PUNE INSTITUTE OF COMPUTER

TECHNOLOGY, DHANKAWADI, PUNE-

43

Mini Project Report – Cybersecurity & Digital Forensics

‘A Tool for Digital Forensic of Images’

Submitted By
Name: Atharva Litake
Roll no: 41143 Class: BE-1

Name: Mihir Deshpande

Roll no: 41150 Class: BE-1

Under the guidance of

Prof. YOGESH ASHOK HANDGE

DEPARTMENT OF COMPUTER ENGINEERING

Academic Year 2024-25
 Contents
1. TITLE

2. PROBLEM DEFINITION

3. LEARNING OBJECTIVES

4. LEARNING OUTCOMES

5. ABSTRACT

6. TECHNICAL DETAILS ABOUT THE PROJECT

7. GLIMPSE OF THE PROJECT

8. CONCLUSION
1. TITLE: Digital Forensics of Images

2. PROBLEM DEFINITION:

In the era of digital media, images play a crucial role in communication,

journalism, legal proceedings, and social media. However, the widespread
availability of sophisticated image editing tools has made it increasingly
easy to manipulate digital images, often in ways that are difficult to detect
with the naked eye. This proliferation of altered images poses significant
challenges across various domains:

1. Journalism and Media: The integrity of photographic evidence is

crucial for maintaining public trust in news reporting.
2. Legal and Forensic Investigations: Altered images can mislead
investigations and court proceedings.
3. Social Media: Manipulated images can spread misinformation
rapidly, influencing public opinion and behavior.
4. Scientific Research: Image manipulation can lead to falsified
research results and damage scientific integrity.

The Challenge

The primary challenge in digital image forensics is to develop reliable,

accessible methods for detecting image manipulation and verifying image
authenticity. This task is complicated by several factors:

1. Sophistication of Editing Tools: Modern image editing software

can produce highly realistic manipulations that are challenging to
detect.
2. Diverse Manipulation Techniques: Alterations can range from
simple adjustments (cropping, color correction) to complex
manipulations (object removal, compositing).
3. Varied Image Formats: Different image formats (JPEG, PNG,
HEIC, etc.) require different analysis approaches.
4. Metadata Manipulation: EXIF data can be easily altered, making it
an unreliable sole indicator of authenticity.
5. Compression and Re-saving: Multiple saves and compressions can
obscure traces of manipulation.
6. Lack of Original Source: Often, the original, unaltered image is not
available for comparison.
3. LEARNING OBJECTIVES:

The primary objectives of our image forensics tool are:

1. To provide a reliable first-pass analysis for detecting potential image

manipulations.
2. To offer multiple, complementary analysis techniques that can
corroborate each other.
3. To generate clear, interpretable results that can guide further
investigation.
4. To create an accessible tool that can be used by journalists,
researchers, and other professionals who need to verify image
authenticity.

4. LEARNING OUTCOMES:

Through the development and implementation of this digital image

forensics tool, the following key learning outcomes have been achieved:

1. Understanding of Digital Image Formats

o Gained in-depth knowledge of various image formats (JPEG,
PNG, HEIC) and their internal structures.
o Learned how different compression algorithms affect image
data and quality.
2. Image Manipulation Techniques
o Developed a comprehensive understanding of common image
manipulation methods.
o Learned to identify potential indicators of image tampering.
3. Forensic Analysis Techniques
o Mastered multiple image forensic analysis methods:
 Error Level Analysis (ELA)
 Metadata analysis
 Quantization table analysis for JPEG images
o Understood the strengths and limitations of each technique.
4. Programming and Tool Development
o Enhanced Python programming skills, particularly in image
processing.
o Gained experience in using libraries such as Pillow, NumPy,
and SciPy for image analysis.
 o Developed skills in creating user-friendly command-line
interfaces.
5. Data Interpretation and Analysis
o Improved ability to interpret complex data from forensic
analyses.
o Developed critical thinking skills in evaluating the
significance of analysis results.
5. ABSTRACT:

In an era dominated by digital media, the authenticity of images has

become increasingly crucial yet challenging to verify. This project
addresses the pressing need for accessible and reliable image forensics
tools by developing a Python-based application that employs multiple
analysis techniques to detect potential image manipulations. The tool
integrates three primary methods: metadata analysis, Error Level
Analysis (ELA), and quantization table examination for JPEG images.
By leveraging libraries such as Pillow, NumPy, and SciPy, the
application provides a user-friendly command-line interface that allows
users to input an image for comprehensive analysis.

The tool first examines the image's metadata for inconsistencies that
might indicate tampering. It then performs Error Level Analysis,
visualizing differences in compression levels across the image to
highlight potential areas of manipulation. For JPEG images, the tool
also analyzes quantization tables to detect patterns suggestive of
computer-generated or heavily processed images. The results are
presented in an easily interpretable format, including a visual ELA
output and textual analysis findings.

While not definitive proof of manipulation, the tool serves as a valuable

first-pass filter for detecting potentially altered images. It aims to assist
professionals in fields such as journalism, law enforcement, and
scientific research in their initial assessment of image authenticity. The
project not only demonstrates the practical application of digital
forensics techniques but also highlights the complexities and evolving
challenges in image authentication. By providing an open-source,
extensible platform, this tool contributes to the broader effort of
combating digital misinformation and promoting media integrity in the
digital age.
 TECHNICAL DETAILS ABOUT THE PROJECT

1. System Architecture

The image forensics tool is designed as a command-line Python application with a

modular structure. It consists of several key components:

 Main script (entry point)

 Metadata analysis module
 Error Level Analysis (ELA) module
 Quantization table analysis module
 Utility functions for image processing

2. Technologies and Libraries

The tool leverages several Python libraries to perform its functions:

 Pillow (PIL Fork): Used for opening, manipulating, and saving various image
formats.
 pillow-heif: An extension to Pillow that adds support for HEIF/HEIC images.
 NumPy: Utilized for efficient array operations and numerical computations.
 SciPy: Employed for advanced computations, particularly the Discrete Cosine
Transform (DCT) in quantization table analysis.
 Matplotlib: Used for creating and saving visualizations (optional, for future
enhancements).

3. Key Components and Their Implementation

3.1 Metadata Analysis

 Utilizes Pillow's _getexif() method to extract EXIF metadata from images.

 Analyzes extracted metadata for inconsistencies, such as mismatched creation
and modification dates or signs of editing software use.
 Implementation:

python
Copy
def analyze_metadata(img):
exif_data = img._getexif()
# ... (analysis logic)
3.2 Error Level Analysis (ELA)

 Implements ELA by resaving the image at a known quality level and

computing the difference with the original.
 Uses Pillow for image manipulation and NumPy for pixel-level computations.
 Outputs a new image highlighting areas of potential manipulation.
 Implementation:

python
Copy
def perform_ela(img, quality=95):
# ... (ELA logic)
ela_img = Image.new('RGB', img.size, (0, 0, 0))
# ... (pixel comparison and difference calculation)

3.3 Quantization Table Analysis

 Extracts JPEG quantization tables using Pillow's quantization attribute.

 Applies Discrete Cosine Transform (DCT) to the luminance quantization table
using SciPy.
 Analyzes patterns and values in the quantization table to detect anomalies.
 Implementation:

python
Copy
def analyze_quantization_table(img):
qtables = img.quantization
# ... (table extraction and analysis)
dct_lum_qtable = dct(dct(lum_qtable_array.T, norm='ortho').T,
norm='ortho')
# ... (pattern analysis)

4. Workflow and Data Flow

1. User inputs image path via command line.

2. Main script loads the image using Pillow.
3. Metadata analysis is performed first, extracting and analyzing EXIF data.
4. If the image is JPEG, quantization table analysis is conducted.
5. ELA is performed last, generating a new image file.
6. Results from all analyses are collected and presented to the user.

5. Input and Output

  Input: File path to the image (supports JPEG, PNG, HEIC, and other formats
supported by Pillow)
 Output:
o Console output with detailed analysis results
o ELA result saved as a new image file ('ela_result.png')

6. Error Handling and Robustness

 Implements try-except blocks to handle various exceptions:

o File not found errors
o Unsupported file format errors
o Metadata extraction failures
 7. GLIMPSE OF THE PROJECT & DEPLOYMENT:
import os
from PIL import Image
from PIL.ExifTags import TAGS, GPSTAGS
from pillow_heif import register_heif_opener
import numpy as np
from scipy.fftpack import dct
import matplotlib.pyplot as plt

register_heif_opener()

def analyze_metadata(img):
exif_data = img._getexif()
if not exif_data:
return "No EXIF metadata found."

labeled_exif = {TAGS.get(key, key): value for key, value in exif_data.items()}

# Check for common metadata inconsistencies

inconsistencies = []
if 'Software' in labeled_exif and 'Photoshop' in labeled_exif['Software']:
inconsistencies.append("Image processed with Photoshop")
if 'DateTimeOriginal' in labeled_exif and 'DateTimeDigitized' in labeled_exif:
if labeled_exif['DateTimeOriginal'] != labeled_exif['DateTimeDigitized']:
inconsistencies.append("Capture and digitization times don't match")

return "Metadata Inconsistencies: " + ", ".join(inconsistencies) if inconsistencies else "No obvious metadata
inconsistencies found."

def perform_ela(img, quality=95):

temp_filename = 'temp_ela.jpg'
img.save(temp_filename, 'JPEG', quality=quality)
compressed_img = Image.open(temp_filename)

ela_img = Image.new('RGB', img.size, (0, 0, 0))

for x in range(img.size[0]):
for y in range(img.size[1]):
orig_pixel = np.array(img.getpixel((x, y)))
compressed_pixel = np.array(compressed_img.getpixel((x, y)))
diff = np.abs(orig_pixel - compressed_pixel) * 10
ela_img.putpixel((x, y), tuple(diff))

os.remove(temp_filename)
return ela_img

def analyze_quantization_table(img):
if img.format != 'JPEG':
return "Quantization table analysis is only applicable to JPEG images."

# Extract quantization tables

qtables = img.quantization
if qtables is None or len(qtables) < 1:
return "Unable to extract quantization tables."

# Analyze luminance quantization table (usually the first table)

lum_qtable = qtables[0]
 # Convert the quantization table to a numpy array
lum_qtable_array = np.array(lum_qtable).reshape((8, 8))
# Perform DCT on the quantization table
dct_lum_qtable = dct(dct(lum_qtable_array.T, norm='ortho').T, norm='ortho')
# Analyze the quantization table
analysis_results = []
# Check for unusual uniformity
if np.std(lum_qtable_array) < 5:
analysis_results.append("Unusually uniform quantization table, possibly indicative of a computer-generated
image.")

# Check for typical JPEG compression artifacts

if lum_qtable_array[0][0] != 1 or np.max(lum_qtable_array) > 255:
analysis_results.append("Atypical quantization values, might indicate tampering or non-standard
compression.")

# Check DCT coefficients

if np.max(np.abs(dct_lum_qtable)) / np.min(np.abs(dct_lum_qtable[dct_lum_qtable != 0])) > 1000:
analysis_results.append("Unusual variance in DCT coefficients of quantization table, possible sign of
manipulation.")

if not analysis_results:
return "No obvious anomalies detected in quantization table."
else:
return "Quantization Table Analysis Results:\n- " + "\n- ".join(analysis_results)

def analyze_image(image_path):
try:
with Image.open(image_path) as img:
print(f"Analyzing image: {image_path}")
print(f"Image format: {img.format}")
print(f"Image size: {img.size}")
print(f"Image mode: {img.mode}")

print("\nMetadata Analysis:")
print(analyze_metadata(img))

print("\nQuantization Table Analysis:")

print(analyze_quantization_table(img))

print("\nPerforming Error Level Analysis (ELA)...")

ela_img = perform_ela(img)
ela_img.save("ela_result.png")
print("ELA result saved as 'ela_result.png'. Please examine for inconsistencies.")

except Exception as e:
print(f"Error: {str(e)}")

def main():
image_path = input("Enter the path to the image file: ")
analyze_image(image_path)

if __name__ == "__main__":
main()
8. CONCLUSION

The development and implementation of this image forensics tool

represent a significant step forward in addressing the growing
challenge of digital image authentication. As the proliferation of
manipulated images continues to pose threats across various domains
– from journalism and legal proceedings to scientific research and
social media – the need for accessible and reliable forensic tools has
never been more pressing.

This project has successfully created a multi-faceted analysis tool that

combines metadata examination, Error Level Analysis (ELA), and
quantization table analysis for JPEG images. By integrating these
diverse techniques, the tool provides a comprehensive first-pass
assessment of image authenticity, offering users valuable insights into
potential manipulations.