Dear Tip Tuesday addict, welcome to this week’s Tip! While using Amped Authenticate have you ever noticed that, for most images, you can find a lot of different places showing dates and times? Why are they so many, and what is the difference between them? Keep reading to find out!

Dear Tip Tuesday lovers, welcome to this week’s Tip! When you load an image into Amped Authenticate and click on the File Format filter, a lot of tests are executed to analyze your image’s encoding properties and metadata. When Authenticate finds something suspicious, it raises a warning to help you focus your attention. Today, we will briefly review what these tests do, and show how you can customize the parameters determining their behavior.

Hello Amped blog readers! Following last week’s Tip Tuesday idea that “simple things matter”, today we’ll show you how one of the most straightforward filters in Amped Authenticate, that is, the Thumbnail filter, can sometimes reveal interesting information.

First of all, what is the image thumbnail? It is (well… it should be) a much lower resolution version of the image, commonly in the order of 160 x 120 pixels. It is mostly used by file/image manager applications for efficiently creating image galleries: they just need to decode a few thousand instead of millions of pixels during gallery creation and browsing, while the full-size picture will be decoded when the user “opens” it. The Exif standard provides rules for embedding the thumbnail into the image file as a stand-alone JPEG object, allowing to decode it without having to process the full-sized image.

This week is Amped Authenticate‘s turn, and we are going to look at our images from a different perspective than usual, that is… their bytestream! We’ll see how Amped Authenticate’s Hex Viewer and Hex Strings filters can help you spot hidden information in your evidence images.

Hello dear Amped Blog readers, welcome to this week’s Tip Tuesday. Today we’ll be dealing with one of the most sneaky kinds of fakes: recaptured images. A recaptured image is a “picture of a picture”: you display your (possibly forged) image on a screen, or you print it on paper, and then you take a picture of it. This apparently naive approach is much more clever than it seems: the obtained image will be a “camera original” image to all extents, so it will likely pass every test based on metadata/format analysis. Are we left alone against this subtle threat? Of course not, Amped Authenticate is here to help. Let’s find out how.

April Fools’ Day has just passed and we hope you didn’t go through any nasty trick! Alas, for people working with digital evidence, the risk of getting fooled by some ambiguous finding is always around the corner. In the case of digital image forensics, among the most frequent pitfalls, we find false positives produced by forgery localization algorithms (that is, when an algorithm marks as manipulated a region that was not so). Today’s Tuesday Tip deals with them and shows how Amped Authenticate helps you rule out some of them.

Welcome to this week’s Tip Tuesday! Today we are showing you an interesting, perhaps a bit hidden, functionality of Amped Authenticate. There is no need to introduce the PDF file format: it is surely the most widespread format for sharing digital documents. Therefore, it may easily happen that you have to deal with a PDF containing images and that some of them get questioned.

What would you do in such a case (after realizing that if you drag-and-drop the PDF into Amped Authenticate, nothing happens, because it’s not an image file)? Would you take a screen capture of the picture and work with that? “Nooo!” – I hope you said! Screenshots are evil for image forensics! Ok, you would get some pixels to work with, but you would lose all metadata, you would lose encoding properties, you could be recompressing data… That means you cannot check image integrity, and finding manipulations becomes much harder. No, there’s a better way of dealing with images embedded in PDFs, and we’ll show you how!