What is Digital Image Authentication?
The definition of image authentication is defined by SWGDE (Scientific Working Group on Digital Evidence):
“The application of image science and domain expertise to discern if a questioned image or video is an accurate representation of the original data by some defined criteria, and/or the determination of the original source of the image (PG 4 best practices for digital image authentication).”
If the authentication investigation needs to be presented in a court of law, an expert can help. Our experts can generate a formalized report outlining our qualifications, authentication methodology and opinions. This assists the trier of fact make determinations about the images used as evidence.
We begin all forensic video authentication and analysis investigations with a preliminary analysis. Throughout this process, our experts review the video recording in depth through frame by frame analysis. The goal of the preliminary analysis is to determine if any signs of tampering, anomalies or other red flags are present.
This allows us to learn more about your video recording before proceeding to more costly and detailed forensic testing. We accept retainers if we are confident that we can assist the investigation and the trier of fact scientifically and purposefully. Our preliminary analysis requires 1 hour of lab time to determine if an investigation is possible.
Digital Integrity Verification Testing
The goal of the digital integrity verification testing is to authenticate the digital integrity of the format of the image evidence. Throughout this process we examine the digital information embedded within the image to determine if it is consistent with what we would expect to see from an original. This original recording would have been produced by the system that created it as a 1st generation copy.
This is the point in the investigation where we can provide image edit detection testing as well. Photo editing software has become readily available to the public, as well as simple to use. Most image editors like Adobe Photoshop and Microsoft Paint can provide photo editing capabilities with ease. In most cases these photo editors will leave behind a footprint in the digital information that is detectable through forensic testing.
One of the methods we are trained in is called the HASH test analysis. The HASH test is a series of numbers and letters that is considered a digital fingerprint of the digital file. It is compared to any other versions of the image to confirm consistency.
We also perform a 4 part digital information test that analyzes camera specifications of the image. This information may include footprints of third party software that were used to manipulate the digital image, such as Photoshop. Malicious edit detection and tampering can be detected through photo tampering detection.
Often times we are asked to authenticate the images date/time stamp information. Authentication testing may reveal that the date/time stamp information was not maintained or is not accurate under certain circumstances.
Pixel Authentication Verification Testing
The authentication investigation doesn’t stop in the digital world either. If cloning or copying methods of physical images are used, a loss in quality can be scientifically observed and documented. Quality loss is detectable through digital image conversion to courtroom ready formats (JPEG, BMP, TIFF, PDF and many more). Clone detection testing is most commonly detectable when images have been copied or converted.
Error level analysis testing will additions or reductions of pixel information fro an image. In other words, if something has been added or redacted in a digital image/video, ELA testing can detect it.
Image compression may introduce artifacts and reduce crucial information important to the authenticity of the events as they were recorded. Photo effects and other conversion methods may alter the perception of the events as they occurred. Due to the culture of image social media platforms, these processes go unnoticed to most litigators and even law enforcement agencies. The understanding of these processes and how they are applied is crucial to the accuracy of the investigation.
If a digital image isn’t of sufficient image quality due to image compression, the digital image will lack authenticity. In other words, it lacks the necessary criteria to make an accurate identification of a suspect, vehicle or other object.
Exemplar Sample Comparison Testing
Sometimes it becomes necessary to create an exemplar recording (known recording) to analyze and compare against the evidence recording (unknown recording). In order to create an exemplar accurately, you must determine the type of equipment (camera) that created the original digital image. Then you can obtain or gain access to that equipment and create test sample for analysis.
This is the most accurate way to confirm the authenticity of the digital image, if the original evidence is unavailable. Throughout this process we also analyze the behavior of the system at the time it captured the digital image. Are the original camera’s specifications consistent with what the “original digital image” depicts that was submitted as evidence?
Expert Witness Testimony
When under oath the expert witness has sworn to speak accurately and truthfully. Much like a deposition, courtroom testimony can be an intense situation for an expert. Our experts understand the process of direct and cross examination.
When we prepare for testimony, we anticipate all questions that will be asked of us during direct and cross examination. We understand that our attorney clients will never ask a question that they don’t know the answer to. Helping the tier of fact to understand the scientific analysis in a simple way is important to our experts.
Image Forensic Expert Michael Primeau has experience testifying as an image expert witness. He has testified in local and state courts all over the USA and worked with lawyers around the world.