Multimedia Security, Volume 1

1How to Reconstruct the History of a Digital Image, and of Its Alterations

Quentin BAMMEY¹, Miguel COLOM¹, Thibaud EHRET¹, Marina GARDELLA¹, Rafael GROMPONE¹, Jean-Michel MOREL¹, Tina NIKOUKHAH¹ and Denis PERRAUD²

¹ Centre Borelli, ENS Paris-Saclay, University of Paris-Saclay, CNRS, Gif-sur-Yvette, France

² Technical and Scientific Police, Central Directorate of the Judicial Police, Lyon, France

Between its raw acquisition from a camera sensor and its storage, an image undergoes a series of operations: denoising, demosaicing, white balance, gamma correction and compression. These operations produce artifacts in the final image, often imperceptible to the naked eye but yet detectable. By analyzing those artifacts, it is possible to reconstruct the history of an image. Indeed, one can model the different operations that took place during the creation of the image, as well as their order and parameters.

Information about the specific camera pipeline of an image is relevant by itself, in particular because it can guide the restoration of the image. More importantly, it provides an identifying signature of the image. A model of the pipeline that is inconsistent across the whole image is often a clue that the image has been tampered with.

However, the traces left by each step can be altered or even erased by subsequent processing operations. Sometimes these traces are even maliciously masked to make a forged image seem authentic to forensic tools. While it may be easy to deliberately ...