Welcome, dear Amped blog maniacs! Digital image forensics people have a bittersweet relationship with metadata. We love them… but can we trust them? Today’s tip is about cross-checking Exif metadata information about the camera model that allegedly created your evidence image. We’ll see that Amped Authenticate‘s JPEG Quantization Tables are a great resource, making your integrity verification far more reliable. Keep reading to find out more.
Understanding the Limitations of Exif Metadata in Forensics
If you know a bit about JPEG compression, or you have attended our Amped Authenticate training, then you know that JPEG Quantization Tables are a great resource for digital image integrity analysis. When you’re doing integrity analysis, one of the first questions you ask yourself is: “which device model was used to capture this image?”. Normally, it doesn’t take much to reach the first answer. Most devices today write their brand and model straight in the image metadata, as you can read in the Exif filter. Not only: when this information is available, Authenticate will also read it and show it in the top bar for your convenience (red arrow below).
Exif metadata are nice, but they do have a drawback: they can be easily altered. The Make and Model metadata, coincidentally, are probably the easiest to alter. If you’re a Windows user, the simple File Explorer is enough. Right-click on your image file, click on Properties, then go to the Details tab and there they are!
The forensic man in you will shiver with terror realizing that those fields in the property tab are… editable!
How JPEG Quantization Tables Support Exif Metadata Verification
That is to say: metadata shouldn’t be your single point of truth. And so? Don’t worry, we have good news! When saving an image, cameras leave many other “less intentional” signatures. Among these, there’s one that is quite distinctive, easy to understand, and hard to edit: the JPEG Quantization Table (often abbreviated in JPEG QT). Without going into too much detail, a JPEG QT is an 8-by-8 matrix of integer values used during JPEG compression. It’s written in the file header because it’s necessary to reconstruct the file (decompress).
Contrary to what happens with metadata, it’s not trivial at all to change the JPEG QT of an image file without recompressing it from scratch. Even if you decide to recompress your image, choosing a specific quantization table may not be possible. Most software and cameras only let you select a “quality factor” from a predefined list. This quality factor is then automatically mapped to one of the internal JPEG Quantization Tables used by the software or camera.
Typically, each image contains two or more quantization tables: one for luminance and the other for color. Additionally, if the image includes a thumbnail, it will also have its own JPEG Quantization Tables. For simplicity, we will focus only on the main image’s luminance quantization table.
The interesting aspect is that, while the JPEG Standard offers a recommended set of quantization tables, most camera manufacturers have developed their own unique tables. Moreover, these often use different quantization tables for various camera models within their brand. This is the reason why JPEG QTs are considered a real asset in source camera model verification. You can check whether the JPEG QTs of your evidence image are compatible with those used by the camera model declared in Exif metadata. Of course, to do so you need a database where JPEG QTs are linked to the compatible camera models.
We love to give you good news. When you get Amped Authenticate, you’re also getting a huge database of 14.000+ quantization tables associated with the compatible camera brand and model. Just click on the JPEG QT filter, and Authenticate will automatically list all the cameras in the database that are compatible with your image’s QT.
In the example below, we see that the image quantization table is compatible with a lot of Canon cameras, among which there’s the one declared in the Exif metadata!
Since this cross-check is very important, Authenticate does it for you automatically. When you click on the File Format filter, there’s a line dedicated to warn you when:
- The camera model declared in Exif metadata is not present in Authenticate’s database;
- The camera model declared in your image’s Exif metadata is present in the database. But, is not associated with your image’s JPEG QT.
Best Practices for Cross-Checking Camera Models with Exif Metadata
In both cases, we recommend that you obtain reference images to compare with. For example, with Authenticate you can quickly search the web for other images from the same camera model.
If you need to check whether a specific camera model is present in the Amped Authenticate JPEG QT database, just head to the JPEG QT filter and click on the View All QTs in Database button. A window pops up, where you want to choose Internal camera from the Group dropdown menu. Entries are sorted by Make and then by Model.
Final Note
We note once more that Exif metadata is just text written in your image file header. JPEG Quantization Tables are stored differently and can hardly be altered. Thus, if you can cross-check brand and model info obtained through Exif metadata and JPEG Quantization Tables, that’s a great added value to your integrity verification.