Image Analysis Report 1000-01
Case No. 1000-01
Conducted by: The Grave Hunters Society, LLC
Presented to: The Public
Researcher: Jonathan Batteas
|2014/26/10||0.01||Draft of Background Information|
|2020/06/03||0.1||First Report Draft|
Current Version: 1.0
Confidential Information This report shall not be excerpted without prior written permission of The Grave Hunters Society, LLC
Table of Contents
- Executive Summary
- part 1.1 - Summary of reasons for report
- part 2.1 - In-depth background surrounding the creation of the evidence
- part 3.1 - Specifics about purpose of report
- Evidence Analyzed
- part 4.1 - Primary evidence including descriptions and classifications
- part 4.2 - Secondary evidence including descriptions and classifications
- part 5.1 - Tests performed and tools used
- part 6.1 - Conclusion statement
- part 6.2 - Conclusion evidence
- part 7.1 - Researcher Signature
- part 8.1
- Exhibit A - Chain of Custody
- part 8.2
- Exhibit B - Reference table for further explanation of tools and methods
- part 8.1
On October 25, 2014, Andrea Batteas captured an image that contains an unidentifiable mass. This report was written to preempt claims of digital manipulation, and as a continuation of original EXIF data and Error Level Analysis that was undertaken initially on October 26, 2014. This report is not meant to offer any explanation of what is visible within the photograph, only whether digital artifacts exist that might indicate any kind of digital manipulation.
Originally recorded on October 26, 2014, by Jonathan Batteas.
Andrea and Jonathan Batteas went on the Ghosts and Goblets Quaker Hill Tour in Waynesville on Oct. 25, 2014. The tour ended around nine or 9:30, and they went back to the Museum in the Friends Home for a while, conversing with Linda and Mary at length.
Afterward, they went to the McDonalds on Main St. and had some ice cream. Later, they decided to walk to 237 S. Main St. to take pictures. The time was approximately 10:30. (The last photo at the museum has a timestamp of 10:08:05 from Andrea’s iPhone. Then, the next correct timestamp is 10:45:10 from Jonathan’s iPhone. So, this picture was taken sometime between 10:08 and 10:45.
To present evidence to determine whether any digital manipulation of the image in question has taken place. The purpose of this report is not to offer an explanation, nor to determine what is pictured, only that the photograph itself is genuine.
The jpeg image extracted from the camera media titled
DSCF0096.JPG (renamed to
DSCF0096.jpg for file format recognition by Sherloq.) on October 25, 2014, which was immediately compressed in a zip format titled
Oct 25 2014.zipalong with the rest of that evening’s photographs by myself (Jonathan Batteas). This zip file was kept in sync between multiple machines via Dropbox and Resilio Sync. Any analysis done on the image was performed on copies, verified by MD5 or SHA512 hash comparison.
A nighttime photograph, illuminated by a flash, containing an angled view of the facade of the building located at 237 S. Main St., Waynesville, OH. The front steps are visible. A gaseous shape of unknown substance and origin is located near the roof of the named building in the upper-left of the image. In the lower-right of the image foreground, a bush of purple flowers is visible. There is a white, diagonal shape in the extreme foreground along the right side of the image, making the edges of the image appear as if they are not square.
Secondary evidence exists in the form of contemporaneous photographs taken with an iPhone. These photographs are not considered in this report and will be the subject of their statement.
|2020/04/19||18:51||Ghiro Automated Digital Image Forensics||Report||Automated report attached|
|2020/06/12||15:29||Check Quantization Table Matrix Against Known Table Database||Report||Comparing the quantization table of the image against a database of tables which contains known tables from: The Dresden Digital Image Set, The VISION Digital Image Set, The HDR Digital Image Set, Independent Jpeg Group Standard Tables, and Photoshop Tables.|
|2020/06/12||15:29||Check Quantization Table Matrix Against Quantization Table Database from the Same Device||Report||Since this camera is owned and operated by us, we have a backlog of 3268 photos against which we can run a quantization table comparison.|
|2020/06/13||12:30||Error Level Analysis using Sherloq||Report||Look for bright, white areas, or purple-red patterns around edges. These indicate a higher potential error level. The overall color should be consistent across the image.|
|2020/06/13||12:50||Principal Component Analysis Decomposition using Sherloq||Report||Examine first, second, and third principal components looking for mosaic artifacts, or differences in quality among areas of photograph.|
|2020/06/13||12:22||Luminance Gradient using Sherloq||Report||Look for consistent bumps representing noise, or at higher levels, consistent jagged lines. Flat areas and straight lines could indicate manipulation. Also, pay attention to the light direction and distribution to see that they are consistent.|
|2020/06/24||22:40||Echo Edge Filter using Sherloq||Report||Look for edges where there should be none, and artificial blurring.|
|2020/06/13||12:34||Noise Estimation using Sherloq||Report||Look for any pattern at all. Noise should appear consistent and have no underlying shape to indicate that noise was artificially added.|
It is my expert opinion that based upon the evidence available in and around the image, that this image is in its original state as created by the camera, and has not undergone any secondary, digital manipulation.
The points supporting the above conclusion:
- EXIF information is consistent with the model of camera and indicates no software manipulation
- Quantization Table analysis matched no well-known software packages including Photoshop and IJG Standard tables
- Quantization Table did match tables from other images produced by the same camera
- Error Level Analysis shows a consistent level of compression throughout the image
- Principal Component Analysis shows very high consistency throughout the image
- The luminance gradient shows consistent lighting and no smooth areas. The edges of the buildings are very sharp, as expected in a photo brightly illuminated from a single direction (like a flash)
- Edge Filter shows no hard edges where they shouldn’t be
- Noise Estimation does show some blocking. However, this seems to be highlighted not by one area, but throughout the entire photo, based on very little noise being applied to the very hard edges of objects. Because of the consistency of noise away from edges, this could be indicative of the way the camera compressed the image
Exhibit A – Chain of Custody
Exhibit B – Reference
|Using JPEG Quantization Tables to Identify Imagery Processed by Software||https://www.dfrws.org/sites/default/files/session-files/paper-using_jpeg_quantization_tables_to_identify_imagery_processed_by_software.pdf|
|VISION: a video and image dataset for source identification||https://link.springer.com/article/10.1186/s13635-017-0067-2|
|A Picture’s Worth: Digital Image Analysis and Forensics||http://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf|
|Digital Image Ballistics from JPEG Quantization||https://farid.berkeley.edu/downloads/publications/tr06a.pdf|
|Body by Victoria||http://www.hackerfactor.com/blog/index.php?/archives/322-Body-By-Victoria.html|