•  
  •  
 

Abstract

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given medium, and comparing individual digests with a database of known contraband. However, the large capacities of modern storage media and time pressures placed on forensics examiners necessitates the development of more efficient processing methods. This work describes a technique for fingerprinting JPEGs with optimised Huffman tables which requires only the image header to be present on the media. Such fingerprints are shown to be robust across large datasets, with demonstrably faster processing times.

References

Alakuijala, J., Obryk, R., Stoliarchuk, O., Sz- abadka, Z., Vandevenne, L., & Wassen- berg, J. (2017). Guetzli: Perceptually Guided JPEG Encoder. arXiv preprint arXiv:1703.04421 . Retrieved 2017-05- 31, from https://arxiv.org/abs/1703 .04421 Beebe, N., & Clark, J. (2005). Dealing with Ter- abyte Data Sets in Digital Investigations. In M. Pollitt & S. Shenoi (Eds.), Advances in Digital Forensics (Vol. 194, pp. 3–16). Springer US. Retrieved from http://dx .doi.org/10.1007/0-387-31163-7 1 Breitinger, F., Liu, H., Winter, C., Baier, H., Ry- balchenko, A., & Steinebach, M. (2013). Towards a process model for hash func- tions in digital forensics. In International Conference on Digital Forensics and Cyber Crime (pp. 170–186). Springer. Cryer, J. (2016). Resemble.js: Image analy- sis and comparison. Retrieved 2017-02- 21, from https://github.com/Huddle/ Resemble.js Edmundson, D., & Schaefer, G. (2012). Fast JPEG image retrieval using op- timised Huffman tables. In Pattern Recognition (ICPR), 2012 21st Interna- tional Conference on (pp. 3188–3191). IEEE. Retrieved 2016-03-16, from http://ieeexplore.ieee.org/xpls/ abs all.jsp?arnumber=6460842 Edmundson, D., & Schaefer, G. (2013, Novem- ber). Very Fast Image Retrieval Based on JPEG Huffman Tables. In 2013 2nd IAPR Asian Conference on Pattern Recog- nition (ACPR) (pp. 29–33). doi: 10.1109/ ACPR.2013.18 Farid, H. (2006). Digital image ballistics from JPEG quantization (Tech. Rep.). Tech- nical Report TR2006-583, Department of Computer Science, Dartmouth College. Farid, H. (2008). Digital image ballistics from JPEG quantization: A followup study. Department of Computer Sci- ence, Dartmouth College, Tech. Rep. TR2008-638 . Retrieved 2016-05-06, from 12 http://www.cs.dartmouth.edu/farid/ downloads/publications/tr08.pdf Garfinkel, S., Farrell, P., Roussev, V., & Dinolt, G. (2009, September). Bringing science to digital forensics with standardized forensic corpora. Digital Investigation , 6 , S2–S11. Retrieved 2016-03-05, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287609000346 doi: 10.1016/j.diin.2009.06.016 Garfinkel, S., Nelson, A., White, D., & Roussev, V. (2010, August). Us- ing purpose-built functions and block hashes to enable small block and sub- file forensics. Digital Investigation , 7 , S13–S23. Retrieved 2016-03-03, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287610000307 doi: 10.1016/j.diin.2010.05.003 Gloe, T. (2012). Forensic analysis of ordered data structures on the exam- ple of JPEG files. In Information Forensics and Security (WIFS), 2012 IEEE International Workshop on (pp. 139–144). IEEE. Retrieved 2016-04- 29, from http://ieeexplore.ieee.org/ xpls/abs all.jsp?arnumber=6412639 Huiskes, M. J., Thomee, B., & Lew, M. S. (2010). New trends and ideas in visual concept de- tection: the MIR flickr retrieval evaluation initiative. In Proceedings of the interna- tional conference on Multimedia informa- tion retrieval (pp. 527–536). ACM. Re- trieved 2017-02-22, from http://dl.acm .org/citation.cfm?id=1743475 Independent JPEG Group. (2016). Libjpeg. Re- trieved 2017-02-20, from http://www.ijg .org/ Kee, E., Johnson, M. K., & Farid, H. (2011). Digital image authentication from JPEG headers. Information Foren- sics and Security, IEEE Transactions on , 6 (3), 1066–1075. Retrieved 2016-04- 05, from http://ieeexplore.ieee.org/ xpls/abs all.jsp?arnumber=5732683 Kornblum, J. (2006, September). Identify- ing almost identical files using context triggered piecewise hashing. Digital Investigation , 3, Supplement , 91–97. Retrieved 2016-03-04, from http:// www.sciencedirect.com/science/ article/pii/S1742287606000764 doi: 10.1016/j.diin.2006.06.015 Kornblum, J. D. (2008, September). Us- ing JPEG quantization tables to identify imagery processed by soft- ware. Digital Investigation , 5 , S21– S25. Retrieved 2016-04-14, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287608000285 doi: 10.1016/j.diin.2008.05.004 Mahdian, B., Saic, S., & Nedbal, R. (2010). JPEG quantization tables forensics: a sta- tistical approach. In Computational Foren- sics (pp. 150–159). Springer. McKeown, S., Russell, G., & Leimich, P. (2017). Fast Filtering of Known PNG Files Using Early File Features. In Annual ADFSL Conference on Digital Forensics, Security and Law. Daytona Beach, Florida, USA. Mozilla. (2017). Mozjpeg: Improved JPEG encoder. Retrieved 2017-02-20, from https://github.com/mozilla/mozjpeg Piva, A. (2013). An Overview on Image Forensics. ISRN Signal Processing , 2013 , 1–22. Retrieved 2016-05-06, from http://www.hindawi.com/journals/ isrn.signal.processing/2013/496701/ doi: 10.1155/2013/496701 Quick, D., & Choo, K.-K. R. (2014, December). Impacts of increasing volume of digital forensic data: A survey and future research challenges. Digital Investigation , 11 (4), 273–294. Retrieved 2015-10-06, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287614001066 doi: 10.1016/j.diin.2014.09.002 Roussev, V. (2010). Data fingerprinting with similarity digests. In Advances in digital forensics vi (pp. 207–226). Springer. Retrieved 2016-03-04, from http://link.springer.com/chapter/ 10.1007/978-3-642-15506-2 15 Schaefer, G., Edmundson, D., & Saku- rai, Y. (2013, December). Fast JPEG Image Retrieval Based on AC 13 Huffman Tables. In (pp. 26–30). IEEE. Retrieved 2016-04-15, from http://ieeexplore.ieee.org/lpdocs/ epic03/wrapper.htm?arnumber=6727165 doi: 10.1109/SITIS.2013.16 Schaefer, G., Edmundson, D., Takada, K., Tsuruta, S., & Sakurai, Y. (2012, Novem- ber). Effective and Efficient Filtering of Retrieved Images Based on JPEG Header Information. In (pp. 644–649). IEEE. Retrieved 2016-03-31, from http://ieeexplore.ieee.org/lpdocs/ epic03/wrapper.htm?arnumber=6395154 doi: 10.1109/SITIS.2012.97 Wallace, G. K. (1992). The JPEG still picture compression standard. Con- sumer Electronics, IEEE Transactions on , 38 (1), xviii–xxxiv. Retrieved 2016-03- 11, from http://ieeexplore.ieee.org/ xpls/abs all.jsp?arnumber=125072Alakuijala, J., Obryk, R., Stoliarchuk, O., Sz- abadka, Z., Vandevenne, L., & Wassen- berg, J. (2017). Guetzli: Perceptually Guided JPEG Encoder. arXiv preprint arXiv:1703.04421 . Retrieved 2017-05- 31, from https://arxiv.org/abs/1703 .04421 Beebe, N., & Clark, J. (2005). Dealing with Ter- abyte Data Sets in Digital Investigations. In M. Pollitt & S. Shenoi (Eds.), Advances in Digital Forensics (Vol. 194, pp. 3–16). Springer US. Retrieved from http://dx .doi.org/10.1007/0-387-31163-7 1 Breitinger, F., Liu, H., Winter, C., Baier, H., Ry- balchenko, A., & Steinebach, M. (2013). Towards a process model for hash func- tions in digital forensics. In International Conference on Digital Forensics and Cyber Crime (pp. 170–186). Springer. Cryer, J. (2016). Resemble.js: Image analy- sis and comparison. Retrieved 2017-02- 21, from https://github.com/Huddle/ Resemble.js Edmundson, D., & Schaefer, G. (2012). Fast JPEG image retrieval using op- timised Huffman tables. In Pattern Recognition (ICPR), 2012 21st Interna- tional Conference on (pp. 3188–3191). IEEE. Retrieved 2016-03-16, from http://ieeexplore.ieee.org/xpls/ abs all.jsp?arnumber=6460842 Edmundson, D., & Schaefer, G. (2013, Novem- ber). Very Fast Image Retrieval Based on JPEG Huffman Tables. In 2013 2nd IAPR Asian Conference on Pattern Recog- nition (ACPR) (pp. 29–33). doi: 10.1109/ ACPR.2013.18 Farid, H. (2006). Digital image ballistics from JPEG quantization (Tech. Rep.). Tech- nical Report TR2006-583, Department of Computer Science, Dartmouth College. Farid, H. (2008). Digital image ballistics from JPEG quantization: A followup study. Department of Computer Sci- ence, Dartmouth College, Tech. Rep. TR2008-638 . Retrieved 2016-05-06, from 12 http://www.cs.dartmouth.edu/farid/ downloads/publications/tr08.pdf Garfinkel, S., Farrell, P., Roussev, V., & Dinolt, G. (2009, September). Bringing science to digital forensics with standardized forensic corpora. Digital Investigation , 6 , S2–S11. Retrieved 2016-03-05, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287609000346 doi: 10.1016/j.diin.2009.06.016 Garfinkel, S., Nelson, A., White, D., & Roussev, V. (2010, August). Us- ing purpose-built functions and block hashes to enable small block and sub- file forensics. Digital Investigation , 7 , S13–S23. Retrieved 2016-03-03, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287610000307 doi: 10.1016/j.diin.2010.05.003 Gloe, T. (2012). Forensic analysis of ordered data structures on the exam- ple of JPEG files. In Information Forensics and Security (WIFS), 2012 IEEE International Workshop on (pp. 139–144). IEEE. Retrieved 2016-04- 29, from http://ieeexplore.ieee.org/ xpls/abs all.jsp?arnumber=6412639 Huiskes, M. J., Thomee, B., & Lew, M. S. (2010). New trends and ideas in visual concept de- tection: the MIR flickr retrieval evaluation initiative. In Proceedings of the interna- tional conference on Multimedia informa- tion retrieval (pp. 527–536). ACM. Re- trieved 2017-02-22, from http://dl.acm .org/citation.cfm?id=1743475 Independent JPEG Group. (2016). Libjpeg. Re- trieved 2017-02-20, from http://www.ijg .org/ Kee, E., Johnson, M. K., & Farid, H. (2011). Digital image authentication from JPEG headers. Information Foren- sics and Security, IEEE Transactions on , 6 (3), 1066–1075. Retrieved 2016-04- 05, from http://ieeexplore.ieee.org/ xpls/abs all.jsp?arnumber=5732683 Kornblum, J. (2006, September). Identify- ing almost identical files using context triggered piecewise hashing. Digital Investigation , 3, Supplement , 91–97. Retrieved 2016-03-04, from http:// www.sciencedirect.com/science/ article/pii/S1742287606000764 doi: 10.1016/j.diin.2006.06.015 Kornblum, J. D. (2008, September). Us- ing JPEG quantization tables to identify imagery processed by soft- ware. Digital Investigation , 5 , S21– S25. Retrieved 2016-04-14, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287608000285 doi: 10.1016/j.diin.2008.05.004 Mahdian, B., Saic, S., & Nedbal, R. (2010). JPEG quantization tables forensics: a sta- tistical approach. In Computational Foren- sics (pp. 150–159). Springer. McKeown, S., Russell, G., & Leimich, P. (2017). Fast Filtering of Known PNG Files Using Early File Features. In Annual ADFSL Conference on Digital Forensics, Security and Law. Daytona Beach, Florida, USA. Mozilla. (2017). Mozjpeg: Improved JPEG encoder. Retrieved 2017-02-20, from https://github.com/mozilla/mozjpeg Piva, A. (2013). An Overview on Image Forensics. ISRN Signal Processing , 2013 , 1–22. Retrieved 2016-05-06, from http://www.hindawi.com/journals/ isrn.signal.processing/2013/496701/ doi: 10.1155/2013/496701 Quick, D., & Choo, K.-K. R. (2014, December). Impacts of increasing volume of digital forensic data: A survey and future research challenges. Digital Investigation , 11 (4), 273–294. Retrieved 2015-10-06, from http://linkinghub.elsevier.com/ retrieve/pii/S1742287614001066 doi: 10.1016/j.diin.2014.09.002 Roussev, V. (2010). Data fingerprinting with similarity digests. In Advances in digital forensics vi (pp. 207–226). Springer. Retrieved 2016-03-04, from http://link.springer.com/chapter/ 10.1007/978-3-642-15506-2 15 Schaefer, G., Edmundson, D., & Saku- rai, Y. (2013, December). Fast JPEG Image Retrieval Based on AC 13 Huffman Tables. In (pp. 26–30). IEEE. Retrieved 2016-04-15, from http://ieeexplore.ieee.org/lpdocs/ epic03/wrapper.htm?arnumber=6727165 doi: 10.1109/SITIS.2013.16 Schaefer, G., Edmundson, D., Takada, K., Tsuruta, S., & Sakurai, Y. (2012, Novem- ber). Effective and Efficient Filtering of Retrieved Images Based on JPEG Header Information. In (pp. 644–649). IEEE. Retrieved 2016-03-31, from http://ieeexplore.ieee.org/lpdocs/ epic03/wrapper.htm?arnumber=6395154 doi: 10.1109/SITIS.2012.97 Wallace, G. K. (1992). The JPEG still picture compression standard. Con- sumer Electronics, IEEE Transactions on , 38 (1), xviii–xxxiv. Retrieved 2016-03- 11, from http://ieeexplore.ieee.org/ xpls/abs all.jsp?arnumber=125072

Download

Share

COinS
 
 

To view the content in your browser, please download Adobe Reader or, alternately,
you may Download the file to your hard drive.

NOTE: The latest versions of Adobe Reader do not support viewing PDF files within Firefox on Mac OS and if you are using a modern (Intel) Mac, there is no official plugin for viewing PDF files within the browser window.