top of page

The Technology

Our solution employs innovative heuristic algorithms to calculate the probability of the forgery for each particular image. The algorithms assign files numeric values corresponding to the probability that the file has been manipulated. The module detects double compression artifacts that are typical for JPEG images lossy compression algorithms. The presence of such artifacts in an image is a reliable sign of the image being edited and saved.

Deep analysis of uploaded documents

Today's high-end digital cameras such as those produced by Canon or Nikon can digitally sign images to ensure their authenticity. In theory, when such images are altered, the embedded digital signature will no longer validate. Unfortunately, the technology is inherently flawed. There are tools allowing to put a valid digital signature on obviously fake images. It only takes minutes to produce a set of forged images that successfully pass validation with Nikon Image Authentication Software or Canon Original Data Security Kit (OSK-E3).

Therefore, digital signatures cannot be trusted, and should be disregarded completely as a positive proof of authenticity.

The Forgery Detection software looks elsewhere in the image to find signs that the image has been forged or altered.

Error Level Analysis

Manipulation attempts are detected by comparing compression quality between different areas of the image.

ErrorLevelAnalysis.jpeg

Clone Detection

Cloning, copying and pasting of certain objects or areas in the image is detected with scaling and rotation support.

CloneDetection.jpeg

Quantization Table Analysis

Digital cameras and PC-based image editing tools use different quantization tables when saving encoding images into JPEG format. Quantization tables can be extracted and analyzed. If the tables are different from those used by the camera model as specified in the image's EXIF information, then a manipulation attempt is present.

Double Compression Artifacts

JPEG is a lossy compression format, meaning that certain artifacts are introduced every time an image is saved. By opening, editing and saving a JPEG picture, one inevitably introduces compression artifacts that were not present in the original JPEG. As certain correlation of neighboring pixels is only present in JPEG images when they are opened and compressed again, it becomes possible to detect these artifacts and bring investigator's attention to the altered image.

Double Quantization Effect

This algorithm is based on certain quantization artifacts appearing when applying JPEG compression more than once. If a JPEG file was opened, edited, then saved, certain compression artifacts will inevitably appear.

double-quantization.png

In order to determine the double quantization effect, the algorithm creates 192 histograms containing discrete cosine transform values. Certain quantization effects will only appear on these histograms if an image was saved in JPEG format more than once. If the effect is discovered, we can definitely tell the image was edited (or at least saved by a graphic editor) at least once. However, if this effect is not discovered, we cannot make any definite conclusions about the image as it could, for example, be developed from a RAW file, edited in a graphic editor and saved to a JPEG file just once.

bottom of page