Introduction to Digital Forensics/Image investigations

Image Investigations One of the most common aspects of any digital forensic investigation is that of image forensics. It is an unavoidable fact that one of the most common crimes looked at within the field is that of child pornography, but beyond that images can have a number of evidential uses in other settings. For example, we previously discussed how some browsers store thumbnails of visited sites, useful to proving what a user saw on their screen. With the Google Chrome browser this can sometimes amount to many hundreds of images to work through, this is the inherent disadvantage introduced by image analysis; there tends to be a lot of them. A basic installation of Windows, for example, could contain thousands of images and just one computer game tens of thousands. Finding ways to process and filter relevant images in bulk is one of the foremost issues in digital forensics. Extracting images Finding what you need Images can contain information in several ways. There's the image itself, which may consist of material that may be illegal to possess in some jurisdictions. For example depictions of abuse, classified information or falsified identification documents. There is also metadata, like EXIF data which is commonly written by cameras and scanners. EXIF may contain GPS coordinates, make and model of the camera used, sometimes even the serial number of the camera. The settings that were used (like F-stop, focal length, exposure time, etc) are also commonly recorded. Together with Arm, BBC, Intel, Microsoft and Truepic, Adobe co-founded the non-profit Coalition for Content Provenance and Authenticity (C2PA) in February 2021. The C2PA is tasked with the formulation of an open, royalty-free technical standard that serves as a basis for the C2PA member's efforts against disinformation. While the C2PA's work applies to the technical aspects of implementing a provenance metadata standard, the CAI sees its task as the dissemination and promotion of the standard. Both C2PA and Google's SynthID may reveal that an image has been tampered with, but the absence of them is not proof that an image is genuine. The image format may also reveal clues about its provenance. For example, if a photograph is found in PNG format with a resolution of 1920×1080, it is likely a screenshot as photos are rarely saved in PNG format and 1920×1080 is a common display resolution. thumb|upright|A couple at the beach. This picture hides more details in plain sight. Can you spot them? Some images contain much more information than meets the eye. Look at this image of a couple at the beach. Where was this photo taken? Who took it? The beach and the sea have few identifiable properties. If we look closely, three ships can be seen in the background. They are out of focus, but if we roughly know when and where this picture was taken perhaps their routes could be tracked down. It would still be difficult to determine the exact location based on some distant ships, and it won't identify the photographer. So take another look. Look into their eyes. Or rather, their sunglasses. Many people don't notice the details in reflections. In this case, we can clearly see that the woman took the picture. We see her extended arm holding a smartphone, we even see the wrist strap she's using. We also see beach chairs, parasols, trees and some structures. The water and the sand were impossible to identify, but now we see a location that is uniquely identifiable. When investigating images, think about all the ways an image may contain more information than the author intended to record. The COPINE scale Introduction to Digital Forensics Image Investigations