INVESTIGATIVE FORENSICS

Assignment 3

A Survey on image and Video Forensics

Michael Wood
B4024681@my.shu.ac.uk
Contents
1.0 Abstract ........................................................................................................................................... 2
2.0 Introduction ..................................................................................................................................... 2
2.1 Background................................................................................................................................. 2
2.2 Motivation .................................................................................................................................... 3
2.21 Image Tampering ................................................................................................................ 3
2.22 Image enhancement ........................................................................................................... 4
2.23 Number plates ...................................................................................................................... 5
2.24 Video stabilization ............................................................................................................... 6
2.25 Moving object identification and tracking ......................................................................... 6
2.26 Face recognition .................................................................................................................. 7
2.27 Image source identification ................................................................................................ 7
2.28 Watermarking ....................................................................................................................... 7
2.3 Accuracy ..................................................................................................................................... 8
3.0 Current challenges and Future plans ......................................................................................... 8
4.0 Conclusion ...................................................................................................................................... 9
5.0 Bibliography .................................................................................................................................. 10
Investigative Forensics
1.0 Abstract
Throughout this report I will be talking about how image and videos are used in forensics.
They are part of an advanced digital forensics and an important part of the forensic
investigation. Images and videos play an important role in forensics, photographs and other
recording can represent a very key role in documenting a crime or incident that may have
happened. Visual records are easily preserved for later use by forensic investigators for
example, they can also be used for eyewitnesses and used in courts for evidence. A
complete photographic recording of a person, or a place, or item is evidence that allows
investigators to determine who may not have been present at a certain time the images or
videos were taken. I will be going through how forensics investigators use images and
videos in crimes and how sometimes it may be difficult to determine whether something has
been tampered with or if it is actually legit.

2.0 Introduction
Digital images are everywhere that we go, whether this be from our mobile phones to the
cameras that you see in the street. The aim of forensic images is to get information from
CCTV cameras or any other cameras that may be in action and make them readable,
especially images that appear noisy or unfinished. The quality of surveillance imagery is
usually quite low. This is often caused by poor lighting, poor media quality, and extreme
motion. The main aspects of digital images are looking at them and deciding whether it
represents a crime or is it simply a scene that may have never existed, meaning it may have
been tampered with. Before action can be taken on an individual due to an image, we must
look at the image itself. Investigators will require the best tools that they will use to tackle the
challenges that have been presented in front of them and deciding whether it is malicious, or
not.

2.1 Background
Images and video evidence can be found now at more locations and more varied sources
than ever before. From shopping mauls to fast food restaurants and to bank, CCTV systems
are now almost everywhere you go. Cell phones cameras now extend a observant eye to
every town that you may be in. Images and videos can be considered real time eyewitness
for any crime and is the best type of electronic evidence. In recent years since forensics and
investigation had been increased now images and videos are without doubt one of the best
optimized pieces of evidence.
They are the most compelling forms of evidence that can used in a courtroom, though it is
important that steps are taken when preparing them to the court. In forensics, we now have
a lot of reality TV shoes that show us how forensics is used in crimes. Martino Jerian (2017)
says “Within the field of forensic image and video analysis one of the biggest issues we face
is the CSI effect: the phenomenon whereby representations of forensic science on popular
TV shows gives a distorted perception of what is possible; from endless zooming from
satellite imagery, to enhancing the reflection of a reflection of a reflection. We very often
have to explain, even to the experts, what is science and what is fiction.” This means that
what you see on TV, is not how it works in the real word, as the technology shown on tv is so
much more advanced compared to what we have.
So why do individuals want to manipulate photos? People who manipulate photos tend to do
it for a number of reason, such as:
  Make someone look heroic
 Erase enemies
 Propaganda
 Media stunts
 Greed
Forensics investigators when looking at an image can usually tell by looking for clues of
fakes. Lighting plays a big part in this as they look for differences in lighting direction and
shadow differences. Eye positions and sparkles in eyes are important as well, this can be
the shape, colour and location of these reflections.

2.2 Motivation
My incentive in writing this report is to show how difficult it can be for forensics to show how
an image or video can be manipulated, or how showing it is legit. Digital images and videos
are being used in many places such as businesses and law enforcements and crime
preventions. It is important that when a piece of digital evidence is found that it must be
proved that it came from the claimed device. As technology is getting smarter, though more
complicated, software’s are out now that could make an image or video look so legit that you
would not be able to tell the difference between the real one and the tampered one at all.
When presenting digital images and videos in court during prosecution, there should be an
assurance and the source and truthfulness of the evidence provided, if not then they may not
be acceptable in court.

2.21 Image Tampering

Photographs have been considered to be the most trusted piece and most authoritative
media of expression. For many years these were accepted as prove of evidence in several
things, such as images you see on the news, military intelligence, scientific research and
even forensic investigation and many more. Now, images can be completely manipulated to
make us see a different side to a story. Unfortunately, due to the fast advancements in the
field of digital image processing, we can look upon a picture and think it is genuine. Due to
the increasing availability of low costs, or even sometimes for free like image editing
software: such as photoshop, and pixelmator have made the tampering with images to
become more easier and a lot more common. As I have said, it has become quite hard now
to look at a photograph and decide whether it is actually a genuine camera output, or
whether it has been manipulated. Therefore, image tampering detection has come as an
important study so that we can decide the genuineness of photographs by then
unscrambling the tampered images from the original ones.
An example of image tampering is:
2.22 Image enhancement
This is the process of manipulating a stored image using some kind of software. The tools
that can be used for this have many different types such as filters, image editors and other
tools that may change the properties of the whole image, or even parts of it.
There are many ways that image enhancement can be done and a basic one is to merely
change the contrast or brightness of an image and sometimes even manipulate the photo
and make it grayscale or different colours. More sophisticated types of this can be
manipulated to apply changes to more on a specific area on the image. Software’s that allow
you to do this such as adobe will allow designers to do a more professional image enhancing
where the image is changed in to a stylized or blown up version of itself. Forensic
investigators may use image enhancement or de-blur an image or restore or clarifying
images that may be in poor condition. Before and after image below:
2.23 Number plates
2.231 Licence plate recognition in images
To recognize licence places that have been taken in a low-resolution frame is commonly a
big problem, especially through cameras on the street as their quality is not always brilliant.
Though forensic investigators do have a way to recognize blurred licence plates in images.
One of the main methods that they use contains three steps. The first step is using a single
character template by identifying the position of the characters on the plate and then
estimating the corresponding character list. Following this, they then position a special
symbol on the plate and it is estimated. Lastly, to improve the recognition final, they expand
the single character templates to multiple character templates.

2.232 Automatic Number Plate Recognition

Automatic number plate recognition (ANPR) is used to help detect vehicles which may have
a record. If a vehicle passes an ANPR camera, then the registration plate is read and is
straight away checked against a database for records of vehicles. A police officer may
intercept and if needed, stop a vehicle and search it for any evidence and if required make
an arrest. The archives of vehicles that have past an ANPR camera is stored, this also
includes vehicles that are not of attention at the time of the read and if required that may be
investigated in time if needed. This can be used in many crimes such as, finding stolen
vehicles, uninsured vehicles and sometimes even more major cases such as terrorism.
2.24 Video stabilization
An example of video stabilization is that if you have a recording of a vehicle going from left to
right then you can not use a denoise filter, this is because everything in the scene is
changing due to it moving. Forensics use stabilize filters which uses the shape matching and
velocity to freeze the moving car for example, in the same place. The software that they use
will match the pixels on the screen and then draws directional motion tracks. When the
motion has been estimated, the camera will then move in the same direction and speed. I
can not post an image of how video stabilization works, but I will put a link in showing you
how. When you look at the video you will notice the one of the left is not sturdy, though the
one on the right is very sturdy and the man is in time with the camera, this is the video of
stabilization. https://www.androidpolice.com/2017/11/15/pixel-2-uses-fused-video-
stabilization-technology-behind-incredible/

2.25 Moving object identification and tracking

Moving object identification and tracking is important in video analysis and is mainly used in
cameras that may be on the street. It is used in tracking something, such as a car and every
move that they take so that they can not be mislaid when checking them. Though sometimes
a vehicle can be lost, but then picked up in other places as the car moves around within that
area.
2.26 Face recognition
Just like automated fingerprints that are used to identify people, facial recognition can
provide forensic investigators with a tool that will increase public safety. Though fingerprints
are usually higher rates of accuracy, face recognition provides a very good benefit when the
fingerprints in an individual does not exist. Face recognition can provide the law in identifying
number of things, such as:

 Identify a criminal
 Identify missing person
 Identify unidentified person of interest
 Verify mugshots received against a database

2.27 Image source identification

This is important if such evidence is to be presented in court. If a CCTV or any other camera
has managed to capture a crime scene and is then presented in court, the forensic
investigator must be able to clarify in court that the image did come from the claimed camera
that captured this. To prove that this has come from the right camera, they put a digital
signature on it, this can be both invisible, or visible. Loads of programs can be used to do
this such as photoshop and It can even sometimes be automated.

2.28 Watermarking
Digital watermark is the copyright or author identification information which has been
embedded onto the digital media in a way that is unnoticeable, healthy and secure. A digital
watermark can happen in audio, images and videos and can be repeated at ransom
locations within the content which makes them hard to detect and remove. The main reason
for a forensic watermark is to protect the author against illegal use and distribution of copy
right. Forensic watermarks can make it easier for copyright holders to detect and then
identify people who have engaged it. However, they cannot prevent such activity overall.
It does have some limitations, the main one been that an occasional rate of false positives
like legal copies of audio, images and videos. An example of this is when you trade in your
laptop and then it is re-registered in the new user’s name.
2.3 Accuracy
We can’t use algorithms that present some prejudice, this is because they add new
information that does not belong to the original image that had been given, this is the
difference with proper enhancement or restoration techniques. While they are often Identical,
there is an important difference between the two, enhancement and restoration. Martino
Jerian (2017) explains the difference:

 “Image enhancement is a kind of process used to improve the visual appeal of an

image, enhancing or reducing some feature already present in the image (for
example correcting the brightness).”
 “Image restoration is a kind of process where we try to understand the mathematical
model which describes a specific defect and, inverting it, tries to restore an image as
much as possible close to a hypothetical original without the defect (for example
correcting a blurred image or lens distortion).”
What Martino is suggesting is that the process does not necessary add new data to the
image, though depends on only what is already there.

3.0 Current challenges and Future plans

Challenges are still emerging on a day-to-day basis as we are faced with numerous images
and videos and it is possible that at least a few have undertaken some level of manipulation.
The implications of such images and videos that have been tampered with are only just
started to be understood.
So far, we are only able to identify a digital camera that has managed to take a picture/video.
Through research we are now working towards estimating the time, date and locations
where images are taken so that we can identify the device that may have took them. This will
help forensics to add value and reliability to a crime scene and then presenting the evidence
in the court. This way we can say that it was not taken a certain diurnal or nocturnal the
crime was done, as well as the location where the crime was done.

4.0 Conclusion
Throughout this report I have discussed many sections in that forensics investigators may
need to tackle within their role of looking in to fraud and real images or videos that may be
needed for something that might have to do with a crime that has been committed. With the
information that I have found sometimes images and videos have been manipulated in
making it look something that could be related to a potential crime, this meaning that forensic
investigators need to examine the evidence that they have been given to see if this has been
tampered with finding out if it is legit or fake.
I have also talked about the accuracy in which how we can’t use algorithms as they add new
information that will not belong to the original image and an article that I found where Martino
Jerian explained the difference between the two, enhancement and restoration.
I believe that I now understand image and video forensics a lot more and how it is used in
part of advanced digital forensics and how much of an important component it is in an
investigation. I have also talked about how it is used to provide real time eyewitnesses to a
crime that can be used in the court of law.
5.0 Bibliography
CHEUNG, H. (2005, 3 18). Video Forensics: Catching the Crooks on Camera. Retrieved
from Tomsguide: https://www.tomsguide.com/us/video-forensics,review-416-4.html
Hager, R. (2017, 11 15). The Pixel 2 uses "Fused Video Stabilization," and the technology
behind it is incredible. Retrieved from Andraoid Police:
https://www.androidpolice.com/2017/11/15/pixel-2-uses-fused-video-stabilization-
technology-behind-incredible/
Mishra, M. (2013, 6 28). Digital Image Tamper Detection Techniques - A Comprehensive
Study. Retrieved from arxiv: https://arxiv.org/abs/1306.6737
Police. (N/A). Automatic Number Plate Recognition. Retrieved from Police:
https://www.police.uk/information-and-advice/automatic-number-plate-recognition/
Rouse, M. (2011, 3). forensic watermark (digital watermark). Retrieved from
whatis.techtarget: https://whatis.techtarget.com/definition/forensic-watermark-digital-
watermark
Singh, A. (2015, 10 28). Exploring Forensic Video And Image Analysis. Retrieved from
linkedin: https://www.linkedin.com/pulse/exploring-forensic-video-image-analysis-
ashish-singh/
Techopedia. (N/A). Image Enhancement. Retrieved from Techopedia:
https://www.techopedia.com/definition/26314/image-enhancement