Welcome to this week’s tip, dear friends! Today we’ll use Amped Authenticate to go through a peculiar sample case. We will deal with a digital camera that supports adaptive JPEG quantization tables. It’s something that is not so often out there, so keep reading and don’t miss this opportunity!
The powerful High-Efficiency Image Format (HEIF) is seriously entering the game in these months. JPEG, however, is still the undisputed leader in terms of pervasiveness. One key reason is the role of JPEG quantization in enabling efficient image compression while maintaining visual quality. This is a feature that remains crucial in forensic analysis. This is why Amped Authenticate dedicates several tools and filters to the analysis of traces and artifacts introduced by JPEG compression.
As Authenticate users know well, JPEG quantization tables (QTs) are an important asset for image forensics. We recently dedicated another article to the subject, titled “Where Are You From? Learn How to Investigate Which Camera Model Took an Image Using Exif Metadata and JPEG Quantization Tables“. The key point is that most cameras use a limited set of QTs, which is often typical of that camera model or brand. For example, as you can see below, an image captured with an iPhone 11 Pro is stored using QTs shared by Apple devices and not by others.
Now, let’s assume you have been asked to investigate the integrity of the image available at this address. One of the key forensic techniques for assessing image integrity is analyzing its JPEG quantization properties.
We load the image in Authenticate and anxiously head to the File Format filter:
The image doesn’t trigger any hard warning (those are written in red), which is surely a good starting point! There’s just a soft warning (orange font)… what is that?
As explained in the tip we linked before, JPEG quantization table analysis is a good ally when you’re asked to check the integrity of an image. If the camera model declared in Exif metadata is also listed in the “Compatible Cameras” of the JPEG QT filter, as it happened in the previous iPhone example, that’s a good confirmation. In this case, however, we’re not lucky. The File Format filter warns us that the Fujifilm Finepix A202 camera is not available in Authenticate’s internal database. So we still have an open question: is the questioned image stored with QTs that are compatible with a FinePix A202?
“Well”, the savvy Authenticate user says, “I can still use one of the tools to search images from the same camera model on the web!”. That’s a good idea indeed. Since readers of this blog may not have a subscription to CameraForensics, we’ll use the simpler Search Images From Same Camera Model tool for the sake of generality.
Unfortunately, however, the web doesn’t help much in this case:
Why is that? Well, the camera we’re dealing with entered the market in 2002. Flickr didn’t even exist then, and image sharing platforms, in general, were yet to come.
There will surely be thousands of images from the Finepix A202 in the world. But they’re mostly stored on DVDs or memory cards in people’s drawers.
We thus decide to ask colleagues in our team and it turns out that one of them actually owns a Finepix A202. We ask him permission to take some pictures, and then we put them in a reference folder. Then we use Authenticate’s Batch File Format Comparison to compare our questioned image to the reference pictures. And here we get a real surprise.
We see that the properties of the reference images are totally consistent with the questioned image, except for the JPEG quantization table (consequently, the estimated JPEG quality is also different). But wait: reference images also have different JPEG quantization tables! How is that possible? We’re sure they are from the same camera: we took the pictures ourselves!
And here is the explanation: we’ve just met a device featuring adaptive quantization tables! Contrarily to most devices, these cameras won’t limit themselves to a narrow set of 5-6 possible JPEG QTs to choose from, based on “picture quality” settings. No, these cameras can adaptively generate QTs based on the image they have to compress! There’s a nice (and niche) paper dated 1995 presenting a possible strategy for such a task.
That doesn’t mean they cannot generate two times the same QT, of course. But it’s much, much harder to find two images with the same table. In our specific case, using the Search Images From Same Camera Model (Camera Forensics)… tool we could actually find some pictures from the same device and with the same QT on the web! That was possible since the integration with CameraForensics allows searching for images with a specific JPEG QT.
Needless to say, it’s important to understand when you’re dealing with a device in this category. So, you can properly justify, in your report, that those red numbers in the file format comparison tables are not actually suspicious, they are rather expected!
Of course, being able to quickly compare tens or hundreds of images’ JPEG quantization tables is very useful in cases like this. Of course, Amped Authenticate is the right tool for that.
After all these words, you’re probably curious to see how this Fujifilm FinePix A202 looks like. And so… here it is!
I’m sure you expected something more futuristic, didn’t you? So, congratulations to Fujifilm for embedding such a cool feature in an entry-level device! Credits for spotting that this device uses adaptive QTs go to Jesse Kornblum and his paper “Using JPEG quantization tables to identify imagery processed by software“.
