Gfrktyl

Many times I face images on the Internet or spread on social networks like Facebook and twitter.

How to check that those images are right I mean not processed in photoshop?

Firstly I check that those images are related to the specific event by using Google image searching but after that I want to make sure that those images not processed through some image editing tools like photoshop.

There are several solution for image authentication. The simplest way is by checking the EXIF. It doesn't validate the image as unedited, but if an EXIF tag left by Photoshop or other software is found, you can be sure the image is edited.

The law-accepted method is by using camera that sign the picture it took. Of course this won't detect optical manipulation, but at least it's good for ensuring forensic photo aren't tampered when the photo itself is taken by trusted officer. Also, when the private key is leaked, boom, every image is now suspect.

A more general method would be detecting the fluctuation in the image statistics. Software for such method can be extremely expensive for forensic situation or could be free. Then again, they won't actually detect an optical manipulation.

Authenticating a digital image is not an easy task and it depends on how far you want to go with it. First of all it is needed to understand at which level you want to verify the originality of a picture.

Do you want it to be the exact image created by the camera without any alteration (camera-original)? In that case if you uploaded it to Facebook it won't be an original anymore, as Facebook servers will likely recompress it, resize it and add some tags.
There are several methods to verify if the image is a camera-original or not and some are actually very simple, for example:

• check if the format and resolution is supported by the camera


• check if EXIF metadata are present and respect the settings provided by the camera


• check that EXIF metadata don't contain any suspicious software tag containing words like "Photoshop"


• check that the JPEG compression settings (quantization tables) are compatible with the ones of the images generated by the suspect camera

Checking if the pictures are camera-original is quite quick, but we must remember that a skilled attacker with the proper software will be able to fool your analysis. It may be quite easy to modify the EXIF data of an image to make it appear original, but it may be less obvious to encode a tampered image with the camera settings without altering original camera file structure.

The other problem is that you may not care at all that the image is not a camera-original (for example because it has been resized) but you are only interested about the fact that its content has not been faked, for example removing an object or adding a person.

In this case you won't analyze the only the file format and metadata but the actual pixels to perform different kinds of analysis that take into account image statistics and other mathematical properties of the image.
The analysis can be done at a global level or at a local level.
In general, a global analysis will tell you if the image has been modified, but won't tell you where. Conversely, a local analysis may be be able to tell you where exactly the image has been modified.

The most reliable results will be obtained comparing the image under analysis with other pictures coming from the same device that it's supposed to having taken the photo. Analysis techniques based on pixels are much more difficult to fool that the ones based on format, but it's not impossible.

In a forensic setting we won't be able to tell in absolute terms that an image is an original, but only that we weren't able to find any evidence that the image is not an original.

There are not many tools available for image authentication: other than the ones cited by Martheen, you can also take a look at my company's product Amped Authenticate (http://ampedsoftware.com/authenticate).