Welcome to this week’s tip, dear friends! Today we’ll use Amped Authenticate to go through a peculiar sample case: we’ll deal with a digital camera that supports adaptive JPEG quantization tables. It’s something that is not so often out there, so keep reading and don’t miss this opportunity!
Despite the fact that the powerful High-Efficiency Image Format (HEIF) is seriously entering the game in these months, JPEG is still the undisputed leader in terms of pervasiveness. This is why Amped Authenticate dedicates several tools and filters to the analysis of traces and artifacts introduced by the JPEG compression.
As Authenticate users know well, JPEG quantization tables (QTs) are an important asset for image forensics, and we recently dedicated another tip to the subject (Where Are You From? Learn How to Investigate Which Camera Model Took an Image Using Exif Metadata and JPEG Quantization Tables). The key point is that most cameras use a limited set of QTs, which is often typical of that camera model or brand. For example, as you can see below, an image captured with an iPhone 11 Pro is stored using QTs that are shared by Apple devices and not by others.
Now, let’s assume you have been asked to investigate the integrity of the image available at this address https://pbase.com/soesterknollen/image/76374039.
We load the image in Authenticate and anxiously head to the File Format filter:
The image doesn’t trigger any hard warning (those are written in red), which is surely a good starting point! There’s just a soft warning (orange font)… what is that?
As explained in the tip we linked before, JPEG QTs analysis is a good ally when you’re asked to check the integrity of an image. If the camera model declared in Exif metadata is also listed in the “Compatible Cameras” of the JPEG QT filter, as it happened in the previous iPhone example, that’s a good confirmation. In this case, however, we’re not lucky: the File Format filter warns us that the Fujifilm Finepix A202 camera is not available in Authenticate’s internal database. So we still have an open question: is the questioned image stored with QTs that are compatible with a FinePix A202?
“Well”, the savvy Authenticate user says, “I can still use one of the tools to search images from the same camera model on the web!”. That’s a good idea indeed. Since readers of this blog may not have a subscription to CameraForensics, we’ll use the simpler Search Images From Same Camera Model… tool for the sake of generality.
Unfortunately, however, the web doesn’t help much in this case:
Why is that? Well, the camera we’re dealing with entered the market in 2002. Flickr didn’t even exist then, and image sharing platforms, in general, were yet to come.
There will surely be thousands of images from the Finepix A202 in the world, but they’re mostly stored on DVDs or memory cards in people’s drawers.
We thus decide to ask colleagues in our team and it turns out that one of them actually owns a Finepix A202. We ask him permission to take some pictures, then we put them in a reference folder, and then we use Authenticate’s Batch File Format Comparison to compare our questioned image to the reference pictures. And here we get a real surprise.
We see that properties of the reference images are totally consistent with the questioned image, except for the JPEG QT (consequently, the estimated JPEG quality is also different). But wait: reference images also have different JPEG QTs! How is that possible? We’re sure they are from the same camera: we took the pictures ourselves!
And here is the explanation: we’ve just met a device featuring adaptive quantization tables! Contrarily to most devices, these cameras won’t limit themselves to a narrow set of 5-6 possible JPEG QTs to choose from, based on “picture quality” settings. No, these cameras can adaptively generate QTs based on the image they have to compress! There’s a nice (and niche) paper dated 1995 presenting a possible strategy for such a task.
That doesn’t mean they cannot generate two times the same QT, of course, but it’s much, much harder to find two images with the same table. In our specific case, using the Search Images From Same Camera Model (Camera Forensics)… tool we could actually find some pictures from the same device and with the same QT on the web! That was possible since the integration with CameraForensics allows searching for images with a specific JPEG QT.
Needless to say, it’s important to understand when you’re dealing with a device of this category, so you can properly justify, in your report, that those red numbers in the file format comparison tables are not actually suspicious, they are rather expected!
Of course, being able to quickly compare tens or hundreds of images’ JPEG QT is very useful in cases like this, and of course, Amped Authenticate is the right tool for that.
After all these words, you’re probably curious to see how this Fujifilm FinePix A202 looks like. And so… here it is!
I’m sure you expected something more futuristic, didn’t you? So, congratulations to Fujifilm for embedding such a cool feature in an entry-level device! Credits for spotting that this device uses adaptive QTs go to Jesse Kornblum and his paper “Using JPEG quantization tables to identify imagery processed by software“.
