At Amped Software we are continually researching new methods to help you in your analysis. Designing, testing and then implementing new features and filters is a continuous process. When complete, we get these out to you as soon as we can.
In this post, I will be introducing you to some of the latest developments in Amped Authenticate.
For those new to this blog, or the software, Amped Authenticate is a software package that enables you to conduct forensic image authentication and tamper detection on digital photos and documents. Today, digital images are key sources of evidence in criminal activities. But the creation and manipulation of those images is relatively easy to do, so it is vitally important that images being used as evidence are what they say they are. Amped Authenticate is the only software in the market that includes, in one single and easy to use package, all the scientific tools and functions necessary to discover tampering on an image or determine originality, and to verify if a picture has been generated by a specific device.
This update includes some very big improvements and additions.
Fourier
Amped FIVE users will be aware of how powerful the Fourier domain is in identifying and then removing frequency noise in images. This frequency noise can also be used to identify signs of LCD Recapture. As a result, this filter is now included in Authenticate.
Re-capturing an image that is being displayed on a screen could be used to hide signs of malicious manipulation.
In this image, we have a receipt, that has been altered. Many of the alterations can not be detected.
However, the signs that it has been captured from a screen are visible and clearly detected using the Fourier filter.
I have purposely used a clear example here to show the patterning, but if a LCD recapture is done well, the moire effect can be very hard to see with the eye. The filter doesn’t have that limitation though, and will clearly show the regular frequency in the image.
Blocking Artifacts
Added to the Local Analysis category of filters is Blocking Artifacts.
This is a very simple, yet very effective filter to visualize any inconsistencies in the blocking artifacts caused by jpeg quantization.
Here we have a regular looking .jpg image, purporting to be an original image.
However, when the Blocking Artifacts filter has processed the image, it shows suspect areas in red.
Below you can see the original image. The subject was removed from the picture we analyzed. We were not able to see this modification by just simply looking at the picture, but mathematics cannot be fooled, and with Amped Authenticate, you can clearly see the person’s shape in the filter output.
It is more reliable on images of high quality, with low compression. Highly compressed images can hide any artifacts caused by the mixing of content.
Saturation Map
Several filters give you the ability to show saturation within the image result.
The selection of these areas has been improved and now the areas with no luminance (black), are shown in blue, and the areas with full luminance (white) are shown in yellow.
Some areas of saturation can be detected as errors, so actually visualizing these helps to discount those parts of the image.
Image Thumbnails
When conducting Batch File Format Analysis and the other tools which list images in tables, a small thumbnail is now created to assist you in visually identifying specific images or changes in scene or environment.
PRNU – Updated!
Sensor identification, using Photo-Response Non-Uniformity, has been in Amped Authenticate from the start. Imperfections in each sensor cannot be seen with the eye, but are unique to that specific piece of silicon. Identifying the pattern, and then comparing this with an image, is a reliable way of proving that the image was, or was not, taken by that specific camera.
The update to Amped Authenticate’s PRNU function is a big one! I have been testing this for the last few days and found it much easier to quickly obtain the noise pattern and then make some comparisons. The results are also much easier to understand.
It will also be much easier for me to teach, when I am out in your agency or department, delivering our training. Ensuring that you can be up and running quickly is one of our core beliefs.
I will be writing a post dedicated to the PRNU update in the coming weeks but the main difference is that rather than an evaluation of the Correlation, the Peak-to-Correlation Energy (PCE) ratio is calculated.
That all sounds pretty complicated … but the values are much easier to understand.
In the screenshot above, the suspect image has been compared against the noise profile from a specific camera.
The PCE Value is way above the threshold of 45. Thus, the compatibility is Positive.
In this next screenshot, we have compared another image, but this one has been manipulated.
The PCE Value is still very high, and as such it is still reported with a Positive compatibility. It is still able to detect that it came from the same camera, regardless of the modification.
What about this screenshot?
The image was purported as coming from the same camera. However, it has a very low PCE Value. As a result, the compatibility is Negative. It did not originate from that camera.
This new feature in PRNU is pretty cool, so keep watching out for a dedicated post in the next few weeks.
That’s it for now. For Amped Authenticate users with up to date support, please remember to ‘Check for Updates Online’ to download this update or contact us to renew your SMS plan.
Also, after updating, take the time to run some tests and get acquainted with the new PRNU PCE reporting. I am sure you are going to like the changes!
