Welcome, dear Amped blog friends! This week’s tip is dedicated to Amped Authenticate‘s Camera Identification filter, which received important upgrades with the last software release! Today we’ll see how you can check images against multiple cameras in batch, saving a lot of time!
Camera Identification is one of the core features in Amped Authenticate: it has been present since the beginning and, not surprisingly, it has always attracted our users’ attention. In fact, the possibility to link an image to the exact device that captured it has a dramatic impact on investigations (e.g., it may help to prove that a child abuse picture was generated by the device found in the suspect’s home).
The principle on which Camera Identification works is described in other posts on this blog (see here). In a nutshell, the camera sensor introduces noise in the image during its formation. Among the various kinds of noise that are left, Photo Response Non-Uniformity (PRNU) proved to be the most suitable for conducting camera identification because of its uniqueness, stability, and robustness. Even if you have two cameras of the same brand and model, built the same day, their sensors will leave a distinct PRNU noise pattern!
In order to conduct Camera Identification with PRNU, you first need to compute the sensor noise pattern that characterizes your camera. With Amped Authenticate, that’s very easy: you put a suitable number of images captured with the camera in a folder, go to the PRNU Identification filter and click on the “Create PRNU Reference Pattern” button.
The created “.crp” file characterizes your camera sensor. You can now load images in Authenticate, and the PRNU Identification filter will measure their compatibility with the currently selected CRP.
We won’t dig into the details of the filter output, you can find them in the Program Reference Manual or in other posts on this blog. Instead, we want to focus on a recent feature: since Release 13901, you can load multiple CRPs at the same time! Just click on the “Load PRNU Reference Pattern” button and load as many CRPs as you wish. They will appear as separate PRNU Identification‘s filter configurations in the left panel.
Just click on a configuration’s name to load the corresponding CRP file and see the output on the screen. Authenticate will mark in red those configurations whose associated CRP file turns out to not be compatible with the currently loaded image.
Although it’s nice to have many CRPs in Authenticate’s interface, the possibility of loading multiple CRPs gives its best with Batch Processing. Imagine you’ve seized six imaging devices from the suspect’s home, and you need to test hundreds of images against them. The best way to go is to create the CRP for each device, load all of them in Authenticate, click on one of them to enable the PRNU Identification filter, and then head to Tools > Batch Processing. Here, you can easily tell Authenticate to test all your evidence images against all CRPs currently loaded, as shown below.
Now simply click “Ok”, and let Authenticate do the work for you! Upon completion, you’ll find results in an HTML file.
You can set the “Output Filename” to “.tsv” extension if you prefer a more “processable” tab-separated values output. In this case, you’ll know for each image-CRP pair whether positive compatibility was found or not by looking at the “Status” column: “Ok” means a positive match was found, “Warning” means the opposite. Of course, you’re then encouraged to review sensitive results and not limit to such a synthetic table!
One further advantage of PRNU Identification coupled with Batch Processing is that all results are cached, making displaying of results lightning fast in the rest of your analysis.
That’s all for today! We hope you’ve found this issue of the Video Evidence Pitfalls series interesting and useful! Stay tuned and don’t miss the next ones. You can also follow us on LinkedIn, YouTube, Twitter, and Facebook: we’ll post a link to every new Tip Tuesday so you won’t miss any!