View Single Post
  #2  
Old September 20th 12, 10:07 PM posted to rec.photo.digital.slr-systems,alt.photography,rec.photo.digital
Martin Brown
external usenet poster
 
Posts: 821
Default Forensics v. Photoshop

On 20/09/2012 21:49, Alan Browne wrote:
On 2012.09.20 04:26 , Martin Brown wrote:

There are a handful of independent JPEG implementations - most follow
the original spec closely enough that there is little or no distinction
between them (apart from in PSPro 8 which contained gross errors). It
has to be like that or you would see much worse artefacts if some JPEG
encoders made significant mistakes (as in fact happened with PsP 8).


These folks seem to have statistical evidence to the contrary which
trumps your knee jerk assumptions.

It will be judged in the marketplace of those who are concerned with
such. If there is value it will be quickly found. Or not.


I agree. Snake oil will be fairly quickly smoked out.

The only real variation is the exact choice of quantisation table and
Photoshop is distinctive there, but most of the rest use a scaled
version of the canonical JPEG standard Qtables from the original spec.


Assumption.


Not an assumption at all - I know that for a fact. I have written
software that analyses damaged JPEGs. There are only a handful of
cameras and applications that use custom non-standard Qtables that are
unrelated to the "examples" given in the original spec. Virtually
everything apart from Photoshop uses scaled copies of the JPEG example.

One such was PsPro 8 which included a typo in the Y matrix and various
faulty chroma downsampling algorithms which distorted the results. Such
errors are rare and are seldom detected by end users.

Not really. Tools to do this have been around more or less since the
JPEGLIB codec was completed. CJPEG can compress an image with any
arbitrary quantisation if you ask it nicely. Splicing in the fake Exif
data for a given camera signature is a pretty trivial binary edit.

It probably is - but that's not what this sw is detecting. Above.


That is all that they have claimed. I have already pointed a link at
freeware that does exactly the same job (and much the same way).

The file signature is pretty much determined by the miscellaneous dross
that each vendor adds to the header for the JPEG stream and how many
implementation ambiguities/mistakes they make in their encoding of Exif
data. Luckily most decoders can cope with quite badly malformed Exif so
there is scope for recognising certain brands there.


Again, as if you didn't read the article or see the video, the signature
aspect has to do with the content, not the additional data.


I did read the site and their description matches my interpretation of
what they are offering. The camera "signature" is in the fluff around
the JPEG stream and not in the coefficient stream itself.

http://www.fourandsix.com/fourmatch

Such "signatures" can be easily forged with the right tools.

The JPEG coefficient stream has a limited number of encoding
possibilities and only a few of them are actually seen in practice.

--
Regards,
Martin Brown