Featured Post

Welcome to the Forensic Multimedia Analysis blog (formerly the Forensic Photoshop blog). With the latest developments in the analysis of m...

Friday, January 30, 2009

Adobe and Education

This blog and the book were mentioned in a blog post by Adobe's Rick Miller. Rick, part of the Education Technologies team at Adobe, was pointing out that he's starting to get questions from Criminal Justice students about working with images. He offered up the book and the blog as resources.

Thursday, January 29, 2009

There's no such thing as a free lunch

Over 5,000 people (and counting) have downloaded a trojan infected Photoshop CS4 crack for their macs. You read it right, for mac. Mac has hit the big time as hackers are now targeting mac users who frequently look to file sharing sites for "free" software.

Here's a sure fire way to not infect your system with malware, pay for it and get it from a reputable source. A web site in China offering Photoshop CS4 Extended for $79 is probably not legit. Adobe doesn't discount its retail offerings that much.

If in doubt, contact the manufacturer to verify that "good deal" you are about to get.

Wednesday, January 28, 2009

Cryptographic Hash

"Simple-to-use digital technology will make it more difficult to distort history in the future.

On Tuesday a group of researchers at the University of Washington are releasing the initial component of a public system to provide authentication for an archive of video interviews with the prosecutors and other members of the International Criminal Tribunal for the Rwandan genocide. The group will also release the first portion of the Rwandan archive.

This system is intended to be available for future use in digitally preserving and authenticating first-hand accounts of war crimes, atrocities and genocide.

Such tools are of vital importance because it has become possible to alter digital text, video and audio in ways that are virtually undetectable to the unaided human eye and ear."

Read the entire article at the NY Times on-line.

Kicking it up a notch

I received a note from a University faculty member in response to a previous post on using MATLAB and Dr. Farid's work. The professor was worried that I may have overemphasized the utility of MATLAB to the exclusion of other, less expensive or free options.

Fair enough.

One of the things that I do, behind the scenes here, is to scour the research and articles available from the world's think tanks and universities. I have a membership with the ACM and a subscription to their digital library. I check out the latest research and see if I can make it usable in the real world.

Some of my favourite papers are:
  • Advanced JPEG Carving by Cohen
  • Can We Trust Digital Image Forensics? by Gloe, Kirchner, Winkler, and Boehme
  • The Adaptability of Electronic Evidence Acquisition Guides for New Technologies by Turnbull
  • An Inexpensive Method to Shield Wireless Devices During Hardware Forensic Investigation in a Laboratory Setting by Hill
There's so much going on in labs and in university classrooms. These hardworking folks deserve recognition for thinking way outside the box. We can all benefit from what they are doing. And ... they can benefit from what we are doing. They need folks to provide raw materials and data from the real world. They need folks to put their theories to the test. We need each other. We benefit from each others' work.

The offer is extended to any researcher: if you want to demonstrate a new technique or if you think that you've got an improvement to a process ... we want to know about it. I'd be happy to feature the work in a future series.

Tuesday, January 27, 2009

Where are we going?

It seems that we are at a cross-roads, and we may not know it. The majority of "forensic" practitioners at the city/county level are sworn law enforcement. When you get to the state level, the gap starts to narrow. At the national level, it narrows further still.

Many in "the community" want this gap to go away. The trend "in the community" is for "forensics" to take place at a lab ... and for practitioners to hold at least a MS degree, with a PhD preferred. 

Think I'm kidding? Check out the ASTM International, the new version  of the American Society for Testing and Materials. Their subcommittee (E30) for Forensic Sciences has draft proposals for new standards under consideration. These cover Practice for Computer Forensics and Education and Training in Digital Forensics.

While the ASTM acknowledges that the current practitioners may hold a great deal of knowledge and skill, and may do their best to improve themselves through the course of their career, it would be better if they sought and achieved advanced degrees in their field of choice. For us, multimedia evidence doesn't get introduced until the Masters level. Yes, the title of the proposal says Computer Forensics, but they've included video, audio, and cell phones in their proposal.

Most of the readers of this blog are stakeholders in this discussion of proposed new standards. Yet, the ASTM has done little to reach out to you and I to include us in the discussion. You may want to check out these proposals and run them by your employers. They may not be compatible with your agency's strategic plans or culture. They may not have the money to put you through college to get your PhD, do you? You may want to weigh in on the discussion. But hurry, the balloting closes on this soon.

We may end up with a situation where a few PhDs lead the discussion (in private) towards a new standard whereby only labs staffed with doctors and grad students can process video evidence. You think you've got a backlog of cases now, just wait. Better yet, don't wait ... speak up.  You may like the proposed policy, you may not. But, at least you will have had your say.

Precise compression?

This weekend, I raised a question to the Photoshop 3 students at the Art Center College of Design in Pasadena. I asked what the various compression setting meant when saving out JPEGs in Photoshop.

Just how much compression is a "12?" What about "10?" What do you do if you need a specific compression, like 95% or 75%?

Answer: MATLAB

FYI, the default compression quality in MATLAB is 75%. Writing a file out to an image using the imwrite command, specify ... 'compression', '95') or ... 'compression', '75') or any value for that matter. The cool thing about using MATLAB is that you can control the compression precisely. You can also use the 'resolution' variable to specify an output resolution. For example, ... 'resolution', '240').

When you really need control, you'll need MATLAB.

But we don't compress in forensics, right? Compression = loss. Loss is bad, right? Yes, that's right ... for the most part. Some readers have tried to duplicate Dr. Farid's "ghosting" technique (authentication / detection of forgeries) using just Photoshop ... and they can't pull it off. Why not? You need to control, precisely, the compression of the images that you generate as part of the process. In short, you'll need MATLAB.

What's more, you can control Photoshop directly from within the MATLAB interface.


Everything MATLAB and Photoshop need to work together has been installed with Photoshop. That MATLAB folder that sits quietly in your Photoshop folder contains a lot of hidden power. Get your hands on a copy of MATLAB and you'll see for yourself.

Monday, January 26, 2009

Device Central and your firewall

I received an answer as to why some IT security is not so friendly with Device Central CS4.

Device Central CS3 had libraries that were resident on your computer. Periodically, the libraries were updated and the updates offered for download. You would then download the update and install in on your local computer. CS4 is different. The libraries are hosted at Adobe. As such, they can update it on the fly and offer an much better customer experience.

However ...

If your ISP or IT security folks block inbound port 80 traffic (many trojans use this common port) or the ".dat" file type, you could be left with a very limited program. Remember, all the libraries are now at Adobe.com.

Bear in mind that your IT folks may not wish to open up their firewall in this way. If so, you may want to put Device Central on a stand-alone machine and handle your own connection to the internet and security.

Many thanks to Nandi at the Adobe support forums for the help on this matter.

Saturday, January 24, 2009

Helping out in the community

It's funny how so many folks will admit that "they are bad at taking pictures" when they really aren't. They just don't know a few simple things that can make the images that they are taking just pop off the screen.



A fellow blogspot blogger takes this picture for the Johnson Street blog. The picture is fine, it's just not clarified. After a touch of the workflow, it is revealed in all its glory.



Today's point and shoot cameras are capturing an amazing amount of detail. In less than 5 minutes with Photoshop or Elements, you clean them up and show them off to the world.

The Forensic Photoshop workflow can work for anyone wishing to clarify images quickly. If you are well familiar with the workflow, and you see images that need clarifying, offer help to your neighbour who may be in need. Answer the call and help the community. It's for the images. :-)

Friday, January 23, 2009

What are they thinking?

Washington State's HB 1262 - 2009 -10, Establishing conditions for video monitoring in public schools has had its first reading and is being considered in their Education committee. 

It all sounds well meaning, until you get to the part that will bankrupt the local districts:

"(3) The school district shall preserve the original of any video monitoring for not less than six years from the date of the monitoring."

Six years? What are they thinking?

Frame size x frames per second x seconds recorded x number of cameras / compression. The average school is open from 6a-6p M-F, more if they offer adult education at night. That's a whole lot of storage need to get to a 6 year retention.

I sure hope that someone in Washington State is listening. In these tough economic times, this "black hole" will break many districts if it is passed as-is.

Thursday, January 22, 2009

Which of these 6 pixels do you want?



I received the typical parking garage scene image in a help request. An agency wanted to see if I could get the license plate off of the black car in the left/center of the image. It was crucial to their investigation.

I asked a bit about the CCTV and if there were cameras closer to the car that might have a better shot. It turns out that the closest camera would have a brilliant look at the car, but the dome's been down for a while. Maintenance has been complaining to management, but there is no money to fix the dome (budget problems are still being sorted out). This is all that there is. 


After balancing the image a bit and brightening up the area in question, I took a look to see how many available pixels there were to help fulfill the request.


Then I asked the question: which of these 6 pixels do you want clarified?

In these crazy economic times, preventative maintenance is usually the first thing to go. I'm sure that more of these types of files will be showing up in my inbox. Facility managers can't afford the up-keep on their CCTV systems, then hope the ol' CSI button still works at the local police station when something goes wrong. Didn't they do something like this on last night's episode?

Wednesday, January 21, 2009

Photoshop CS4 update development help

John Nack recently blogged about the development of the first CS4 update. They need your help. Check out his post for more information on how you can lend a hand.

More Acrobat Stuff

I received a number of comments from people using Adobe's Acrobat Pro in their workflow. Based on the content of those comments, it seems like folks are just touching the surface of what this powerful program can do. Which leads me to today's link.

AcrobatPodcast.com - if you are new to Acrobat Pro and PDF creation, check out these amazing podcasts for ideas on improving your workflow or adding features to your final product that you may never have thought of.

I'll be going over the creation of PDF portfolios and binders in a future series. So, consider this your warning. :-)

Until then ... enjoy.

Tuesday, January 20, 2009

Why so long?

Seattle Times: "A young man who spent nearly a year in jail awaiting trial in a fatal shooting at the Federal Way Transit Center was set free Thursday because surveillance video shows he was not the shooter, his attorney says."

"His defense lawyer says it took so long to dismiss the charge against Proctor because of delays in getting workable copies of the surveillance video."

I think that you'll be hearing more stories like this one in the near future. I've heard of ADAs out here that won't file a case involving proprietary digital CCTV unless the data has been converted to VHS and it clearly shows the crime and an ID can be clearly made on the suspect. Those ADAs don't want something like this Seattle case to happen to them.

Here's what I want from the next version of Photoshop

In an old blog post, Scott Kelby asks folks to list their top ten requests for new features to be included in the next Photoshop release.

Many of the comments he received were great. But, I'd like to add just one:

1. Presets for the Custom Filter ...

Sharpen Vertically
Sharpen Horizontally
Blur Vertically
Blur Horizontally
Sharpen Horizontally and Blur Vertically
Blur Horizontally and Sharpen Vertically

and etc.

... with an accompanying strength and/or fade slider.

I keep waiting, and using it as-is like a faithful old friend. (I know, it's called "Custom" for a reason. One can only ask and hope for the best, after all.)

Monday, January 19, 2009

Toonit!

Here's one that you don't get everyday. A reader asked about making line drawing head shots (like the ones used in the Wall Street Journal) for her agency's internal newsletter. She said, almost in a challenging way, that it should be easy for someone such as myself.

I'd like to devise a long tutorial about the various methods of doing something like this, but who has time for creative pursuits when you've got a newsletter to get to press?

A better idea ... Toonit! Digital Anarchy's handy little plug-in is just the tool needed for this job. Once downloaded and installed, you'll find it in the Filters menu under Digital Anarchy. There are all sorts of controls ... but you don't want allsorts ... you want results. So, click on Woodcuts from the presets menu on the right side of the dialog box. Then click OK.

 

If you've got a bunch of photos to get through, you'll enjoy the fact that it's really that easy. You can clean up the edges a bit, or leave it as-is. It's one of the quickest ways to get from basic image to outline effect. With all of the other presets, and the ability to tweak each one to your liking, it's well worth the price.

Saturday, January 17, 2009

Using Adobe Acrobat

Check out Rick Borstein's blog for information on an upcoming series of eSeminars on using Adobe Acrobat in the legal world.

With version 9 of Acrobat, they've fully integrated Flash and added a ton of cool features. I'm particularly interested in the new portfolio / binder features that will be shown in the final installment of the series, "Creating Electronic Closing Binders Using Acrobat 9." I think that this way of packaging and presenting information from multiple sources is just what we've been looking for.

Friday, January 16, 2009

Global warming?



Global warming seems to be effecting many of the images seen in today's media. It's been so long since it's been this cold for this many days, that many of the shots that are showing up in print and on the web aren't balanced correctly.

Remember to think in terms of the workflow. Check your image's overall colour and light for evidence of a colour cast or haze.

right out of the camera


colour/light corrected and sharpened
and we found that there was a person
standing behind the WRX wearing a pink hat

Wait, I thought all that CO2 from my gas guzz'ling American people mover was supposed to be making the planet hotter? Folks in the north east and upper mid-west are freezing. I'd better keep driving. Hopefully, after a while ... I can thaw the planet out.

Why CS4 - reason 3

Still on the fence about upgrading to CS4? Here's another reason to upgrade: new camera support.

The 4.6 update to Adobe Camera Raw was the last one for version 4. Now ACR is in version 5 and has already been updated since its initial release. What does this mean? New camera support will take place in ACR 5, not version 4. Stay with CS3, and you won't get that support.

ACR 5 also adds built in camera profiles for many manufacturers. Remember, shooting RAW mean no processing (which is why the RAW images tend to look flat). Saving JPEGs in the camera adds processing to the image. The addition of camera profile functionality in ACR 5 makes your RAW processing a little easier. But we'll get into ACR later.

Until then ... enjoy.

Avid Tutorials

A few recent e-mails have asked some very basic Avid editing questions. One of the issues seemed to be the expectation that with the Avid purchase there'd be comprehensive "Avid" training. I can't comment on that. But I will say that I've been using Avid for quite a while ... and there's still stuff that I'm finding out.

With that in mind, check out this cool page on Avid's site: 60+ Tutorials on basic Media Composer tips.

You've got to get your footage digitised somehow. Many are using Avid, but have no idea of its full potential. This link will get you 60 steps closer.

Art Walk LA

Please come out and support a local artist on Thursday, March 12th at 19:00. Metropolis Books is presenting local photographer and all around good guy, Jack Nadelle, and his work during Art Walk LA.


Quiet and unassuming, Jack (a genuine craftsman) lets his work do the talking for him. If you are in the LA area, this is one event you won't want to miss.


See you there.

Thursday, January 15, 2009

Why CS4 - reason 2

What was the old rule of thumb for zooming in? You only achieved an accurate view at certain view levels: 100%, 50%, etc. Not any more.

Thanks to the power of your computer's GPU, with Photoshop CS4 you can see the image accurately at every zoom level. Yes, that's right ... your image will look sharp at every zoom level.

What's more, if you select the Zoom Tool then click and hold within the image, you will watch in amazement as your image zooms in seamlessly. No more click and wait, click and wait ...

Another cool thing that is now possible thanks to your GPU is called "flick panning." iPhone and iPod touch users are used to this type of panning ... just press, hold, and flick to move the image around. This handy way of moving around an image is now part of Photoshop.

Want more? How about "Birds eye view." When you are zoomed in, click on H for the Hand tool. The image zooms out all the way (thus the name). Then, move the hand to the portion of the image that you need to see, and click again. You'll be zoomed in on that part of the image instantly. A couple of clicks speed your way around the image. You can also hold the Opt/Alt key and use your scroll wheel to zoom in and out of your image.

Not sure yet? Need more convincing? Ok ... here it goes. If you use a tablet (like me) and you are used to moving the tablet around to get a comfortable angle for painting masks or dodging/burning, you'll love this new feature. Click on the R key to rotate the image on the screen. Here you aren't changing the pixel matrix, you are just using that GPU to move the image around. So, instead of contorting your workspace, just rotate the image on screen. Now that's cool.

Still not convinced. Tomorrow we'll look at even more reasons to upgrade.

Until then ... enjoy.

Wednesday, January 14, 2009

Why CS4?

Just about everyone who writes about or teaches Photoshop is getting bombarded with questions about Photoshop CS4. In the government world, they tend to centre around "should we upgrade or should we wait?"

Here's the short answer: UPGRADE

If you've spent a truck-load full of cash on those high-end workstations from Ocean Systems, Salient Stills, Signalscape, Intergraph, and the like - they all have massive GPU power in the box. Photoshop CS4 has offloaded much of what used to be done in software to your machine's hardware, which really speeds things up. This hardware acceleration combined with a tightening up of the underlying code and redesigned panels means time savings to you. 

In today's "time is money" world, getting a little of that time back is reason #1 to justify the expense - think ROI (return on investment).

Tomorrow, we'll look at reason #2 to upgrade.

Until then ... enjoy.

Tuesday, January 13, 2009

Quick masks

A note came in asking about making a mask from a selection. The reader had heard that there was an easy way, but forgot how. Here's the answer.

In the old days, you would use the Magic Wand tool to make the selection. Then simply Click on the Add Layer Mask icon at the bottom of the layers panel.

Is there a new way? You bet.

CS4 has a bunch of new features, but this is one of my favourites. I do a lot of composition work and making masks quickly has always been a challenge. Until now, that is ...


Now, just make the selection and go to the Masks panel. Then select the Pixel Mask icon. Photoshop CS4 does all the work for you. You've even got a ton of controls for refining the mask that were never there before. How cool is that!

Monday, January 12, 2009

Study Critical of San Francisco Surveillance Cameras

"SAN FRANCISCO (KCBS) -- San Francisco’s surveillance cameras in high-crime areas do not prevent violent crime, according to a new study by researchers at the University of California.
The long-awaited study by the UC Center for Information Technology Research in the Interest of Society found the program is hurt by lack of training and oversight, a failure to integrate footage with other police efforts, poor quality cameras, and what may be a fundamental weakness of cameras as anti-crime devices.

Mayor Newsom began the program four years ago, but out of concern for people’s privacy, police are not allowed to monitor cameras in real time. Investigators must wait until a crime is reported before looking at footage."

Read the report by clicking here.

Cutting ribbons on CCTV projects may help get politicians re-elected, but let's finally stop saying that cameras "prevent" crime. Properly configured, positioned, maintained ... and with good timing, they "may" assist investigators in solving crimes. But "prevent" crime ...

Sunday, January 11, 2009

Can you spot the fake?

I recently performed an analysis on two images to help determine if the images were genuine or composites. While the issue is politically charged, I thought I'd give you a heads up as to the discussion. 

Look over the images. Read the arguments. Consider the points raised. Download the images and see for yourself.

I won't tell you yet what my initial conclusions were. I don't want to spoil the fun. (... and not to confuse anyone, my report has not been published yet and none of the comments on the site are mine)

Until then ... enjoy.

Friday, January 9, 2009

An interesting case

An interesting case that I've been working in private practice on focusses on the authenticity of certain photos posted to the popular photo sharing site Flickr.

   

A hex dump of the image revealed that it had been edited both in Picasa 3 as well as Photoshop. So I tried to see how this information trail ends up in the image - using my own images. 

The first capture of the hex is from a photo taken by me with my Fuji FinePix s6000fd and edited last year with Photoshop CS3 for Windows. I opened this image in Picasa 3 and applied a little brightening to the image and saved it with a different file name. Then I looked the hex dump of this new image. The camera info is still there, along with the original date of capture ... but the Photoshop info has been replaced by Picasa. Notice that on the bottom of the shot, there still remains a mention of Photoshop. Aside from the difference in camera and date, this second hex dump is formatted similar to the questioned photo, with the Picasa reference on the top and the Photoshop reference on the bottom.

As a control, I took a new shot and used Picasa 3 to move the image from my camera to my computer (normally, I would use Lightroom 2). Acquiring the image in this way, the hex had no reference to Adobe in the questioned area of the hex info.

This is an interesting case with more than just the hex information that's suspicious. I'll be reporting more in the near future.

Tuesday, January 6, 2009

YouTube vid leads to arrests

When will they learn. They posted their illegal activities on YouTube for all to see ... problem for them was ... the cops saw it too.

Read the article here.

Monday, January 5, 2009

Metadata is discoverable

This came off the RSS feed from the 2nd Circuit:

"Embedded metadata consists of “text, numbers, content, data, or other information that is directly or indirectly inputted into a [n]ative [f]ile by a user and which is not typically visible to the user viewing the output display” of the native file. Examples include spreadsheet formulas, hidden columns, externally or internally linked files (such as sound files), hyperlinks, references and fields, and database information. This type of metadata is often crucial to understanding an electronic document. For instance, a complicated spreadsheet may be difficult to comprehend without the ability to view the formulas underlying the output in each cell. For this reason, the District of Maryland working group concluded that embedded metadata is “generally discoverable” and “should be produced as a matter of course.”

Aguilar v. Immigration & Customs Enforcement Div., 2008 U.S. Dist. LEXIS 97018 at *14-15 (S.D.N.Y. Nov. 20, 2008) (internal citations removed).

Evidential Weight and Admissibility

BS 10008:2008 - Evidential weight and legal admissibility of electronic information. Specification

In a recent development, the British Standards Institution has released its Evidential weight and legal admissibility of electronic information specification.

"Legal admissibility concerns whether or not a piece of evidence would be accepted by a court of law. To ensure the admissibility, information needs to be managed by a secure system throughout its lifetime (which can be for many years). Where doubt can be placed on the information, the evidential weight may well be reduced, potentially harming the legal case."

"BS 10008 ensures that any electronic information required as evidence of a business transaction is afforded the maximum evidential weight. The process is based on the specification of requirements for planning, implementing, operating, monitoring and improving the organization’s information management systems."

So, what type of info is covered by the new standard? "The form of the information may be ‘page based’ (such as word processing documents and scanned or other images), may be ‘dynamic’ (such as documents with integrated formulae and databases), may be 3-dimensional and/or may contain voice / video recordings."

What does the standard include?
  • The management of electronic information over long periods, including through technology changes, where information integrity is vital
  • How to manage the various risks associated with electronic information
  • How to demonstrate the authenticity of electronic information
  • The management of quality issues related to document scanning processes
  • The provision of a full life history of an electronic object throughout its life
  • Electronic transfer of information from one computer system to another
  • Covers policies, security issues, procedures, technology requirements and auditability of electronic document management systems (EDMS).
Although this standard applies only in the UK, it may serve as a helpful guide to businesses interested in the management of their electronic information, regardless of their address.

Sunday, January 4, 2009

Mapping mouse buttons in Avid

One of the first things we are taught to do when setting up our Avids is to map the keyboard. Once I've put the mark-in / mark-out where I want them, my mix down in the right place, and my render button in a convenient spot ... one would think that I was done. But what about the mouse? Did you know that you can map the mouse buttons as well?

Open your mouse settings ("Mouse" in the settings window), then open your command palette (from Tools) and drag your favourite commands to the mouse buttons. Now obviously this works best with a multi-button mouse - or go nuts and get a Nostromo.