Author Archives: Martino Jerian

HEIF Image Files Forensics: Authentication Apocalypse?

If you follow the news from Apple you may have heard that the latest iOS 11 introduces new image and video formats.

More specifically, videos in H.264 (MPEG-4 AVC) are replaced by H.265(HEVC) and photos in JPEG are replaced by the HEIF format.

Files in HEIF format have the extension “.heic” and contain HEVC encoded photos. In a nutshell, a HEIF file is more or less like a single frame encoded H.265 video. Here there is a nice introduction. And, if you want to go more in depth, here there is some more technical documentation.

For people like us, that have been working for years on image authenticity exploiting the various characteristics of the JPEG formats and various effects which happen when you resave a JPEG into another JPEG, this is pretty big – and somewhat worrying – news.

If you want to do image forensics in the real world – not in academia, where the constraints are usually quite different – it means that the vast majority of images you will work with will be compressed in the JPEG format. A lot of filters in Amped Authenticate actually work only on JPEG files, because that’s the most common case. On the contrary, a lot of the algorithms published in journals are almost useless in practical scenarios since their performances drop dramatically when the image is compressed.

JPEG has been on the market for ages, and many tried to replace it with something better, with formats like JPEG 2000 and, more recently, Google WebP. However, with the decreasing costs of storage and bandwidth and the universal adoption of JPEG, it has been impossible to displace. In contrast, video formats and codecs have seen a very rapid progression at the same time, since storage and bandwidth for video is always an issue.

I think this time will be different, for better or worse, since when Apple introduces radical changes, the industry normally follows. This means a lot of work for those of us working on the analysis of image files. Nowadays the majority of pictures are done on a mobile device, and a good part of them are Apple devices so the impact cannot be neglected.

If the HEIC format becomes the new standard, many of the widely used algorithms must be heavily modified or replaced. Don’t hope to save many of those. After all, despite what some are saying, most of the image authentication and tampering detection algorithms don’t work on videos at all. The exception is having a Motion JPEG video modified and resaved as another Motion JPEG video. But that’s a very rare case, and most times the quality will be so low that it will be impossible to use them anyways.

Now let’s see what the situation is like in practice. Continue reading

Cowboys versus Bureaucrats: Attitude and Tools

There were a couple of interesting discussions this week which prompted me to write this blog post. One is related to the scientific methods used during the analysis of images and videos, the other relates to the tools used.

There was a pretty interesting and detailed conversation that happened on an industry specific mailing list where a few experts debated about the scientific and forensic acceptability of different methodologies. This discussion began with the reliability of speed determination from CCTV video but then evolved into a more general discussion.

There are two extreme approaches to how forensic video analysts work: let’s call one group the cowboys and the other the bureaucrats. I’ve seen both kinds of “experts” in my career, and – luckily – many different variations across this broad spectrum.

What is a cowboy? A cowboy is an analyst driven only by the immediate result, with no concern at all for the proper forensic procedure, the reliability of his methods and proper error estimation. Typical things the cowboy does:

  • To convert a proprietary video, he just does a screen capture maximizing the player on the screen, without being concerned about missing or duplicated frames.
  • Instead of analyzing the video and identify the issues to correct, he just adds filters randomly and tweaks the parameters by eye without any scientific methodology behind it.
  • He uses whatever tool may be needed for the job, recompressing images and videos multiple times, using a mix of open source, free tools, commercial tools, plugins, more or less legitimate stuff, maybe some Matlab or Python script if he has the technical knowledge.
  • He will use whatever result “looks good” without questioning its validity or reliability.
  • If asked to document and repeat his work in detail he’ll be in deep trouble.
  • If asked the reason and validity of choosing a specific algorithm or procedure, he will say “I’ve always done it like this, and nobody ever complained”.
  • When asked to improve a license plate he will spell out the digits even if they are barely recognizable on a single P frame and probably are just the result of compression artifacts amplified by postprocessing.
  • When asked to identify a person, he will be able to do so with absolute certainty even when comparing a low-quality CCTV snapshot with a mugshot sent by fax.
  • When sending around results to colleagues he just pastes processed snapshots into Word documents.
  • When asked to authenticate an image, he just checks if the Camera Make and Model is present in the metadata.

Continue reading

Amped has a Chat with Forensic Video Expert, George Reis

We love learning about our users. We are always interested to hear your views about the world of image and video forensics, what your challenges are, and especially finding out about your interest in books, gardening and maybe even dancing!  If you are interested in sharing your story, contact us for a chat!

George Reis, an expert photographer turned forensic image and video expert, and now the owner of Imaging Forensics, tells us how many fruit trees and vegetables he has in his garden and his love for reading and dancing! But he also shares his thoughts about the challenges of DVR systems and what he thinks the future of image and video forensics will look like.

I have known George for many years. He helped us a lot during the development and testing of our tools. Not only did he request a lot of useful features that have been added to Amped FIVE and Amped Authenticate, but he also tested the software thoroughly, reporting bugs and various little details that we had missed during development. To tell you the truth, to implement all the features he asked for means we would need to double or triple our team… but it’s good to be pushed to the limit. Thanks to George and people like him, we have a very rich roadmap for the next few years.


George, tell us a bit about yourself. What is your background and can you tell us about your company?

I am the owner of Imaging Forensics, a company that provides forensic video analysis, photography analysis, and photography. Imaging Forensics also provides training in these disciplines.

Prior to entering forensics, my background was in photography, primarily in the field of photojournalism. I was then hired by the Newport Beach (CA) Police Department as a forensic photographer. My duties expanded into the areas of photographic enhancement and video analysis in the early to mid-1990s, when all security video was analog on VHS tape.

I retired from the police department in 2004 to make Imaging Forensics a full-time venture.

What made you decide to enter the field of multimedia forensics?

I got into forensics in general, and forensic video analysis specifically, by accident. In the late 1980s, I was a freelance photographer and business was slow. I answered a newspaper classified ad for a “police photographer” with the intention of using it to stabilize my income, then returning to the freelance field. But, I found forensics much more interesting and rewarding than I expected.

In 1992 I began experimenting with digital photography and enhancement of fingerprints. And, around 1995, our video producer asked me if I’d like to work on some security camera video and I then took over those duties.

Continue reading

Why Sotiris Pavlides from Cyprus Police Criminalistic Services believes proper training is important

We love chatting with our users. We are always interested to hear about your views on image and video forensics, what your challenges are, and just simply getting to know you! If you are interested in sharing your story with us, let us know. 

Sotiris Pavlides has been an Amped user for many years. His toolbox of digital forensic software includes all Amped Software products. We’ve met many times at industry events and at the numerous Amped software training courses he’s attended. He is an expert user who believes in continuous training in order to be able to keep up with the pace of advancements in digital forensics and technology.


Sotiris, tell us what you are doing at the Cyprus Police.

I am the Head of Photographic and Graphic Lab, of the Cyprus Police Criminalistic Services. I have a Master’s Degree in Communication. Our lab activities include Crime Scene Photography, Forensic Photography, Image and Video Analysis and Enhancement, CCTV Retrieval and Analysis, Facial or Items Comparison, Image Authentication, and etc.

Why did you choose to work in the field of multimedia forensics?

I have always been interested in image and video processing, especially creating funny TV productions where everything can be done. When I joined the police force and started to work in the Photographic and Graphic Lab (it was around the year 2000) I had received the first case about video authentication. This is what made me start thinking about the field of multimedia from another perspective. The new challenge for me was not to know how to create or manipulate a video but to know how to look for traces to identify if a video was authentic or not. Even though it was for analog video, I found the entire procedure, analysis and investigation very interesting.

You’ve been in this role for quite a long time. What do you think are the biggest challenges with multimedia digital evidence and investigating crimes?

I think the biggest challenge is when you have to deal with massive video data coming from different DVRs. We are also faced with problems when we collect or retrieve the footage from these systems. For sure, this is not an easy procedure. Moreover, the video compression (artifacts, loss of details), low frame rates, and in general, the low quality of footage we get from these systems is a challenge.
Continue reading

Interview with Tomislav Prijanovič, Forensic Expert, National Forensics Laboratory, Slovenia

This is the second in a series of interviews with a number of our users that will share their story. If you are interested in being profiled, let us know. We would love to hear from you!

In this post, we feature Tomislav Prijanovič, from the Slovenian National Forensics Lab. We have known each other since 2006 where we happened to be in the same hotel for the ENFSI Digital Imaging Working Group meeting in Rome. He’s actually one of our first customers and, given the proximity between Trieste and Ljubljana – little more than one hour by car – we meet at least once per year to exchange ideas and share interesting cases. I must say that quite often he amazes me with his skills. Many times, he is able to get incredible results on license plates that at a first glance I deemed impossible. 


Tomislav, tell us a bit about yourself. What is your background and your current role at the National Forensics Laboratory?

I am a forensic expert and court witness, working in the Physics Examination Department at the National Forensics Laboratory in Ljubljana, since 1990.

What made you decide to enter the forensics field?

After finishing technical school for electronics, I started working as a video technician. I basically worked on video documentation (video recording and editing) for police purposes,  capturing and analyzing images from CCTV.  At that time I also had the opportunity to do some work related to photography, like darkroom photography and working as a minilab operator. Due to the rapid development of digital technology (cameras, computer hardware, and software), we started to look for new technical solutions to make our work more effective (less time consuming and higher quality results).  After digital cameras and digital video editing systems, getting forensic software was just a matter of time… and money. Continue reading

Amped FIVE and Griffeye Analyze: Introducing the Integration

You may remember the announcement of our partnership with Griffeye, some months ago.  This partnership is especially interesting since we both work on images and videos, but in a different, yet complementary way. Griffeye focuses on finding the needle in a haystack, while Amped focuses on sharpening the needle and verifying it is actually a needle and not a stick.

In the latest release of  Griffeye Analyze, the Amped FIVE plugin has been added to the Analyze Forensic Market, but in the near future we plan to also add apps for Amped Authenticate and Amped DVRConv. In this post, we will show you how to start with the integration and how the two software work together.

First of all, we assume that you have installed Amped FIVE (build 9010 or later) and Griffeye Analyze (17.1.0 or later) on the same machine.

In order to enable the integration, you need to click on the button “Analyze Forensic Market”.

Continue reading

Amped Authenticate Update 9446: CameraForensics Integration, New Quantization Tables Database and Much More

We’ve just launched some pretty important additions to Amped Authenticate. Not only have we integrated it with CameraForensics, but we have also made some major improvements to the quantization tables in addition to many other internal improvements. Read below for the details.

CameraForensics Integration

The main purpose of Amped Authenticate is to verify if a picture is an original coming from a specific device or if it’s the result of manipulation using image editing software. One of the main tests to verify the file integrity is to acquire the camera that is assumed to be the one that has generated the photo (or at least the same model) and verify if the format is compatible with the file under analysis.

While this sounds easy in practice, many devices have so many different settings and because of this it can be challenging to recreate the same conditions. Furthermore, the camera is often not available.

What if we look on the web for pictures coming from a specific device? While we cannot, in general, guarantee the integrity of files downloaded from the web, we can triage them pretty easily and do a comparison with the image under analysis.

But how do you search for images on the web in an efficient manner? We have had “Search for Images from Same Camera Model…” in Authenticate for quite some time. It allows you to search on Google Images and Flickr, but the search is not always optimal, as it has to apply different workarounds to work efficiently in a forensic setting.

So, what if someone built a database of pictures on the web, optimized for investigative use, enabling you to instantly search for images coming from a specific device and with specific features such as resolution and JPEG quantization tables? Turns out the guys at CameraForensics did exactly this (and much more) and we partnered with them to provide a streamlined experience.

Let’s see how it works. Continue reading

Are Amped Software products validated or certified officially for forensic use?

We work in the field of forensic video analysis, which is generally intended as the analysis of the images themselves and their context in a legal setting. For this reason, our customers often ask us if our products are valid for court use and if they have been validated and certified. We have written this post as an answer to the most common questions related to this topic.

You can also download this as a PDF document here


What are the scientific foundations of Amped Software products?

All the processes implemented in our software follow the principles of scientific methodology. Any process follows these basic principles:

  1. Accuracy (Reliability): our tools and training program help users avoid processing errors caused by the implementation of an inappropriate tool or workflow and help mitigate the impact of human factors / bias.
  2. Repeatability: the same process, executed by the same user at a different time, must lead to the same result. The project format in Amped FIVE, for example, does not save any image data. Every time a project is reopened, all the processing happens again starting from the original data. In the event that a project file is lost or as a part of a validation or other test scenario, the same user can repeat the steps and settings, guided by the tool’s report, and achieve the same results.
  3. Reproducibility: another user with the proper competency, should be able to reproduce the same results. Amped FIVE generates a complete report detailing all the steps of the processing, the settings / parameters applied, a description of the algorithms employed in the processing and the scientific references for those algorithms (when applicable). In this way, another user, with a different tool set or by implementing the same algorithms, should be able to reproduce the same results. Given the huge number of implementation details and possible differences, it is not expected to produce a bit by bit copy of the results, but only to produce an image of similar informative content.

Additionally, we apply strict due diligence on the applicability of the algorithms for the forensic environment. Not every algorithm is, in fact, properly applicable in a forensic science setting. We cannot use algorithms which have a random component because they would not be reproducible and repeatable (when we do, we set a fixed seed for the random number generation) and we cannot use algorithms which “add” external data to the original, for example improving the quality of a face with information added from an average face. All information is derived from the actual evidence file.

We employ algorithms which have been validated by the scientific community through peer review, such as university textbooks, scientific publications, or conference papers. If for some specific task, there are not good enough algorithms available or we need to adapt existing algorithms, we describe the algorithm and attempt to publish them in scientific journals. Continue reading

CCTV is More Useful Than We May Perceive

One of the things that fascinate me the most in forensic video analysis is the relation between the subjective digital data and the objective human interpretation involved in any investigation. Psychological biases and the fallacies of human perceptions easily verifiable with any of the popular optical illusions are just some of the factors which must be taken into account while doing investigations.

But this time I want to look at things from a higher level and talk about the usefulness of video as evidence and our perception of it. Chances are you have already seen the very interesting article: “The Value of CCTV Surveillance Cameras as an Investigative Tool: An Empirical Analysis” (link).

The abstract provides some impressive numbers: “This study sought to establish how often CCTV provides useful evidence and how this is affected by circumstances, analysing 251,195 crimes recorded by British Transport Police that occurred on the British railway network between 2011 and 2015. CCTV was available to investigators in 45% of cases and judged to be useful in 29% (65% of cases in which it was available).”

For reference, this is the decision workflow used in the classification (image from the above paper).

This really made me feel good. It looks like what we are doing here at Amped Software is having an impact on society, and more than we expected. I think most people in our community would be surprised by the numbers. At Amped, we see hundreds of cases every year, and for more than half of the images and videos that we receive, we just say that they are useless. Continue reading

Amped Support Portal Available Now!

Normally, we release new stuff for your desktop, but this time we released a little new section on our website to help you with the management of your Amped Software licenses and training: the Amped Support Portal.

In the portal, you can find all the essential information about your software licenses and the training classes that you have attended.

Just head to https://support.ampedsoftware.com and you will see a typical Email / Password login page.

login

If you are an Amped Software user and we have received your details when you purchased a license, you should already be able to log into the system. Just insert your email address and hit the button “Reset password”. Then check your email and follow the instructions to change the password and then log in. If you don’t receive an email, this means that we don’t have you in our records. But no worries, just send an email to support@ampedsoftware.com and we’ll create an account for you once we have identified your available licenses.

You can see all your licenses and their expiration dates, you can download the latest versions of the software, and you can generate license certificates that your administration or management may require.

Additionally, you will also see all the training classes that you have attended and download the related training certificate.

We plan to add additional features soon, for example, adding the possibility to receive email notifications before the expiration of your SMS (software updates). So, stay tuned!

As usual, feel free to contact us if you have any comments or suggestions about the new portal.