We know how to detect tampering and disclose false perceptions in digital images through digital image authentication.
Digital images aren’t always an accurate representation of the events as they occurred. The Federal Rules of Evidence require that digital images used as evidence be authentic. In order for a digital image to be used as evidence in court, it must be authentic. Our digital image authentication services can assist the trier of fact to determine the authenticity of a digital image submitted as evidence.
Are My Images Edited?
Are my images authentic? Media manipulation is the application of different editing techniques to digital images in order to deceive it’s viewer from the events as they naturally occurred. If these techniques are applied, a trained image forensic expert can detect these anomalies through several integrity verification tests. If the authentication investigation needs to be presented in court, an expert can generate a formalized report stating methods and opinions about the digital images.
THE IMPORTANCE OF AN ORIGINAL VIDEO RECORDING
Often times we receive video evidence that has been copied, and makes the analysis process difficult. The Scientific Working Group on Digital Evidence (SWGDE & IOCE) defines Original Digital Evidence as:
“The physical items and the data objects associated with such items at the time of acquisition or seizure.”
In other words, when the digital images have been removed from the system that created it, they are susceptible to manipulation and tampering, and may not be considered an original. When a copy has not been produced accurately as evidence, it is not an original. It’s important for everyone involved in the litigation to agree that the digital image is an authentic representation of the events.
CHAIN OF CUSTODY
It is important that the creator of the digital image provide chain of custody documentation. A chain of custody document explains how the digital image was handled from the time it was created, to the delivery to court. Some common questions that are answered in the chain of custody documentation are:
- Who created the image?
- What equipment was it created on?
- Who had access to the image?
- What activity was performed to the image?
These types of questions must be answered before beginning an investigation to determine if the authenticity of the chain of custody. Even if someone viewed or copied the digital images while in their possession, that activity must be noted in the chain of custody.
Another method we use to investigate the digital integrity is to analyze the chain of custody. Specific digital information bout the system that created it strengthens the authenticity of the chain of custody. This assists the expert in gathering information to create any sample images needed for the investigation.
DIGITAL IMAGE AUTHENTICATION SCIENCE
We begin all forensic video authentication and analysis investigations with a preliminary analysis. Throughout this process, our experts review the video recording in depth through frame by frame analysis. The goal of the preliminary analysis is to determine if any signs of tampering, anomalies or other red flags are present.
This allows us to learn more about your video recording before proceeding to more costly and detailed forensic testing. We accept retainers if we are confident that we can assist the investigation and the trier of fact scientifically and purposefully. Our preliminary analysis requires 1 hour of lab time to determine if an investigation is possible.
DIGITAL INTEGRITY VERIFICATION
The goal of the digital integrity verification testing is to authenticate the digital integrity of the format of the image evidence. Throughout this process we examine the digital information embedded within the image to determine if it is consistent with what we would expect to see from an original. This original recording would have been produced by the system that created it as a 1st generation copy.
One of the methods we are trained in is called the HASH test analysis. The HASH test is a series of numbers and letters that is considered a digital fingerprint of the digital file. It is compared to any other versions of the image to confirm consistency.
We also perform a 4 part digital information test that analyzes camera specifications of the image. This information may include footprints of third party software that were used to manipulate the digital image, such as Photoshop. Malicious edit detection and tampering can be detected through digital integrity verification testing.
Often times we are asked to authenticate the images date/time stamp information. Authentication testing may reveal that the date/time stamp information was not maintained or is not accurate under certain circumstances.
The image authentication investigation doesn’t stop in the digital world either. If cloning or copying methods of physical images are used, a loss in quality can be scientifically observed and documented. This quality loss detection is also applied when authenticating digital image file formats such as JPEG, BMP, TIFF, PDF and many more.
Image compression may introduce artifacts and reduce crucial information important to the authenticity of the events as they were recorded. If this information is not accurately captured in the digital image, the digital images used as evidence MAY NOT be considered authentic. If a digital image isn’t of sufficient image quality due to image compression, the digital image will lack authenticity. In other words, it lacks the necessary criteria to make an accurate identification of a suspect, vehicle or other object.
Sometimes it becomes necessary to create an exemplar recording (known recording) to analyze and compare against the evidence recording (unknown recording). In order to create an exemplar accurately, you must determine the type of equipment (camera) that created the original digital image. Then you can obtain or gain access to that equipment and create test sample for analysis.
This is the most accurate way to confirm the authenticity of the digital image, if the original evidence is unavailable. Throughout this process we also analyze the behavior of the system at the time it captured the digital image. Are the original camera’s specifications consistent with what the “original digital image” depicts that was submitted as evidence?
When under oath the expert witness has sworn to speak accurately and truthfully. Much like a deposition, courtroom testimony can be an intense situation for an expert. Our experts understand the process of direct and cross examination.
When we prepare for testimony, we anticipate all questions that will be asked of us during direct and cross examination. We understand that our attorney clients will never ask a question that they don’t know the answer to. Helping the tier of fact to understand the scientific analysis in a simple way is important to our experts.
Image Forensic Expert Michael Primeau has experience testifying as an image expert witness. He has testified in local and state courts all over the USA and worked with lawyers around the world.