Forensic Image Analysis
Study of the authenticity, origin and information contained in images for investigative and expert work.
Photographing evidence is one of the most common activities in forensic investigation.
Forensic image analysis can be defined as the science concerned with the scientific and technical skills used to analyze and investigate photographic evidence, both digital and photochemical. It involves interpreting and determining its origin and authorship, the relationship between an image and the camera used to capture it, and the authenticity of the image itself, whether it has been manipulated, and therefore its evidentiary value.
A challenge for forensic experts
Forensic image analysis is one of the greatest challenges in technology-related expert work due to the absence of standardized protocols, the scarcity and ineffectiveness of software tools, and the widespread lack of understanding of the scientific and technological principles underlying digital image formation. Far from being a pessimistic view, this shows that there is a fascinating opportunity for the scientific community. Evidence of this can be found in the numerous image analysis studies, which are growing exponentially year after year and establishing the theoretical foundation for new analysis methods.
Much of the lack of methods is due to the fact that forensic image analysis currently falls within the field of digital forensics, treating the image as digital evidence. While this is true to some extent, the expert examination of digital images requires analysis beyond the files' computational properties. It requires a holistic study encompassing the full range of technologies underpinning photography: geometric and wave optics, the study of CCD and CMOS sensor hardware, color interpolation calculations, the conversion of the sensor's analog signal into Raster RGB digital images, compression systems, visual artifacts, photogrammetry, etc. Only in this way can we overcome the new challenges posed by this new era of decentralized information.
The objectives of forensic image examination are to establish a scientific method for determining causes and their origins, helping judicial authorities understand and analyze them with the highest degree of assurance.
The objectives of forensic image analysis can be divided into three groups:
- Image authentication and origin—the English term used for this type of analysis is “camera ballistics”—
- Obtain information from both the computer file and the image itself.
- Preserve evidence and present it with the highest possible assurance, maintaining the chain of custody at all times.
Methodological assurance
Digital evidence is obtained in accordance with the guidelines for the identification, collection, acquisition and preservation of electronic evidence set out in ISO/IEC 27037:2016. The standard recommends creating a forensic image of the memory of the device containing the relevant information. Subsequent analysis of this memory can recover data that has been deleted accidentally or intentionally.
Based on the results obtained and the prior assessment of each case, a clear and concise report will document all the evidence and expert analyses undertaken, providing legal evidence with the highest possible assurance to support the assessment of the work. The report will be prepared in accordance with UNE 197010:2015 and drawing on the extensive experience of our experts, providing the highest possible assurance for any subsequent legal proceedings.
Objectives of forensic image analysis
Forensic image analysis offers a wide range of possibilities for examining photographic evidence. Its main functions include:
Identification and classification of evidence.
- Cloning of storage media.
- Encrypted digital custody.
- Verification that photographic images and video have not been manipulated.
- Analysis of image integrity: detection of cloning, photomontages, image artifacts, etc.
Information retrieval.
- Precise measurements: photogrammetric analysis, orthophotographs.
- Identification of individuals: biometric analysis.
- Retrieval of hidden data: steganography.
- Metadata analysis: operating system information, e-mail metadata, analysis of light and shadows.
Image enhancement.
- Removal of blur and motion effects: convolution techniques, levels adjustment, etc.
- Removal of patterns and textures: Fourier transform calculation.
Unambiguously link the image to its source.
- Determine the origin and authorship of the image.
- Metadata analysis and logical and binary analysis of the file.
- Verification that any photographic or video image has not been manipulated
- Artifact analysis.