Hex Searching

One of the interesting aspects of having a blog is that some people will write to you asking about something related that they read elsewhere on the web. While I am generally friendly and prompt in my replies to questions that come from this blog, I'm often left wondering ... why didn't you just ask them?

Here's an example.

California is going nuts with image authentication issues related to law enforcement's use of images from Facebook. Last year, Scott Anderson wrote an outstanding overview of image authentication techniques as his Masters thesis at UC Denver's National Center for Media Forensics.

The reader wants to know about "practical applications" of Scott's thesis as regards law enforcement. My response: he couldn't be more clear. The question had to do with searching hex data for signs that an image had been "Photoshopped."

First, I reminded the reader of Scott's admonition that there is no one "right way" to authenticate images. There are many right ways, some will work better than others. Also, there should be a specific allegation of forgery that can be tested against.

I asked the reader to perform a simple test. Take a picture with your camera phone. Upload it directly to your Facebook account. Log in to Facebook and click on the picture. On the Options tab, click download. You will now have two versions of the picture - the one on your phone and the one downloaded from Facebook. Examine both with a hex editor. Use the find feature and search for terms like Photoshop, Picasa, and so forth. (Scott offers sample search terms in the back of his paper)

Now, open one of the pictures in Photoshop. Do something to it and save it. Open the hex editor again and search for the word Photoshop. What did you find?

In my test, I found multiple instances of the word ... usually following whatever was done by Photoshop.

If you're not familiar with Scott Anderson's thesis, take a minute and read it (well, more than a minute ...). It's a great example of the wonderful work being done in Denver.

Enjoy.

Some Myths and Facts About Science

An outstanding set of quotes from the FJC's How Science Works:

"... Because science is an adversary process in which each idea deserves the most vigorous possible defense, it is useful for the successful progress of science that scientists tenaciously hang on to their own ideas, even in the face of contrary evidence (and they do, they do) ..."

"... There is a very large component of skill in making cutting-edge experiments work. Often, the only way to import a new technique into a laboratory is to hire someone (usually a postdoctoral fellow) who has already made it work elsewhere. Nevertheless, scientists have a solemn responsibility to describe the methods they use as fully and accurately as possible. And, eventually, the skill will be acquired by enough people to make the new technique commonplace."

The take-away from this section of the publication; every scientist who comes up with a new way of examining/processing evidence has a duty to defend it vigorously by documenting it as fully and accurately as possible - then sharing it with the greater community so that this new method will eventually become commonplace.

Enjoy.

Peer Review and Publication

Here's a few nice quotes on the value of peer review and publication from the Daubert Uncensored blog:

"Another pertinent consideration is whether the theory or technique has been subjected to peer review and publication. Publication (which is but one element of peer review) is not a sine qua non of admissibility; it does not necessarily correlate with reliability, and in some instances well-grounded but innovative theories will not have been published. Some propositions, moreover, are too particular, too new, or of too limited interest to be published. But submission to the scrutiny of the scientific community is a component of “good science,” in part because it increases the likelihood that substantive flaws in methodology will be detected. The fact of publication (or lack thereof) in a peer reviewed journal thus will be a relevant, though not dispositive, consideration in assessing the scientific validity of a particular technique or methodology on which an opinion is premised."

"But how do these considerations affect the admissibility analysis? Significantly. Experts testifying in large-scale litigation are usually leaders in their field—when the outcome depends upon compelling expert testimony, parties ordinarily retain first-string experts. Challenging the experts’ qualifications will almost always be futile, so focusing on peer review and publication will strengthen any challenge to the testimony."

“The ultimate test of a scientific expert’s integrity is her readiness to publish and be damned.”

"Haller v. AstraZeneca Pharm. LP, 598 F.Supp.2d 1271, 1296-97 (M.D. Fla. 2009). See generally Kumho Tire, 526 U.S. at 152 (holding that Daubert standards are intended “to make certain that an expert, whether basing testimony upon professional studies or personal experience, employs in the courtroom the same level of intellectual rigor that characterizes the practice of an expert in the relevant field”)."

"Expert witnesses are quick to spew litigation opinions as clear, compelling, beyond doubt, and a no-brainer, when they would never dare to submit those same opinions to the scrutiny of their peers. The experts’ unwillingness to subject opinions to peer review and publication speaks volumes about the scientific reliability of the analyses and conclusions."

Enjoy.

The Dry Run

Here's an interesting angle on Daubert hearings from forensic-psych.com: "By providing a picture of the expert in action under cross-examination, expert depositions commonly serve as "dry runs" for trial preparation. However, Daubert hearings have the advantage of providing a second opportunity to probe the expert, as well as to obtain an otherwise unavailable assessment of the trial judge's attitudes toward the case. In those jurisdictions where depositions do not occur or are not allowed in civil or criminal cases, thus depriving attorneys of the opportunity to perform a dry run of the cross-examination of the opposing expert, a Daubert hearing may serve the purpose of obtaining an equally valuable advance look at the opposing experts' opinions, bases, methodology, and courtroom demeanor. The resultant data can be put to very good use by the attorney in case preparation, mastery of the relevant literature, and the like."

They go on to say ...

"Just as moving for an unnecessary examination for competence to stand trial may aid the attorney in laying a foundation (if only in the public's mind) for a later insanity plea, moving for an unnecessary Daubert hearing may lay the foundation for later efforts to impeach the expert's reasoning on scientific grounds. Even if the expert's opinion is ultimately not excluded, the knowledge gained in the process (the dry run suggested in the prior section) may be helpful to the attorney in designing more effective cross-examination for trial."

Further more ...

"The motion for a Daubert hearing may constitute no more than an attempt at simple harassment of the experts, designed to shake their confidence in their own testimony by a threshold challenge to their approach, methodology, reasoning, and professional acceptance of the experts' theory of the case."

If you're in the game ... know the players and the rules.

Enjoy.

Daubert and criminal justice

Over on LinkedIn, some have suggested that Daubert really isn't as helpful in criminal cases as it has been in civil courts. Here's an opinion from Peter J. Neufeld, JD, on defending science.org: "An analysis of post-Daubert decisions demonstrates that whereas civil defendants prevail in their Daubert challenges, most of the time criminal defendants almost always lose their challenges to government proffers. But when the prosecutor challenges a criminal defendant’s expert evidence, the evidence is almost always kept out of the trial. This is true in both federal and state courts. And even though Frye remains the test in more than a dozen states, criminal defendants fared no better under Frye. In the first 7 years after Daubert, there were 67 reported federal appellate decisions reviewing defense challenges to prosecution experts. The government prevailed in all but 6, and even among the 6, only 1 resulted in the reversal of a conviction. In contrast, in the 54 cases in which the defense appealed a trial court ruling to exclude the defendant’s expert, the defendant lost in 44 cases. In 7 of the remaining 10, the case was remanded for a Daubert hearing."

While the article is more than seven years old, it's still relevant. It also has a wealth of resources in it's reference list. It begs a lot of questions - mainly, why do privateer experts not fare as well in criminal cases? Is money really the issue?

Interesting none the less.

I'm off to Louisiana

I'm heading out the door, going to Baton Rouge for the Louisiana Association of Forensic Scientists meeting next week. I'm looking forward to presenting two days of Photoshop training at the meeting. If you're in the NOLA or Baton Rouge area ... look me up.

See you soon.

Premiere Pro CS6: what’s new and changed

Click here for a quick blog post about Premiere Pro CS6. I'm looking forward to seeing Adobe Prelude CS6.

Forensic Photoshop Book - promo pricing

If you've been waiting to get the book, the wait's over ... Blurb is offering promotional pricing on orders of 2 or more books from their web site. Use offer code ORDERUP to receive 20% off your order. But, act soon. The offer ends on May 2, 2012.

Google Apps and e-discovery

From Australia's Image & Data Manager: "An ediscovery application has been launched for Google Apps known as Vault aimed at reducing the costs of litigation, regulatory investigation and compliance actions.

Google says Vault provides extended management and information governance capabilities to proactively archive, retain and preserve Gmail and on-the-record chats.

It offers the ability to search and manage data based on terms, dates, senders, recipients and labels to give management, IT, legal and compliance users a systemised, repeatable and defensible platform.

Google Apps Vault can be added to an existing Google Apps account for an additional $US5 per user per month.

“It will be very hard for IT managers to justify the cost of expensive on-site email archiving when all the old data can be migrated to the cloud for $5 a user. The cloud continues to deliver economies of scale that organisations can no longer ignore.”

Check out Google Vault by clicking here.

Enjoy.