Hex Searching

One of the interesting aspects of having a blog is that some people will write to you asking about something related that they read elsewhere on the web. While I am generally friendly and prompt in my replies to questions that come from this blog, I'm often left wondering ... why didn't you just ask them?

Here's an example.

California is going nuts with image authentication issues related to law enforcement's use of images from Facebook. Last year, Scott Anderson wrote an outstanding overview of image authentication techniques as his Masters thesis at UC Denver's National Center for Media Forensics.

The reader wants to know about "practical applications" of Scott's thesis as regards law enforcement. My response: he couldn't be more clear. The question had to do with searching hex data for signs that an image had been "Photoshopped."

First, I reminded the reader of Scott's admonition that there is no one "right way" to authenticate images. There are many right ways, some will work better than others. Also, there should be a specific allegation of forgery that can be tested against.

I asked the reader to perform a simple test. Take a picture with your camera phone. Upload it directly to your Facebook account. Log in to Facebook and click on the picture. On the Options tab, click download. You will now have two versions of the picture - the one on your phone and the one downloaded from Facebook. Examine both with a hex editor. Use the find feature and search for terms like Photoshop, Picasa, and so forth. (Scott offers sample search terms in the back of his paper)

Now, open one of the pictures in Photoshop. Do something to it and save it. Open the hex editor again and search for the word Photoshop. What did you find?

In my test, I found multiple instances of the word ... usually following whatever was done by Photoshop.

If you're not familiar with Scott Anderson's thesis, take a minute and read it (well, more than a minute ...). It's a great example of the wonderful work being done in Denver.

Enjoy.

Some Myths and Facts About Science

An outstanding set of quotes from the FJC's How Science Works:

"... Because science is an adversary process in which each idea deserves the most vigorous possible defense, it is useful for the successful progress of science that scientists tenaciously hang on to their own ideas, even in the face of contrary evidence (and they do, they do) ..."

"... There is a very large component of skill in making cutting-edge experiments work. Often, the only way to import a new technique into a laboratory is to hire someone (usually a postdoctoral fellow) who has already made it work elsewhere. Nevertheless, scientists have a solemn responsibility to describe the methods they use as fully and accurately as possible. And, eventually, the skill will be acquired by enough people to make the new technique commonplace."

The take-away from this section of the publication; every scientist who comes up with a new way of examining/processing evidence has a duty to defend it vigorously by documenting it as fully and accurately as possible - then sharing it with the greater community so that this new method will eventually become commonplace.

Enjoy.

Peer Review and Publication

Here's a few nice quotes on the value of peer review and publication from the Daubert Uncensored blog:

"Another pertinent consideration is whether the theory or technique has been subjected to peer review and publication. Publication (which is but one element of peer review) is not a sine qua non of admissibility; it does not necessarily correlate with reliability, and in some instances well-grounded but innovative theories will not have been published. Some propositions, moreover, are too particular, too new, or of too limited interest to be published. But submission to the scrutiny of the scientific community is a component of “good science,” in part because it increases the likelihood that substantive flaws in methodology will be detected. The fact of publication (or lack thereof) in a peer reviewed journal thus will be a relevant, though not dispositive, consideration in assessing the scientific validity of a particular technique or methodology on which an opinion is premised."

"But how do these considerations affect the admissibility analysis? Significantly. Experts testifying in large-scale litigation are usually leaders in their field—when the outcome depends upon compelling expert testimony, parties ordinarily retain first-string experts. Challenging the experts’ qualifications will almost always be futile, so focusing on peer review and publication will strengthen any challenge to the testimony."

“The ultimate test of a scientific expert’s integrity is her readiness to publish and be damned.”

"Haller v. AstraZeneca Pharm. LP, 598 F.Supp.2d 1271, 1296-97 (M.D. Fla. 2009). See generally Kumho Tire, 526 U.S. at 152 (holding that Daubert standards are intended “to make certain that an expert, whether basing testimony upon professional studies or personal experience, employs in the courtroom the same level of intellectual rigor that characterizes the practice of an expert in the relevant field”)."

"Expert witnesses are quick to spew litigation opinions as clear, compelling, beyond doubt, and a no-brainer, when they would never dare to submit those same opinions to the scrutiny of their peers. The experts’ unwillingness to subject opinions to peer review and publication speaks volumes about the scientific reliability of the analyses and conclusions."

Enjoy.

The Dry Run

Here's an interesting angle on Daubert hearings from forensic-psych.com: "By providing a picture of the expert in action under cross-examination, expert depositions commonly serve as "dry runs" for trial preparation. However, Daubert hearings have the advantage of providing a second opportunity to probe the expert, as well as to obtain an otherwise unavailable assessment of the trial judge's attitudes toward the case. In those jurisdictions where depositions do not occur or are not allowed in civil or criminal cases, thus depriving attorneys of the opportunity to perform a dry run of the cross-examination of the opposing expert, a Daubert hearing may serve the purpose of obtaining an equally valuable advance look at the opposing experts' opinions, bases, methodology, and courtroom demeanor. The resultant data can be put to very good use by the attorney in case preparation, mastery of the relevant literature, and the like."

They go on to say ...

"Just as moving for an unnecessary examination for competence to stand trial may aid the attorney in laying a foundation (if only in the public's mind) for a later insanity plea, moving for an unnecessary Daubert hearing may lay the foundation for later efforts to impeach the expert's reasoning on scientific grounds. Even if the expert's opinion is ultimately not excluded, the knowledge gained in the process (the dry run suggested in the prior section) may be helpful to the attorney in designing more effective cross-examination for trial."

Further more ...

"The motion for a Daubert hearing may constitute no more than an attempt at simple harassment of the experts, designed to shake their confidence in their own testimony by a threshold challenge to their approach, methodology, reasoning, and professional acceptance of the experts' theory of the case."

If you're in the game ... know the players and the rules.

Enjoy.

Daubert and criminal justice

Over on LinkedIn, some have suggested that Daubert really isn't as helpful in criminal cases as it has been in civil courts. Here's an opinion from Peter J. Neufeld, JD, on defending science.org: "An analysis of post-Daubert decisions demonstrates that whereas civil defendants prevail in their Daubert challenges, most of the time criminal defendants almost always lose their challenges to government proffers. But when the prosecutor challenges a criminal defendant’s expert evidence, the evidence is almost always kept out of the trial. This is true in both federal and state courts. And even though Frye remains the test in more than a dozen states, criminal defendants fared no better under Frye. In the first 7 years after Daubert, there were 67 reported federal appellate decisions reviewing defense challenges to prosecution experts. The government prevailed in all but 6, and even among the 6, only 1 resulted in the reversal of a conviction. In contrast, in the 54 cases in which the defense appealed a trial court ruling to exclude the defendant’s expert, the defendant lost in 44 cases. In 7 of the remaining 10, the case was remanded for a Daubert hearing."

While the article is more than seven years old, it's still relevant. It also has a wealth of resources in it's reference list. It begs a lot of questions - mainly, why do privateer experts not fare as well in criminal cases? Is money really the issue?

Interesting none the less.

I'm off to Louisiana

I'm heading out the door, going to Baton Rouge for the Louisiana Association of Forensic Scientists meeting next week. I'm looking forward to presenting two days of Photoshop training at the meeting. If you're in the NOLA or Baton Rouge area ... look me up.

See you soon.

Premiere Pro CS6: what’s new and changed

Click here for a quick blog post about Premiere Pro CS6. I'm looking forward to seeing Adobe Prelude CS6.

Forensic Photoshop Book - promo pricing

If you've been waiting to get the book, the wait's over ... Blurb is offering promotional pricing on orders of 2 or more books from their web site. Use offer code ORDERUP to receive 20% off your order. But, act soon. The offer ends on May 2, 2012.

Google Apps and e-discovery

From Australia's Image & Data Manager: "An ediscovery application has been launched for Google Apps known as Vault aimed at reducing the costs of litigation, regulatory investigation and compliance actions.

Google says Vault provides extended management and information governance capabilities to proactively archive, retain and preserve Gmail and on-the-record chats.

It offers the ability to search and manage data based on terms, dates, senders, recipients and labels to give management, IT, legal and compliance users a systemised, repeatable and defensible platform.

Google Apps Vault can be added to an existing Google Apps account for an additional $US5 per user per month.

“It will be very hard for IT managers to justify the cost of expensive on-site email archiving when all the old data can be migrated to the cloud for $5 a user. The cloud continues to deliver economies of scale that organisations can no longer ignore.”

Check out Google Vault by clicking here.

Enjoy.

Get a sneak peek at Adobe Audition CS6

One of the more difficult tasks in managing evidentiary multimedia is taking the audio from a body-worn recorder and merging it with various sources of covertly recorded video. Often times, the body-worn recorder produces the best audio, but the body-worn video misses the hand-off or the face shot. Thus, an investigator will want the better audio inserted into another video feed from the operation (pole cam, hand-held, etc.).

For this reason, I'm looking forward to the release of Audition CS6. According to Adobe, "Automatic Speech Alignment: Designed to align overdub dialogue quickly with existing production audio, the new automatic speech alignment feature does much more than merely align initial transients. When used on overdubbed dialogue, Adobe Audition analyzes the frequency spectrum involved as well as the waveforms, so each word of a dialogue clip is matched to its counterpart in the production audio—the real power is a new algorithm to provide alignment of noisy location audio to reduce mis-alignment. If you have ever worked with ADR or overdubbing, you know that this is a time consuming task and our goal was to provide a powerful tool to help make it a little easier. There’s no replacement for the skill and craft involved in professional ADR, but if you have an overdub performance which matches the location audio’s wording and phrasing, but the timing is off for lip sync, the new automatic speech alignment can help. Where you might normally perform a “stretch” on the audio to fit the timing, or be forced to do lots of editing/compositing to line up each word or phrase, automatic speech alignment can help you get good results quickly."

Yes, I know. This feature is designed for a production environment. Well, Photoshop is for photographers, and we love it in law enforcement. I think that the more LE folks get used to Audition, the more they'll love it. I can't wait to try this with body wire/body-worn matching for field operations.

Enjoy.

Deconvolution

To answer a recent question on the meaning of the term "deconvolution," I'll refer you to several texts referenced in the following citation from the world's greatest on-line source of information: "In optics and imaging, the term "deconvolution" is specifically used to refer to the process of reversing the optical distortion that takes place in an optical microscope, electron microscope, telescope, or other imaging instrument, thus creating clearer images. It is usually done in the digital domain by a software algorithm, as part of a suite of microscope image processing techniques. Deconvolution is also practical to sharpen images that suffer from fast motion or jiggles during capturing. Early Hubble Space Telescope images were distorted by a flawed mirror and could be sharpened by deconvolution.

The usual method is to assume that the optical path through the instrument is optically perfect, convolved with a point spread function (PSF), that is, a mathematical function that describes the distortion in terms of the pathway a theoretical point source of light (or other waves) takes through the instrument.[3] Usually, such a point source contributes a small area of fuzziness to the final image. If this function can be determined, it is then a matter of computing its inverse or complementary function, and convolving the acquired image with that. The result is the original, undistorted image.

In practice, finding the true PSF is impossible, and usually an approximation of it is used, theoretically calculated[4] or based on some experimental estimation by using known probes. Real optics may also have different PSFs at different focal and spatial locations, and the PSF may be non-linear. The accuracy of the approximation of the PSF will dictate the final result. Different algorithms can be employed to give better results, at the price of being more computationally intensive. Since the original convolution discards data, some algorithms use additional data acquired at nearby focal points to make up some of the lost information. Regularization in iterative algorithms (as in expectation-maximization algorithms) can be applied to avoid unrealistic solutions.

When the PSF is unknown, it may be possible to deduce it by systematically trying different possible PSFs and assessing whether the image has improved. This procedure is called blind deconvolution.[3] Blind deconvolution is a well-established image restoration technique in astronomy, where the point nature of the objects photographed exposes the PSF thus making it more feasible. It is also used in fluorescence microscopy for image restoration, and in fluorescence spectral imaging for spectral separation of multiple unknown fluorophores. The most common iterative algorithm for the purpose is the Richardson–Lucy deconvolution algorithm; the Wiener deconvolution (and approximations) are the most common non-iterative algorithms."

1. O'Haver T. "Intro to Signal Processing - Deconvolution". University of Maryland at College Park.
2. Wiener N (1964). Extrapolation, Interpolation, and Smoothing of Stationary Time Series. Cambridge, Mass: MIT Press. ISBN 0-262-73005-7.
3. Cheng PC (2006). "The Contrast Formation in Optical Microscopy". Handbook of Biological Confocal Microscopy (Pawley JB, ed.) (3rd ed. ed.). Berlin: Springer. pp. 189–90. ISBN 0-387-25921-X.
4. Nasse M. J., Woehl J. C. (2010). "Realistic modeling of the illumination point spread function in confocal scanning optical microscopy". J. Opt. Soc. Am. A 27 (2): 295–302. doi:10.1364/JOSAA.27.000295.

Adobe Camera Raw 7

Here's a snapshot of Adobe Camera Raw 7's Basic tab. Notice anything different? I thought that you would.

Putting this amount of luminosity control within ACR is so cool. I'm liking CS6 already.

Photoshop CS6 Beta: Training for your test drive

Want to get a head start on the next generation of digital imaging? First, download the Photoshop CS6 Beta. Then, check out the these tutorials to discover the revolutionary new features.

Enjoy.

New Features in CS6

If you are interested in a concise list of the new features in CS6, click here.

Remember, it's a beta ... so the shipping version will be a bit different. And ... as always ... validate your tools before using them for casework.

Enjoy.

Photoshop CS6 Operating System Support

This just in from Jeffrey Tranberry: "I’m pleased to announce that we’ll be providing official support for Windows XP, in addition to Windows 7, with Photoshop CS6.

We know that some of our Windows customers were concerned about Photoshop CS6 dropping Windows XP support similar to Lightroom 4.

We will, however, be dropping official support for Windows Vista (Please note: although Windows Vista is not officially supported, we do not restrict users from installing and using Photoshop CS6 on their Vista Systems)

Why is Photoshop CS6 still supporting Windows XP?

Quite simply, Photoshop’s user base is much different than Lightroom’s and many more of our customers are still on Windows XP. However, the number of our customers on XP is decreasing and we expect to see more and more of our customers to migrate to Windows 7 and Windows 8.

Macintosh

On the Mac side, we made the decision to end support for Macintosh systems that are not 64-bit capable. See related Apple documentation: How to tell if your Intel-based Mac has a 32-bit or 64-bit processor?

Apple is no longer supporting 32-bit hardware with their latest operating system, Mac OS X 10.7 (Lion), so it makes sense for us to follow suit.

Current recommendations and future guidance

Our current recommendation for the best Photoshop experience is to use 64-bit hardware and Operating Systems, specifically Mac OS X 10.6.x (Snow Leopard) or 10.7.x (Lion) for Macintosh and Windows 7 64-bit for Windows PCs.

We’re actively working with Apple to create a great Photoshop experience with future releases of OS X, including the recently announced Mac OS 10.8 (Mountain Lion).

We’re also working with Microsoft to also create a great Photoshop experience with Windows 8 for when it becomes available ..."

Enjoy.

Adobe Photoshop CS6 Beta

The world’s best digital image editing software is about to get even better. Explore Adobe® Photoshop® CS6 beta for a sneak preview of some of the incredible performance enhancements, imaging magic, and creativity tools we are working on. Discover for yourself why Photoshop CS6 software will be a whole new experience in digital image editing.

Here's the link to the public beta site.

Enjoy.

Shooting tethered?

Even though I don't recommend Lightroom for law enforcement use, it's still a valuable tool for photographers. With the newest marketing campaign from Hasselblad, a reader writes in confused about tethering.

Purchasers of the H4D will get Lightroom 4 as part of the package. That's cool. But, the H4D doesn't tether with LR4 ... yet.

From Hasselblad: "The Hasselblad and Lightroom plan does not mean that Hasselblad's Phocus software is being phased out.

Said Russell-Fish: "We will continue to support our proprietary Phocus software. This new agreement is about providing choice for our customers. Lightroom has the advantage of familiarity with photographers, digital operators and enthusiasts worldwide. Phocus still offers high-end imagists some highly specialised tools and remains an integral element of our Multi-Shot cameras as well as our Phocus Mobile application, which enables wireless connectivity for the iPhone, iPad and iPod Touch. We are also working on solutions to tethering and batch processing challenges, and integration of those solutions is not far off."

Click here to learn more about tethering.

Click here for a list of supported cameras.

Enjoy.

Is a badge on Foursquare worth your life?

This just in from the US Army: "There are a number of location-based social media applications and platforms, including Foursquare, Gowalla, SCVNGR, Shopkick, Loopt and Whrrl, currently on the market. They use GPS features, typically in the user's phone, to publish the person's location and offer rewards in the form of discounts, badges or points to encourage frequent check-ins.

Security risks for the military:

A deployed service member's situational awareness includes the world of social media. If a Soldier uploads a photo taken on his or her smartphone to Facebook, they could broadcast the exact location of their unit, said Steve Warren, deputy G2 for the Maneuver Center of Excellence, or MCoE.

"Today, in pretty much every single smartphone, there is built-in GPS," Warren said. "For every picture you take with that phone, it will automatically embed the latitude and longitude within the photograph."

Someone with the right software and the wrong motivation could download the photo and extract the coordinates from the metadata.

Warren cited a real-world example from 2007. When a new fleet of helicopters arrived with an aviation unit at a base in Iraq, some Soldiers took pictures on the flightline, he said. From the photos that were uploaded to the Internet, the enemy was able to determine the exact location of the helicopters inside the compound and conduct a mortar attack, destroying four of the AH-64 Apaches.

Staff Sgt. Dale Sweetnam, of the Online and Social Media Division, said geotagging is of particular concern for deployed Soldiers and those in transit to a mission.

"Ideally, Soldiers should always be aware of the dangers associated with geotagging regardless of where they are," he explained.

General hazards for family members:

While especially relevant for those in the military, cautions about geotagging extend to anyone who uses that feature.

Facebook is in the process of rolling out Timeline, a new layout that includes a map tab of all the locations a user has tagged.

"Timeline presents some unique security challenges for users who tag location to posts," Sweetnam said.

"Some of those individuals have hundreds of 'friends' they may never have actually met in person, he explained. "By looking at someone's map tab on Facebook, you can see everywhere they've tagged a location. You can see the restaurants they frequent, the gym they go to everyday, even the street they live on if they're tagging photos of their home. Honestly, it's pretty scary how much an acquaintance that becomes a Facebook 'friend' can find out about your routines and habits if you're always tagging location to your posts."

Most of the applications let people limit who can see their check-ins to friends or friends of friends.

"A good rule of thumb when using location-based social networking applications is do not become friends with someone if you haven't met them in person," Sweetnam said. "Make sure you're careful about who you let into your social media circle."

Even if there is nothing classified about an individual's location, a series of locations posted online over the course of a month can create a pattern that criminals can use.

"We live in a different world now," Warren said.

"If someone were going to get a hold of your phone, they could figure out a lot about who you are. It's like a beacon that's always out there communicating with towers and plotting your moves on a computer somewhere. Literally, if you don't turn off that feature on your phone people are going to be able to recreate your whole day."

Ways to stay safe:

"In operations security, we talk about the adversary," said Kent Grosshans, MCoE OPSEC officer. "The adversary could be a hacker, could be terrorists, could be criminals; someone who has an intent to cause harm. The adversary picks up on pieces of information to put the whole puzzle together."

Grosshans suggests disabling the geotagging feature on your phone and checking your security settings to see who you're sharing check-ins with.

"If your husband's deployed and you go ahead and start posting all these pictures that are geotagged, now not only does an individual know your husband's deployed and he's not at home, but they know where your house is," he said.

Ultimately, it's about weighing the risks.

"Do you really want everyone to know the exact location of your home or your children's school?" Sweetnam said. "Before adding a location to a photo, Soldiers really need to step back and ask themselves, 'Who really needs to know this location information?'"

Grosshans said it's as important to Soldiers as to family members.

"Be conscious of what information you're putting out there," he said. "Don't share information with strangers. Once it's out there, it's out there. There's no pulling it back."

Enjoy.

Daubert, Frye … or Both? Tracking Florida’s Buy-In

This just in from the BullsEye Blog: "For the second consecutive year, the Florida legislature is considering a bill that would change the standards for admission of expert witness testimony in Florida state courts. Slowly inching its way through the legislature, the bill suffered setbacks on March 8 when Senate amendments altered the language – and ostensibly the bite – of the original bill approved by the House in February.

At issue is whether Florida should adopt its own statutory version of Federal Rule of Evidence 702 and Daubert, and throw out the long-standing Frye standard currently employed in Florida state courts. If you’re waiting to see which direction Florida will ultimately go regarding the current Frye v. Daubert debate, don’t hold your breath. Opinions differ across the board, and the ultimate answer, if any, may be a little of both. ..."

"On February 24 the Florida House voted to approve HB 243, which sought to amend section 90.702 of the Florida Statutes by conforming the standards for admission of expert testimony in Florida state courts to those used in federal courts. Specifically, the bill sought to require that admission of expert testimony in Florida state courts be held to the same standards contained in Federal Rule of Evidence 702 and factors articulated in Daubert.

Florida currently uses the Frye standard in evaluating the admissibility of expert witness testimony. The Frye standard – considered by many to be less stringent than its federal counterpart – generally focuses on whether the underlying scientific principles are sufficiently established to have gained general acceptance in their field.

The original House bill sought to openly reject the Frye standard and replace it with the federal factors enumerated in Federal Rule of Evidence 702 and the standards spelled out by the U.S. Supreme Court in Daubert and its progeny. ..."

"On March 8th, the amended version of the bill was adopted and passed by the Senate. The amended bill now awaits action from the House. If ultimately enacted into Florida law, the bill is slated to take effect July 1, 2012. ..."

Click here to read the rest of the story and find out what the folks are saying about this development.

Enjoy.

Law Enforcement Forensics Day at Photoshop World

This just in from Adobe's John Penn II:

Save the Date! Friday, March 23, 2012

You are invited to join Adobe and leading digital forensics experts for a full day of training. At this unique event, we will take you deep into topics that will help you become more effective in photography and using Adobe Photoshop® and other tools for digital media analysis and investigation.

You will learn about:
• Advances in the science of image verification and the detection of manipulation
• Advanced camera technologies, including high-resolution crime-scene capture
• Photographic techniques
• Video, still, and audio workflows for investigations
• Accurate image color capture and calibration
• Digital media analysis with Photoshop
• Forensic artist use of Photoshop... and more

Speakers include:
• Dr. Richard Vorder Bruegge, FBI senior photographic technologist
• Kevin Connor, President, and Hany Farid, CTO, of Fourandsix Technologies
• Glenn Miller, Forensic Artist at the National Center for Missing and Exploited Children
• John Penn, Adobe Sr. Solutions Architect for Law Enforcement
• Additional speakers TBA

Who should attend:
• Law Enforcement
• Investigators
• Forensic Professionals

Click here for more info or to register for the event.

Enjoy.