Digital multimedia forensics

from Wikipedia, the free encyclopedia

Digital multimedia forensics is a collective term for forensic techniques that aim to systematically check the authenticity of digital media data. The fundamental questions are the determination of the origin of digital media data as well as the detection of manipulations on such. Digital multimedia forensics procedures generally obtain their indications ex post from the media data and do not require access to a possible original. Such "blind" procedures are used and the like. a. in criminology .

Motivation and classification

Thanks to affordable input devices, digital image, audio or video recordings are widely used in practically all areas of application. Their authenticity is therefore of great importance, especially if they have a function of evidence (e.g. in court or in the mass media). Digital multimedia forensics is dedicated to verifying the authenticity of digital media data. It can be viewed as a sub-discipline of digital forensics and as such deals with the identification and analysis of digital traces.

In contrast to cryptographic approaches or digital watermarks , no prior "active" signing of the medium is necessary for checking media data using multimedia forensic methods. Rather, the media data itself is examined with statistical methods on the basis of suitable characteristics with regard to their authenticity. Digital media data are understood as images of reality digitized with a sensor , which makes their forensic analysis an empirical science.

The advantage of multimedia forum-safe procedures lies in their high level of practicality. Since access to the original is not required, media data can in principle be examined regardless of their previous history. A disadvantage, on the other hand, is the lack of analytically deducible statements regarding the reliability of multimedia forensic methods.

Goal setting

The aim of multimedia forensics methods is to draw conclusions about the input device used for digitization and to uncover artifacts of possible manipulations. In general, they use two types of digital tracks to do this:

  • Characteristics of the input device that are inevitably left behind in media data during the digitization process. Depending on the manufacturing process, individual input devices differ systematically in how they convert reality into a digital image. Differences can result, for example, from different sensor structures or optical and acoustic lens systems . Using suitable features, such characteristics can be measured in a medium and evaluated for forensic analyzes.
  • Manipulation artifacts , such as those caused by the processing of digital media data. Just as the digitization process leaves characteristic traces in the medium, certain editing operations (e.g. inserting or removing content) can lead to measurable artifacts (e.g. cracking or phase changes when editing audio material).

Metadata can also provide information on the origin and possible manipulation . However, these have the disadvantage of being easy to manipulate (and remove).

Determination of the origin

Assuming that different input devices have systematic differences in the digitization process, conclusions can be drawn about the device used for digitization by means of suitable features. Depending on the characteristics and suitability of the identification features, it is possible to determine the device class (e.g. scanner vs. digital camera ), the device model or the specific device.

Detection of tampering

In addition to determining the origin, the characteristics of the input device are also suitable for recognizing manipulations of media data. It is assumed here that the characteristic to be expected occurs consistently in the entire medium. A manipulation of the media data can lead to verifiable inconsistencies or the lack of characteristic features.

In addition to inconsistent or missing device characteristics, the presence of traces of manipulation can also be exploited in a targeted manner. The assumption here is that the processing operation changes the media data in such a way that they have features that would not or would only very unlikely occur in a natural medium. A typical example are (almost) identical image regions after a copy & paste operation.

Special case: recognition of hidden data (bar analysis)

The detection of steganography , i.e. secret messages hidden in media data, can also be understood as a type of manipulation detection. The purpose of the manipulation differs here. It is not primarily the semantics of the media content that is changed, but the medium merely serves as a carrier medium for hidden secret messages and is changed ("manipulated") in such a way that a recipient can only recognize and extract the message with the knowledge of a secret key. The aim of the bar analysis is to prove the existence of hidden data without knowing the secret key. This is done through statistical analysis of the properties of digital media data using methods and phenomena similar to those used in the detection of traces of manipulation.

development

Digital multimedia forensics is a comparatively young research area. The first work on the identification of fax machines or digital cameras goes back to the late 1990s, but the majority of the approaches relevant today did not emerge until after 2004. The main focus is primarily on digital image forensics, which deals with the authenticity of digital image data .

→ Main article: Digital image forensics

literature

  • Rainer Böhme, Felix Freiling, Thomas Gloe, Matthias Kirchner: Multimedia forensics as a sub-discipline of digital forensics . In: Stefan Fischer, Erik Maehle, Rüdiger Reischuk (eds.): INFORMATIK 2009, Workshop Digital Multimedia Forensics . 2009, p. 1537–1551 ( PDF, 320 kB - presentation slides, 5.3 MB ).

Individual evidence

  1. ↑ Alin C. Popescu, Hany Farid: Exposing Digital Forgeries by Detecting Duplicated Image Regions . August 2004 ( PDF, 5.7 MB ).
  2. ↑ Volker Heerich: The identification of fax machines . In: Forensic Science . tape 52 , March 1998, ISSN  0023-4699 , p. 214-217 .
  3. ↑ Kenji Kurosawa, Kenro Kuroki, Naoki Saitoh: CCD fingerprint method - identification of a video camera from videotaped images . In: ICIP 1999 . October 1999, p. 537-540 , doi : 10.1109 / ICIP.1999.817172 .
  4. ^ Andrew Lewis: Multimedia forensics bibliography . Retrieved August 4, 2009.
  5. ^ Hany Farid: Digital Forensic Database . Retrieved October 12, 2009.