Skip to main content
SpringerLink
Log in

Theia: a tool for the forensic analysis of mobile devices pictures

  • Published:
Computing Aims and scope Submit manuscript

Abstract

Currently the number of cameras embedded in mobile devices is growing at an unprecedented rate. Additionally, the quality and performance of these mobile cameras is steadily improving, and is closing in on that of classical digital cameras. This scenario makes the forensic analysis of images taken with mobile cameras increasingly important and necessary. Among the various branches of forensic analysis, this paper focuses on the reliable acquisition of the make and model of the mobile camera that produced a given image. For this we have developed a technique based on exchangeable image file format (Exif) metadata analysis, allowing us in certain cases to obtain both the make and model with which the photo was taken. This comes with considerable analysis of whether this metadata information could be trusted, and with additional tools that can help in discovering image manipulation. These and other capabilities have been integrated into a new tool we have developed called Theia, that also offers many other advantages to the forensic analyst that has to mass process and analyze thousands of images in the fastest and most forensically sound way. To that end, we have also incorporated various complex functions that greatly help the forensic analyst, such as different types of advanced queries on Exif metadata information of large sets of images, and advanced geopositioning capabilities.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12

Similar content being viewed by others

References

  1. Hsu J (2010) The worldwide mobile phone camera module market and Taiwan’s industry. Market Intelligence & Consulting Institute (MIC), pp 1–18

  2. Baer R (2010) Resolution limits in digital photography: the looming end of the pixel wars—OSA technical digest (CD). In: Proceedings of the imaging systems, p. ITuB3. doi:10.1364/IS.2010.ITuB3

  3. Srivastava L (2005) Mobile phones and the evolution of social behavior. Behav Inf Technol 24(2):111–129

    Article  Google Scholar 

  4. Van Lanh T, Chong KS, Emmanuel S, Kankanhalli MS (2007) A survey on digital camera image forensic methods. In: Proceedings of the IEEE international conference on multimedia and expo, pp 16–19. doi:10.1109/ICME.2007.4284575

  5. Gloe T, Kirchner M, Winkler A, Bohme R (2007) Can we trust digital image forensics? In: Proceedings of the 15th international conference on multimedia, pp 78–86. doi:10.1145/1291233.1291252

  6. Chang C (2002) A steganographic method based upon JPEG and quantization table modification. Inf Sci 141(1–2):123–138. doi:10.1016/S0020-0255(01)00194-3

    Article  MATH  Google Scholar 

  7. Chamlawi R, Khan A (2010) Digital image authentication and recovery: employing integer transform based information embedding and extraction. Inf Sci 180(24):4909–4928. doi:10.1016/j.ins.2010.08.039

    Article  MathSciNet  Google Scholar 

  8. Tsai HH (2007) Color image watermark extraction based on support vector machines. Inf Sci 177(2):550–569. doi:10.1016/j.ins.2006.05.002

    Article  Google Scholar 

  9. Thing VLL, Ng KY, Chang EC (2010) Live memory forensics of mobile phones. Digit Investig 7:S74–S82. doi:10.1016/j.diin.2010.05.010

    Article  Google Scholar 

  10. Mckay C, Swaminathan A, Gou H, Wu M (2008) Image acquisition forensics: forensic analysis to identify imaging source. In: Proceedings of the IEEE international conference on acoustics, speech and signal processing (ICASSP), pp 1657–1660. doi:10.1109/ICASSP.2008.4517945

  11. Choi KS (2006) Source camera identification using footprints from lens aberration. In: Proceedings on digital photography II. SPIE—The International Society for Optical Engineering, vol 852, no 6069, p 60, 690J–60, 690J–8. doi:10.1117/12.649775

  12. Van LT, Emmanuel S, Kankanhalli M (2007) Identifying source cell phone using chromatic aberration. In: IEEE international conference on multimedia and expo, pp 883–886. doi:10.1109/ICME.2007.4284792

  13. Geradts ZJ, Bijhold J, Kieft M, Kurosawa K, Kuroki K, Saitoh N (2001) Methods for identification of images acquired with digital cameras. In: Proceedings of the international conference on enabling technologies for law enforcement and security, vol 4232, pp 505–512. doi:10.1117/12.417569

  14. Lukas J, Fridrich J, Goljan M (2006) Digital camera identification from sensor pattern noise. IEEE Trans Inf Foren Secur 1(2):205–214. doi:10.1109/TIFS.2006.873602

    Article  Google Scholar 

  15. Costa FDO, Eckmann M, Scheirer WJ, Rocha A (2012) Open set source camera attribution. In: Proceedings of the 25th conference on graphics, patterns and images. IEEE, New York, pp 71–78. doi:10.1109/SIBGRAPI.2012.19

  16. de Costa OF, Silva E, Eckmann M, Scheirer WJ, Rocha A (2014) Open set source camera attribution and device linking. Pattern Recognit Lett 39(0):92–101

  17. Bayram S, Sencar H, Memon N, Avcibas I (2005) Source camera identification based on CFA interpolation. In: Proceedings of the IEEE international conference on image processing, vol 3, pp 69–72. doi:10.1109/ICIP.2005.1530330

  18. Bayram S, Sencar HT, Memon N (2006) Improvements on source camera-model identification based on CFA interpolation. In: Proceedings of the working group international conference on digital forensics. Springer, Berlin, pp 24–27

  19. Avcibas I, Memon N, Sankur B (2003) Steganalysis using image quality metrics. IEEE Trans Image Process 12(2):221–229. doi:10.1109/TIP.2002.807363

    Article  MathSciNet  Google Scholar 

  20. Celiktutan O, Avcibas I, Sankur B, Ayerden NP, Capar C (2006) Source cell-phone identification. In: Proceedings of the IEEE 14th signal processing and communications applications, pp 1–3. doi:10.1109/SIU.2006.1659882

  21. Cao H, Kot AC (2010) Mobile camera identification using demosaicing features. In: Proceedings of 2010 IEEE international symposium on circuits and systems (ISCAS). IEEE, New York, pp 1683–1686

  22. Ho J, Au O, Zhou J, Guo Y (2010) Inter-channel demosaicking traces for digital image forensics. In: 2010 IEEE international conference on multimedia and expo (ICME), pp 1475–1480. doi:10.1109/ICME.2010.5582951

  23. Mehdi KL, Sencar HT, Memon N (2004) Blind source camera identification. In: Proceedings of the international conference on image processing, vol 1. IEEE, New York, pp 709–712. doi:10.1109/ICIP.2004.1418853

  24. Boutell M, Luo J (2005) Beyond pixels: exploiting camera metadata for photo classification. Pattern Recognit 38(6):935–946. doi:10.1016/j.patcog.2004.11.013

    Article  Google Scholar 

  25. Lai CL, Chen YS (2009) The application of intelligent system to digital image forensics. In: Proceedings of the international conference on machine learning and cybernetics, vol 5. IEEE, New York, pp 2991–2998. doi:10.1109/ICMLC.2009.5212589

  26. Hu Y, Li CT, Zhou C (2010) Selecting forensic features for robust source camera identification. In: Proceeding of the 2010 international computer symposium (ICS), pp 506–511. doi:10.1109/COMPSYM.2010.5685458

  27. Ozparlak L, Avcibas I (2011) Differentiating between images using wavelet-based transforms: a comparative study. IEEE Trans Inf Foren Secur 6(4):1418–1431

    Article  Google Scholar 

  28. Liu Q, Li X, Chen L, Cho H, Cooper AP, Chen Z, Qiao M, Sung AH (2012) Identification of smartphone-image source and manipulation. In: Jiang H, Ding W, Ali M, Wu X (eds) Advanced research in applied artificial intelligence. Lecture notes in computer science, vol 7345. Springer, Berlin, pp 262–271. doi:10.1007/978-3-642-31087-4-28

  29. Sandoval Orozco AL, Rosales Corripio J, Garcia Villalba LJ, Hernandez-Castro JC (2013) Source identification for mobile devices, based on wavelet transforms combined with sensor imperfections. Computing 96(9):829–841

    Article  MATH  Google Scholar 

  30. Jang CJ, Lee JY, Won Lee J, Cho HG (2007) Smart management system for digital photographs using temporal and spatial features with EXIF metadata. In: Proceedings of the 2nd international conference on digital information management. ICDIM ’07, vol 1, pp 110–115. doi:10.1109/ICDIM.2007.4444209

  31. Fan J, Kot A, Cao H, Sattar F (2011) Modeling the EXIF-image correlation for image manipulation detection. In: Proceedings of the 18th IEEE international conference on image processing (ICIP), pp 1945–1948. doi:10.1109/ICIP.2011.6115853

  32. Boutell M, Luo J (2004) Photo classification by integrating image content and camera metadata. In: Proceedings of the 17th international conference on pattern recognition, vol 4, pp 901–904. doi:10.1109/ICPR.2004.1333918

  33. Tesic J (2005) Metadata practices for consumer photos. IEEE Multimedia 12(3):86–92. doi:10.1109/MMUL.2005.50

    Article  Google Scholar 

  34. Romero NL, Chornet VG, Cobos JS, Carot AS, Centellas FC, Mendez MC (2008) Recovery of descriptive information in images from digital libraries by means of EXIF metadata. Library Hi Tech 26(2):302–315. doi:10.1108/07378830810880388

    Article  Google Scholar 

  35. Choi KS, Lam EY, Wong KY (2006) Automatic source camera identification using the intrinsic lens radial distortion. Optics Express 14(24):11551–11565. doi:10.1364/OE.14.011551

    Article  Google Scholar 

  36. Long Y, Huang Y (2006) Image based source camera identification using demosaicking. In: Proceedings of the IEEE 8th workshop on multimedia signal processing, pp 419–424. doi:10.1109/MMSP.2006.285343

  37. Dirik AE, Sencar HT, Memon N (2007) Source camera identification based on sensor dust characteristics. In: Workshop on signal processing applications for public security and forensics. IEEE, New York, pp 1–6

  38. Tsai MJ, Lai CL, Liu J (2007) Camera/mobile phone source identification for digital forensics. In: Proceedings of the international conference on acoustics speech and signal processing, pp II-221–II-224. doi:10.1109/ICASSP.2007.366212

  39. Van LT, Emmanuel S, Kankanhalli M (2007) Identifying source cell phone using chromatic aberration. In: Proceedings of the IEEE international conference on multimedia and expo, pp 883–886. doi:10.1109/ICME.2007.4284792

  40. Celiktutan O, Sankur B, Avcibas I (2008) Blind identification of source cell-phone model. IEEE Trans Inf Foren Secur 3(3):553566. doi:10.1109/TIFS.2008.926993

    Article  Google Scholar 

  41. Sandoval Orozco A, Arenas Gonzalez D, Rosales Corripio J, Garcia Villalba L, Hernandez-Castro J (2013) Techniques for source camera identification. In: Proceedings of the 6th international conference on information technology, pp 1–9

  42. Hamilton E (2004) JPEG file interchange format. Version 1.02, September 1, 1992. http://www.w3.org/Graphics/JPEG/jfif3.pdf

  43. Adobe developers association. TiFF Revision 6.0 (1992). http://partners.adobe.com/public/developer/en/tiff/TIFF6.pdf

  44. Committee S (2010) Exchangeable image file for digital still cameras: Exif version 2.3, April 26, 2010. http://www.cipa.jp/english/hyoujunka/kikaku/pdf/DC-008-2010-E.pdf

  45. Sandoval Orozco A, Arenas González D, Garca Villalba L, Hernndez-Castro J (2015) Analysis of errors in Exif metadata on mobile devices. Multimed Tools Appl 74(13):4735–4763. doi:10.1007/s11042-013-1837-6

    Article  Google Scholar 

  46. International T, Telecommunications P, Press C, Illustrator A (2007) International Press Telecommunications Council. Image Rochester, pp 3–5

  47. Wandel M (2010) Exif Jpeg header manipulation tool. http://www.sentex.net/~mwandel/jhead/

  48. Adobe Developers Association (2005) XMP specification. http://partners.adobe.com/public/developer/en/xmp/

  49. Harvey P (2005) ExifTool. http://www.sno.phy.queensu.ca/~phil/exiftool/

  50. Raskin A (2007) Exif viewer 1.81. https://addons.mozilla.org/es-es/firefox/addon/exif-viewer/

  51. Kowalski M (2010) ExifPro image viewer. http://www.exifpro.com/

Download references

Acknowledgments

The authors acknowledge to “Programa de Financiación de Grupos de Investigación UCM validados de la Universidad Complutense de Madrid - Banco Santander”.

Author information

Authors and Affiliations

  1. Group of Analysis, Security and Systems (GASS), Department of Software Engineering and Artificial Intelligence (DISIA), Faculty of Information Technology and Computer Science, Universidad Complutense de Madrid (UCM), Office 431, Calle Profesor José García Santesmases s/n, Ciudad Universitaria, 28040, Madrid, Spain

    Ana Lucila Sandoval Orozco, Jocelin Rosales Corripio, David Manuel Arenas González & Luis Javier García Villalba

  2. School of Computing, University of Kent, Office S129A, Cornwallis South Building, Canterbury, CT2 7NF, UK

    Julio Hernandez-Castro

Authors
  1. Ana Lucila Sandoval Orozco
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jocelin Rosales Corripio
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. David Manuel Arenas González
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Luis Javier García Villalba
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Julio Hernandez-Castro
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Luis Javier García Villalba.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Orozco, A.L.S., Corripio, J.R., González, D.M.A. et al. Theia: a tool for the forensic analysis of mobile devices pictures. Computing 98, 1251–1286 (2016). https://doi.org/10.1007/s00607-015-0482-5

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s00607-015-0482-5

Keywords

Mathematics Subject Classification

Search

Navigation