Featured Post

Welcome to the Forensic Multimedia Analysis blog (formerly the Forensic Photoshop blog). With the latest developments in the analysis of m...

Monday, June 30, 2008

In-Car Video as Evidence

Here is a link to an interesting article on the issues related to evidence generated by in-car video systems.

"Changes made in late 2007 to the Federal Rules of Civil Procedure (FRCP), mandate the speedy recovery of electronically stored information (ESI) for the purposes of the discovery phase of civil suits. If you’re going to create a repository of ESI, as law enforcement agencies have done for their digital video files, that repository is discoverable in the civil courts."

“Law enforcement agencies need to create a policy on how long to keep video, how to destroy it, and defining the litigation hold policy,” Manes explains. He says also, “When you decide to destroy something, you have to apply that policy equally. If a law enforcement officer says ‘I’m going keep that for my personal profile because I did a good job with that subject, but I’m going to destroy the rest of the CD’ – that creates a problem. If the law enforcement officer or agency gets sued, you have to go to the stand and explain why you kept this one piece and not the others.”

Fred Miranda's Plug-ins Updated

Great news .... Fred Miranda (aka FM Digital Darkroom) has updated several of his Photoshop plug-ins for CS3.

In future posts, we'll check out Intellisharpen v2.5, Velvia Vision v1.5, and SI Pro v2.5.

With this upgrade, we get some new options for sharpening, colour and tone adjustments, and interpolation / downsampling.

Saturday, June 28, 2008

Cracking the H.264 Codec

Photoshop's support of vide really took off with CS3. Many are enjoying the flexibility of dealing with small video clips from within Photoshop. There have been a few questions about working with video clips and I've tried to answer them directly.

In this month's Streaming Media Magazine, there is an excellent set of articles by Jan Ozer. Check out Cracking the H.264 Codec for a great overview of this popular codec. In the article called, Under the Hood - File Analysis Tools for Streaming Video, Jan looks at popular tools like GSpot, MediaInfo, and Semaphore.

We'll dive further into Photoshop's video capabilities in future postings. Stay tuned.

Friday, June 27, 2008

CCTV Effectiveness Called Into Question

The internet is buzzing with reports of the lack of concrete proof that CCTV is at all effective in reducing or preventing crime. MSNBC has this report on on the subject. In it, they cite a Seattle official who actually voted against more cameras. Nevertheless, officials are tripping over themselves to install cameras.

Here is the question that I always ask in evaluating the success of a CCTV scheme, "now that the CCTV cameras are installed and operational, would you take your family to visit ____?" Pick the location and ask the question for yourself.

Time and again, people opt to visit places with more visible signs of safety and security - like improved lighting and an active police patrol.

Read the article and see what you think ...

Digital Still Camera Forensics

The second edition of the Small Scale Digital Device Forensics Journal has been released. The SSDDFJ is supported by the Cyber Forensics Lab at Purdue University and the efforts of its staff and faculty. The research papers contained within the journal are top notch. In case you missed it, check out the Digital Still Camera Forensics paper that was released in the first edition.

Have a great weekend.

Thursday, June 26, 2008

What about Aperture?

"Apple's Aperture is so cool .. who needs Photoshop?"

So began a recent e-mail. Without getting into too much detail about how I responded to the e-mail, let me just say this:
  • If you like working with layers, you won't like Aperture - it doesn't support them.
  • If you like working with Smart Objects, you won't like Aperture - it doesn't have them.
  • If you don't have a Mac, you can't use Aperture.
In other words, if you like working with images in a non-destructive (forensic/government) workflow ... you won't like Aperture. Some people like it vs. Lightroom. I'm really not one of them, though I wish Adobe's products would handle metadata like Aperture.

If you want a decent look at Lightroom vs. Aperture, check out Inside Aperture.

Real or Fake?

I received this via e-mail and thought it worth sharing:

Perhaps you've noticed the articles & NOVA special about the digital forensics expert from Dartmouth?

Thought it was really interesting, and quite simple at the same time ---- he's designed software to find similar pixel patterns that appear will an image has been manipulated. 

Real or Fake?

Hany Farid, director of Dartmouth College's Image Science Laboratory and Adobe collaborator recently  appeared on appeared on PBS's NOVA program to discuss his research on detecting doctored photographs.

To check out the show, click here.


Wednesday, June 25, 2008

Acrobat helps e-discovery

What do you do when you have to turn over thousands of e-mails and attachments in discovery? Check out this article about Adobe Acrobat's usefulness in e-discovery.

Negotiating with the government

Several readers have enquired about working as a privateer and seeking government contracts. There is plenty of work available. The biggest problems have to do with knowing where to find it and waiting to be paid (sometimes for months after the job's complete).

If you are interested in working for the government as a contractor, there is a book that may help get you ready to negotiate the contracts, Seven Secrets for Negotiating with Government: How to Deal with Local, State, National, or Foreign Governments—and Come Out Ahead by Jeswald W. Salacuse.

"Seven Secrets for Negotiating with Government: How to Deal with Local, State, National, or Foreign Governments—And Come Out Ahead is designed to help individuals and organizations prepare for, meet, and succeed at the very special challenges of negotiating with governments at all levels. In particular, it will show you how to cope with the greater power you inevitably face on the other side of the negotiating table whenever you have to deal with a government. Toward that end, it presents seven power tools that can level the playing field and enable you to obtain your goals in government negotiations."

Check it out for yourself. Being well prepared is half the battle.

Tuesday, June 24, 2008

Creating Timelines for Presentations

For so long, PowerPoint has been THE tool for creating presentations for court. Slowly, as folks discover Macs, Keynote is sneaking into the courtrooms. Now, there's something else for creating timelines that seems to be a lot easier to use. It's called, uniquely enough, Timeline and it's made by Bee Docs.

Bee Docs offers a free trial to check it out for yourself. The 3D version allows you create some stunningly useful timelines that are simply not possible in the other programs. This will become helpful as your timelines become more complex. Got a RICO case? You'll need something like this to keep from going mad in trial prep.

There are a ton of other features available in this easy to use and inexpensive program. Check out what others are saying by clicking here and here.

Yet another reason to switch to Mac.

Adobe Captivate at NATIA

For those going to NATIA next month and attending the Adobe Captivate class at Adobe, check out Silke Fliescher's blog at Adobe Blogs. Silke is the product manager for Captivate and the go-to person for questions on the program.

If you are not using Captivate in your workflow, I'm guessing that after attending the class you'll hurry to get your copy. I've been using it for a while now and absolutely love its flexibility. From capturing web based multimedia evidence to creating accurate training scenarios and tests, its just a great tool to have. If you've bought the book, you'll recognise Captivate from the videos on the web site.

Monday, June 23, 2008

An interesting case

Here are some notes from an interesting case involving the forensic imaging of a computer hard drive. What privacy rights does the defendant have when a computer is used for both business and personal stuff? How would you approach this type of situation? I know that I've seen many PC based DVRs that were used to manage all aspects of the owners life, as well as recording his CCTV.

Check out how the judge ruled in this Ohio case by clicking here.

Firefox 3.0 supports colour managed browsing

Firefox 3 was released last week. If you haven't downloaded it, it may be worth a look. This version supports colour managed browsing. Unfortunately, it's off by default. Click here to learn more about Firefox 3 and to get the tip on turning colour management on. Some users reported interesting results, so as always with new software releases ... your mileage may vary.

See multiple folders at once in Bridge

John Nack has a great post about viewing multiple folders at once in Adobe Bridge. There is also an interesting post about extracting metadata from files in Bridge and saving that data to a CSV file. Check it out by clicking here.

Sunday, June 22, 2008

Every step you take ...

Check out this link to a video trailer for a documentary called "Every Step You Take." It's worth a look. I'll be posting a review of the movie in a future post.

Friday, June 20, 2008

You be the judge

Check out this video from a baseball game in Georgia. Read the accompanying story. Does the video support or refute the allegations in the case? You be the judge.

Simulate Paper Color - commercial printing part 5

Simulate Paper Color is a tricky subject and there were a few questions about it. When you check the box to Simulate Paper Color, the image will likely change dramatically. Why? Photoshop tries to make the light emitted from your monitor match the look of light reflected from a printed page. Remember that RGB is an additive colour model and CMYK is a subtractive colour model.

Try using Full Screen Mode to get the most use out of your soft proof (using your monitor to simulate a printing device), View>Screen Mode>Full Screen Mode, and hide the palettes and tool bars by pressing the Tab key. To return from Full Screen Mode, click on the F key.

To answer another related question, the process is going through an Absolute Colorimetric rendering through the paper profile to the screen. Remember the proof is meant to simulate the look of the final press output, not the original file. Make your judgements about what's happening to your colours (hue, saturation, and etc.) and adjust accordingly with levels, curves, or other appropriate adjustment layer.

All of this requires accurate profiles and a calibrated system. If you are working on an uncalibrated system, your mileage will obviously vary. No proofing system is perfect. But, as you get comfortable with the process, you'll get better at predicting and preparing for excellent results.

Thursday, June 19, 2008

CCTV: analogue vs. digital - the dangers

Here's a link to an interesting article about the dangers of moving from analogue to digital CCTV.

commercial printing part 4 - file formats

Photoshop is a wonderful program that can handle a ton of different file formats. Add Bridge and Lightroom's support for the various RAW formats and we lose count of just how many supported types there are. But what about the world of commercial printing?

In the world of commercial printing where Postscript is king, there are just two file formats that you will want to work with, EPS and TIFF. In our world, we'll want to stick with TIFF. Why? EPS files can contain a both raster (pixels) and vector information (lines and objects defined by math). TIFF is limited to raster. We're probably not working with line-art and other vector type pieces - so there's little need to concern ourselves with EPS. TIFF gives you the option of compressing, but don't take the bait. Many print houses don't recommend using compression, even LZW, with their presses.

The biggest thing to remember is to include all images with the text that you send for print. If you send the text in an e-mail, attach the files. If you place the files in a Word doc, send the doc and the images as well.

Here's a typical specification sheet from a commercial printer.

Wednesday, June 18, 2008

video evidence clarifies testimony

Check out this case from San Jose, CA. The video evidence was used to clarify statements and ultimately led to the reduction of charges against the accused. Beware of making false statements ... everyone's on camera now.

Google Alerts

Do you know what's been published about you on the internet? If you are going to trial soon, you'll want to know. Chances are, opposing council has done a thorough check on you via Google. Everything you've posted to the web is searchable ... and can be held against you under cross examination.

Have you ever flamed someone on a message board or forum? It may come up. Have you ever posted conflicting opinions on an issue? It may come up. What about the things others are saying about you? How do you know? There's an easy way to keep up to date as things happen ... Google Alerts.

Create a free account with Google and you'll have access to this wonderful service. Google alerts are e-mail updates of the latest relevant Google search results, based entirely on your criteria. Create a comprehensive alert with your name as the search criteria. Set it to return results as they happen, once a day, or once a week. Then, if something is posted on-line with your name on it, you'll know. No more surprises.

The first time it runs, you may get a lot of results. But, those results won't be returned again unless something changes with the page.

You can create alerts that focus on items related to your investigation. There's no limit to the number of alerts you can receive ... but you'll have trouble managing them if you set up too many.

Check it out for yourself and you'll be hooked.

rgb to cmyk - part 3

You will have the most control over the output of your images if you handle the conversion of your own images from RGB to CMYK. Many print houses will perform a "standard value conversion." In other words, their staff will open up the files and convert them to CMYK without any thought of preserving colours as you would like them. It's not a personal thing. They simply don't have the time to handle each file with the care it deserves. That's why it's best if you handle it yourself.

Remember from the earlier post that there are colours available in the RGB gamut that are simply not possible in CMYK. Select the Colour Picker (eyedropper) and check the colours in your image. Pay attention to the greens and the blues. Notice the gamut warnings (above image).

Take a look at what you would consider "blue." 100% blue in RGB would translate into a purple blue with the automatic conversion. For spot colours, or solid inks, you'd want to change the values to C=100, M=65, Y=0, K=0 to get a nice looking blue. But what about your images?

Remember that blues and greens will give you the most trouble. Select View>Gamut Warning to see just what parts of your image will need special treatment. Next, take a look at what your image will look like by selecting View>Proof Setup>Custom. Check the box to Simulate Paper Color. You'll get the device information from your print provider. For now, try choosing between US Web coated and uncoated - and US Sheet fed coated and uncoated. Now toggle the Preview button on and off. What do you see? Are you happy with the results?

Thankfully, a Color Balance adjustment layer can help restore your image's colours. I realise that it'll be a bit tricky colour balancing a CMYK image in the RGB monitor space - whilst aiming for a target that you are not quite sure about. Use your best judgement and don't over do it. Subtle shifts are corrected with subtle adjustments. Do your best and always ask for a "match print" or an accurate printer proof.

Monday, June 16, 2008

Sorry ... I just had to share this

I just had to share this video clip from a TV show called Forensic Heroes II.

Preparing images for print - commercial printing part 2

The first dialog box should be familiar enough, the Color Settings box (Edit>Color Settings). We've used this dialog to help with our colour management routines. Until now, we've probably ignored the CMYK drop-down menu, or kept it at the default [US Web Coated (SWOP) v.2]. SWOP stands for Specifications for Web Offset Printing. I can already hear the confusion ... in this case, the Web portion has nothing to do with the internet or a delivery method. Web presses are fed by large rolls of media. This is opposed to sheet-fed presses. The advantage of web printing is that you can run job after job without regard to the final size of the project - keeping the presses rolling. Jobs are cut down to size later in the process. With sheet-fed, there is more hands on time as media is changed from job to job. This works best for specialty printing projects and custom media types.

After working the image as you would in the forensic photoshop workflow, it's time to start thinking out output. (Remember, we always work from copies.) Our first call or e-mail will be to the printer or the publication's contact person with the most knowledge of their printing process. We'll want to know the line screen of the final print, that is to say how many lines per inch. I know, we're used to thinking in dpi. This one is simple though, for lpi just divide dpi by 2. If your target is 150 line screen, then your final image should be 300dpi. Remember that interpolation is handled towards the end of our workflow.

Going from a 72dpi screen grab of a DVR video to camera ready art can be tricky. I'll refer you back to our discussions on interpolation earlier in the blog (use the search box above). If you don't interpolate to 300dpi, your images will come out overly pixelated when printed - or the printer may reject them outright.

If your printer has a custom profile, try to get it from them. Many of the higher-end print shops do now (and many are using direct to press digital technology). But, many magazines and newspapers contract out the printing and may not have access to their presses anymore, so don't rely on this entirely.

Take a look at samples of the publication. Look at the images that are printed. Are they over or under saturated? Do they look out of focus? Can you see the screen or moire pattern? This will give you clues as to how to output your images so that they will look their best.

In the next installment, we'll look closer at getting our files ready for print.

Sunday, June 15, 2008


The questions have already started. The first one, and a quite good one actually, was ... why does the colour shift when moving from RGB to CMYK. Great question. Let's take a look.
Notice how small the CMYK gamut is within the larger RGB space. All of the space on the outside will have to be "mapped" or reassigned within the CMYK space upon conversion. This is when shifts happen. Knowing that it will happen is half the battle. Controlling how it happens is the other half.

This shift can make a huge difference, especially when dealing with blues and greens. In terms of identification ... we'll want to get it right.

So, when you are getting your files ready for print in your favourite publication (Evidence Magazine, or the like), controlling the conversion can go a long way in helping you make your case to your readers.

working with colour - commercial printing part 1

The first question that I am asked, when dealing with the topic of sending items for commercial printing is: "in which colour space should I colour correct?" The answer is RGB.

Work the workflow as normal. All of your tools and plug-ins are designed to work in RGB. Remember that ProPhotoRGB gives us the largest gamut in which to work and correct our images.

Contact your print provider for the specific ICC profile for the output device. In this way, the conversion can be made at print time, leaving the original unchanged (this allows for the most flexibility but requires good communication between you and your print provider).

But what happens if you can't get a specific profile from your printer? Then ... we'll need to make a process specific CMYK image. One that's optimised for a particular device, ink set, and substrate (or we'll have to make a good guess). This will mean that the colours and tonal range will have to be changed, or limited, accommodate to the printing device in our final output copy.

Tomorrow, we'll look at optimising an image for CMYK output.

Saturday, June 14, 2008

The Forensic Teacher

I stumbled across a publication that I'd like to share, The Forensic Teacher. It's an amazing little quarterly journal that's available for FREE.

Their motto, helping forensic educators teach every student, is well represented within the pages. It seems to be oriented towards the crime labs/chemistry functions of forensic science, but who knows what the future will bring.

I'm sure that you'll enjoy the article on using history to learn forensics and the list of historical cases that comes with it. Also, the list of training resources is a great bonus.

Students and teachers alike will enjoy this free resource.

paying attention to the details

Forensic Dentistry Exhibit Uncorrected - from CMYK Print
courtesy of the Forensic Teacher.

When preparing your exhibits for publication, take care to note the type of printing process that will be employed. Four colour presses are notorious for blurring images and muddying colours. The CMYK process is quite different than RGB (subtractive vs. additive).

Forensic Dentistry Exhibit Corrected

Over the course of the next week, we'll take a look at commercial printing and preparing your exhibits for commercial presses. Many of us will have to prepare our cases to be shared in this way. There is a trick to it. The trick is to pay attention to the details.

Friday, June 13, 2008

Image alteration detection

I've had a few questions regarding the detection of alterations in images. Here's a link to a blog that references Hany Farid's groundbreaking work at Dartmouth. His work is amazing and well worth the read.

Friday, June 6, 2008

Adobe Creative Suite 3.3 - the update

It figures. Not too long after I pull the plug on my WinXP machines and invest in the Adobe Creative Suite 3 Master Collection for Mac, they announce an upgrade - Creative Suite 3.3.

The good news is that it will only cost an additional $159 to upgrade from my new software. For the upgrade price, I'll get Acrobat 9 Pro - which offers some interesting new functionality. I'm looking forward to trying out its Acrobat Connect functionality for sharing, collaborating, or reviewing documents in real-time.

Speaking of which, I am currently working out the details of the first of a series of free Acrobat Connect Sessions to be hosted by your humble host and Rick Miller, Photoshop and Lightroom guru from Adobe. If it all works out, the first session will kick off in the first week of July. So stay tuned as this new feature is developed. NaTIA members can see Rick in action during the pre-conference sessions at Adobe. You should have received the sign-up materials already. Get those in soon. There are only so many seats available. When they are gone ... they are gone. Make sure that you get in on this opportunity to get your training from Adobe - at Adobe.

Wednesday, June 4, 2008

Even more colour management

Today, I want to delve further into the issue of colour management. The topic came up in a discussion recently and I think it warrants a little more space here.

When you turn on colour management  in Photoshop's Color Settings, it uses ICC profiles (or color profiles) to ensure consistent and precise colour reproduction between devices.

That being said, in a colour managed workflow, an input device (camera, scanner, etc.) uses input profiles to describe the data it's captured. Photoshop uses the input profile and the output profile of your monitor to display colours accurately (or the output profile of your printer to print accurately).

Monitor output profiles describe colour gamut and characteristics such as colour temperature, white point, phosphors, gamma, and so forth. Printer profiles describe the ink and paper combination that you've chosen, dot gain, and the like. Photoshop takes the input profile of the image and converts it to the output profile of the printer in order to reproduce the colours accurately.

A couple of points to remember, the Assign Profile command, Edit>Assign Profile, changes only the description of how the numbers that describe the document will map to the colour space of the output device. Assign Profile only changes the appearance, not the underlying data.

The Convert to Profile command, Edit>Convert to Profile, changes the raw numbers to the colour space described by the target profile. As you are changing values, use this command with care.

Monday, June 2, 2008

From Photons to Pixels and Contrast to Convolution

You've read the blog, you've bought the book, now learn the techniques live this October in Orlando at the 2008 LEVA Conference.

"In this two-day course, students will explore the sources of image-based evidence, how to retrieve the highest quality images possible, and enhancement techniques used to reveal hidden details in these images. Students will rely upon Adobe's Photoshop CS3 Extended for their work and will evaluate a number of third-party tools to be used in conjunction with Photoshop. Students will also explore reliable, repeatable and defensible steps in a forensic imaging workflow that both minimize time spent and maximize results obtained from still image evidence."

Students must bring a laptop to work on class files.

Chris Russ, Reindeer Graphics
Jim Hoerricks, Forensic Photoshop blog.

Check it out by clicking here. LEVA membership is not required to attend this event, so book your seat early. This class is sure to sell out!