPG image. If there only five parameters
to be identified and there are fourteen variations of each then it is
not hard to end with 70,000 different unique combinations. Of course
its not quite that simple. The claim sounds credible. That's not the
same as saying it is correct.

The claim is credible from the point of view that if everyone is
completely honest never puts a foreign JPEG stream inside another
cameras signed envelope their software can identify from the choice of
compression parameters and the quirks in the interpretation of the
dreadful ambiguous Exif "standard" which camera or app it came from.

(there are roughly speaking about 500 distinct Qtables in use but less
than 100 are common and fewer than 10 make up the bulk of all images)

I have already pointed at freeware that does exactly this using the same
methodology. But it is not forensically sound. An expert can too easily
fake the headers to for example make it look like Neil Armstrong was
stood on the moon and photographed with an Ixus V.

There you go off track again.



--
"There were, unfortunately, no great principles on which parties
were divided – politics became a mere struggle for office."
-Sir John A. Macdonald