$24
Assignment 4 Solution
Part 1: Verifying an Image’s Source Using JPEG Quantization Tables
In many scenarios, it is important to determine or verify the source of a digital image. One way to do this is by examining the metadata tags associated with an image. By default, most digital cameras append metadata tags indicating the camera model and manufacturer to images that they capture. Unfortunately, these metadata tags can be easily edited. As a result, a forger can falsify the source of a digital image by changing its metadata tags to indicate that a di erent digital camera was used to capture the image.
In class, we discussed a method to verify the source of a digital image using JPEG quantization tables. By default, most digital cameras store the images that they capture as JPEGs in order to save space. However, most digital cameras and editing software do not use the standard JPEG quantization tables when compressing an image. Instead, they use proprietary quantization tables that have been designed to better balance the trade-o between le size and image quality.
Since each camera or software manufacturer uses their own set of quantization tables, a forensic investigator can use this information to trace the source of a digital image. This is done by rst reading the quantization tables used to encode and decode a JPEG from its header information. These tables can then be compared with a list of quantization tables used by di erent digital camera models and image editing software packages.
In class, we discussed a software tool called JPEGsnoop that can be used to read the quantization tables from a JPEG’s header. JPEGsnoop also compares these quantization tables to a list of known quantization tables used by di erent cameras and image editing programs.
Download JPEGsnoop using the following link: https://www.impulseadventure.com/dl.php? le=JPEGsnoop v1 8 0.zip
Note: JPEGsnoop is only designed to run on computers using a Windows operating system. Linux users can reportedly run JPEGsnoop under wine and Mac users can run JPEGsnoop using CrossOver Mac.
Use JPEGsnoop to analyze the following images: imageOrigin1.jpg, imageOrigin2.jpg, imageOri-gin3.jpg, imageOrigin4.jpg, imageOrigin5.jpg, and imageOrigin6.jpg. What are the camera man-ufacturer and camera model reported in the metadata tags (Exif) for each image? Does each image have metadata tags specifying the camera manufacturer and model? What are the luminance and chrominance quantization tables for each image? Do these quantization tables match the camera reported in each image’s metadata? If not, does JPEGsnoop report that these quantization tables match those used by any image editing software? Furthermore, if JPEGsnoop doesn’t nd a match between the quantization tables and the metadata tags, does this mean that the image’s origin has been falsi ed? Why or why not?
How could a forger fool falsify the origin of a digital image (i.e. pass the image o as having been captured by a di erent camera) and fool a program like JPEGsnoop?
Part 2: Detecting JPEG Compression Using Blocking Artifacts
Because an image’s JPEG compression history can reveal a great deal of forensic information about an image, a forger may attempt to pass o a JPEG compressed image as an image that was never compressed. One way that a forger can attempt to do this is by decompressing a JPEG, then re-saving the resulting image in an uncompressed format such as bitmap or ti .
1
ECES 435 - Drexel University
Instructor: Matthew Stamm
In class, we discussed how JPEG compression leaves behind blocking ngerprints in a digital image. These blocking ngerprints can be detected using the algorithm proposed by Fan and de Quieroz in their paper \Iden-ti cation of Bitmap Compression History: JPEG Detection and Quantizer Estimation". This algorithm operates by measuring the di erence between pixel values at the center of each 8 8 block of pixels and comparing it to the di erence between pixel values located at the corners of 4 separate 8 8 pixel blocks.
A detailed description of the algorithm is provided below:
1. For each 8 8 pixel block in the image, calculate the values
Z0
(i; j) =
A
B
C + D
j
(1)
Z00
j
E
F
G + H
(2)
(i; j) =
j
j
where(i; j) denotes the block indices (i.e. the ith block in the row direction and the jth block in the column direction), and A; B; C; D; E; F; G and H are the values of the pixels in the positions shown in the gure above.
Calculate the normalized histogram HI (n) of Z0 values and the normalized histogram HII (n) of the Z00 values.
Note: A normalized histogram is calculated by dividing each histogram entry by the sum of all of the histogram entries. The Matlab function hist can be used to calculate the histograms of K0 and K00 values.
Measure the strength K of the blocking ngerprints using the equation
X
K = jHI (n) HII (n)j: (3)
n
Determine if the image was previously JPEG compressed by comparing the blocking ngerprint strength to a detection threshold . The algorithm detects evidence of JPEG compression if K and classi es the image as never compressed if K .
Brie y explain why the histograms of K0 and K00 values should be di erent if an image has been JPEG compressed.
Write a Matlab function that calculates the implements Fan and de Quieroz’s JPEG blocking artifact detec-tion algorithm. This function should accept the image to be examined as an input and return the value K as an output. Additionally, this function should display the histograms HI and HII in the same plot. Please fully comment your code and append it to your report.
2
ECES 435 - Drexel University
Instructor: Matthew Stamm
Use the function you wrote to examine the images blockArtifacts1.tif, blockArtifacts2.tif, and blockAr-tifacts3.tif for blocking artifacts. Use = 0:25 as your detection threshold. Include the K value that you measure for each image as well as plots of the histograms HI and HII in your report.
3
