, Volume 98, Issue 12, pp 1251–1286 | Cite as

Theia: a tool for the forensic analysis of mobile devices pictures

  • Ana Lucila Sandoval Orozco
  • Jocelin Rosales Corripio
  • David Manuel Arenas González
  • Luis Javier García Villalba
  • Julio Hernandez-Castro


Currently the number of cameras embedded in mobile devices is growing at an unprecedented rate. Additionally, the quality and performance of these mobile cameras is steadily improving, and is closing in on that of classical digital cameras. This scenario makes the forensic analysis of images taken with mobile cameras increasingly important and necessary. Among the various branches of forensic analysis, this paper focuses on the reliable acquisition of the make and model of the mobile camera that produced a given image. For this we have developed a technique based on exchangeable image file format (Exif) metadata analysis, allowing us in certain cases to obtain both the make and model with which the photo was taken. This comes with considerable analysis of whether this metadata information could be trusted, and with additional tools that can help in discovering image manipulation. These and other capabilities have been integrated into a new tool we have developed called Theia, that also offers many other advantages to the forensic analyst that has to mass process and analyze thousands of images in the fastest and most forensically sound way. To that end, we have also incorporated various complex functions that greatly help the forensic analyst, such as different types of advanced queries on Exif metadata information of large sets of images, and advanced geopositioning capabilities.


Mobile phone camera Exif Forensics analysis Source identification 

Mathematics Subject Classification

68Q32 Computational learning theory [See also 68T05] 68T05 Learning and adaptive systems 68U10 Image processing 



The authors acknowledge to “Programa de Financiación de Grupos de Investigación UCM validados de la Universidad Complutense de Madrid - Banco Santander”.


  1. 1.
    Hsu J (2010) The worldwide mobile phone camera module market and Taiwan’s industry. Market Intelligence & Consulting Institute (MIC), pp 1–18Google Scholar
  2. 2.
    Baer R (2010) Resolution limits in digital photography: the looming end of the pixel wars—OSA technical digest (CD). In: Proceedings of the imaging systems, p. ITuB3. doi: 10.1364/IS.2010.ITuB3
  3. 3.
    Srivastava L (2005) Mobile phones and the evolution of social behavior. Behav Inf Technol 24(2):111–129CrossRefGoogle Scholar
  4. 4.
    Van Lanh T, Chong KS, Emmanuel S, Kankanhalli MS (2007) A survey on digital camera image forensic methods. In: Proceedings of the IEEE international conference on multimedia and expo, pp 16–19. doi: 10.1109/ICME.2007.4284575
  5. 5.
    Gloe T, Kirchner M, Winkler A, Bohme R (2007) Can we trust digital image forensics? In: Proceedings of the 15th international conference on multimedia, pp 78–86. doi: 10.1145/1291233.1291252
  6. 6.
    Chang C (2002) A steganographic method based upon JPEG and quantization table modification. Inf Sci 141(1–2):123–138. doi: 10.1016/S0020-0255(01)00194-3 CrossRefzbMATHGoogle Scholar
  7. 7.
    Chamlawi R, Khan A (2010) Digital image authentication and recovery: employing integer transform based information embedding and extraction. Inf Sci 180(24):4909–4928. doi: 10.1016/j.ins.2010.08.039 MathSciNetCrossRefGoogle Scholar
  8. 8.
    Tsai HH (2007) Color image watermark extraction based on support vector machines. Inf Sci 177(2):550–569. doi: 10.1016/j.ins.2006.05.002 CrossRefGoogle Scholar
  9. 9.
    Thing VLL, Ng KY, Chang EC (2010) Live memory forensics of mobile phones. Digit Investig 7:S74–S82. doi: 10.1016/j.diin.2010.05.010 CrossRefGoogle Scholar
  10. 10.
    Mckay C, Swaminathan A, Gou H, Wu M (2008) Image acquisition forensics: forensic analysis to identify imaging source. In: Proceedings of the IEEE international conference on acoustics, speech and signal processing (ICASSP), pp 1657–1660. doi: 10.1109/ICASSP.2008.4517945
  11. 11.
    Choi KS (2006) Source camera identification using footprints from lens aberration. In: Proceedings on digital photography II. SPIE—The International Society for Optical Engineering, vol 852, no 6069, p 60, 690J–60, 690J–8. doi: 10.1117/12.649775
  12. 12.
    Van LT, Emmanuel S, Kankanhalli M (2007) Identifying source cell phone using chromatic aberration. In: IEEE international conference on multimedia and expo, pp 883–886. doi: 10.1109/ICME.2007.4284792
  13. 13.
    Geradts ZJ, Bijhold J, Kieft M, Kurosawa K, Kuroki K, Saitoh N (2001) Methods for identification of images acquired with digital cameras. In: Proceedings of the international conference on enabling technologies for law enforcement and security, vol 4232, pp 505–512. doi: 10.1117/12.417569
  14. 14.
    Lukas J, Fridrich J, Goljan M (2006) Digital camera identification from sensor pattern noise. IEEE Trans Inf Foren Secur 1(2):205–214. doi: 10.1109/TIFS.2006.873602 CrossRefGoogle Scholar
  15. 15.
    Costa FDO, Eckmann M, Scheirer WJ, Rocha A (2012) Open set source camera attribution. In: Proceedings of the 25th conference on graphics, patterns and images. IEEE, New York, pp 71–78. doi: 10.1109/SIBGRAPI.2012.19
  16. 16.
    de Costa OF, Silva E, Eckmann M, Scheirer WJ, Rocha A (2014) Open set source camera attribution and device linking. Pattern Recognit Lett 39(0):92–101Google Scholar
  17. 17.
    Bayram S, Sencar H, Memon N, Avcibas I (2005) Source camera identification based on CFA interpolation. In: Proceedings of the IEEE international conference on image processing, vol 3, pp 69–72. doi: 10.1109/ICIP.2005.1530330
  18. 18.
    Bayram S, Sencar HT, Memon N (2006) Improvements on source camera-model identification based on CFA interpolation. In: Proceedings of the working group international conference on digital forensics. Springer, Berlin, pp 24–27Google Scholar
  19. 19.
    Avcibas I, Memon N, Sankur B (2003) Steganalysis using image quality metrics. IEEE Trans Image Process 12(2):221–229. doi: 10.1109/TIP.2002.807363 MathSciNetCrossRefGoogle Scholar
  20. 20.
    Celiktutan O, Avcibas I, Sankur B, Ayerden NP, Capar C (2006) Source cell-phone identification. In: Proceedings of the IEEE 14th signal processing and communications applications, pp 1–3. doi: 10.1109/SIU.2006.1659882
  21. 21.
    Cao H, Kot AC (2010) Mobile camera identification using demosaicing features. In: Proceedings of 2010 IEEE international symposium on circuits and systems (ISCAS). IEEE, New York, pp 1683–1686Google Scholar
  22. 22.
    Ho J, Au O, Zhou J, Guo Y (2010) Inter-channel demosaicking traces for digital image forensics. In: 2010 IEEE international conference on multimedia and expo (ICME), pp 1475–1480. doi: 10.1109/ICME.2010.5582951
  23. 23.
    Mehdi KL, Sencar HT, Memon N (2004) Blind source camera identification. In: Proceedings of the international conference on image processing, vol 1. IEEE, New York, pp 709–712. doi: 10.1109/ICIP.2004.1418853
  24. 24.
    Boutell M, Luo J (2005) Beyond pixels: exploiting camera metadata for photo classification. Pattern Recognit 38(6):935–946. doi: 10.1016/j.patcog.2004.11.013 CrossRefGoogle Scholar
  25. 25.
    Lai CL, Chen YS (2009) The application of intelligent system to digital image forensics. In: Proceedings of the international conference on machine learning and cybernetics, vol 5. IEEE, New York, pp 2991–2998. doi: 10.1109/ICMLC.2009.5212589
  26. 26.
    Hu Y, Li CT, Zhou C (2010) Selecting forensic features for robust source camera identification. In: Proceeding of the 2010 international computer symposium (ICS), pp 506–511. doi: 10.1109/COMPSYM.2010.5685458
  27. 27.
    Ozparlak L, Avcibas I (2011) Differentiating between images using wavelet-based transforms: a comparative study. IEEE Trans Inf Foren Secur 6(4):1418–1431CrossRefGoogle Scholar
  28. 28.
    Liu Q, Li X, Chen L, Cho H, Cooper AP, Chen Z, Qiao M, Sung AH (2012) Identification of smartphone-image source and manipulation. In: Jiang H, Ding W, Ali M, Wu X (eds) Advanced research in applied artificial intelligence. Lecture notes in computer science, vol 7345. Springer, Berlin, pp 262–271. doi: 10.1007/978-3-642-31087-4-28
  29. 29.
    Sandoval Orozco AL, Rosales Corripio J, Garcia Villalba LJ, Hernandez-Castro JC (2013) Source identification for mobile devices, based on wavelet transforms combined with sensor imperfections. Computing 96(9):829–841CrossRefzbMATHGoogle Scholar
  30. 30.
    Jang CJ, Lee JY, Won Lee J, Cho HG (2007) Smart management system for digital photographs using temporal and spatial features with EXIF metadata. In: Proceedings of the 2nd international conference on digital information management. ICDIM ’07, vol 1, pp 110–115. doi: 10.1109/ICDIM.2007.4444209
  31. 31.
    Fan J, Kot A, Cao H, Sattar F (2011) Modeling the EXIF-image correlation for image manipulation detection. In: Proceedings of the 18th IEEE international conference on image processing (ICIP), pp 1945–1948. doi: 10.1109/ICIP.2011.6115853
  32. 32.
    Boutell M, Luo J (2004) Photo classification by integrating image content and camera metadata. In: Proceedings of the 17th international conference on pattern recognition, vol 4, pp 901–904. doi: 10.1109/ICPR.2004.1333918
  33. 33.
    Tesic J (2005) Metadata practices for consumer photos. IEEE Multimedia 12(3):86–92. doi: 10.1109/MMUL.2005.50 CrossRefGoogle Scholar
  34. 34.
    Romero NL, Chornet VG, Cobos JS, Carot AS, Centellas FC, Mendez MC (2008) Recovery of descriptive information in images from digital libraries by means of EXIF metadata. Library Hi Tech 26(2):302–315. doi: 10.1108/07378830810880388 CrossRefGoogle Scholar
  35. 35.
    Choi KS, Lam EY, Wong KY (2006) Automatic source camera identification using the intrinsic lens radial distortion. Optics Express 14(24):11551–11565. doi: 10.1364/OE.14.011551 CrossRefGoogle Scholar
  36. 36.
    Long Y, Huang Y (2006) Image based source camera identification using demosaicking. In: Proceedings of the IEEE 8th workshop on multimedia signal processing, pp 419–424. doi: 10.1109/MMSP.2006.285343
  37. 37.
    Dirik AE, Sencar HT, Memon N (2007) Source camera identification based on sensor dust characteristics. In: Workshop on signal processing applications for public security and forensics. IEEE, New York, pp 1–6Google Scholar
  38. 38.
    Tsai MJ, Lai CL, Liu J (2007) Camera/mobile phone source identification for digital forensics. In: Proceedings of the international conference on acoustics speech and signal processing, pp II-221–II-224. doi: 10.1109/ICASSP.2007.366212
  39. 39.
    Van LT, Emmanuel S, Kankanhalli M (2007) Identifying source cell phone using chromatic aberration. In: Proceedings of the IEEE international conference on multimedia and expo, pp 883–886. doi: 10.1109/ICME.2007.4284792
  40. 40.
    Celiktutan O, Sankur B, Avcibas I (2008) Blind identification of source cell-phone model. IEEE Trans Inf Foren Secur 3(3):553566. doi: 10.1109/TIFS.2008.926993 CrossRefGoogle Scholar
  41. 41.
    Sandoval Orozco A, Arenas Gonzalez D, Rosales Corripio J, Garcia Villalba L, Hernandez-Castro J (2013) Techniques for source camera identification. In: Proceedings of the 6th international conference on information technology, pp 1–9Google Scholar
  42. 42.
    Hamilton E (2004) JPEG file interchange format. Version 1.02, September 1, 1992.
  43. 43.
    Adobe developers association. TiFF Revision 6.0 (1992).
  44. 44.
    Committee S (2010) Exchangeable image file for digital still cameras: Exif version 2.3, April 26, 2010.
  45. 45.
    Sandoval Orozco A, Arenas González D, Garca Villalba L, Hernndez-Castro J (2015) Analysis of errors in Exif metadata on mobile devices. Multimed Tools Appl 74(13):4735–4763. doi: 10.1007/s11042-013-1837-6 CrossRefGoogle Scholar
  46. 46.
    International T, Telecommunications P, Press C, Illustrator A (2007) International Press Telecommunications Council. Image Rochester, pp 3–5Google Scholar
  47. 47.
    Wandel M (2010) Exif Jpeg header manipulation tool.
  48. 48.
    Adobe Developers Association (2005) XMP specification.
  49. 49.
  50. 50.
  51. 51.
    Kowalski M (2010) ExifPro image viewer.

Copyright information

© Springer-Verlag Wien 2016

Authors and Affiliations

  • Ana Lucila Sandoval Orozco
    • 1
  • Jocelin Rosales Corripio
    • 1
  • David Manuel Arenas González
    • 1
  • Luis Javier García Villalba
    • 1
  • Julio Hernandez-Castro
    • 2
  1. 1.Group of Analysis, Security and Systems (GASS), Department of Software Engineering and Artificial Intelligence (DISIA), Faculty of Information Technology and Computer ScienceUniversidad Complutense de Madrid (UCM)MadridSpain
  2. 2.School of ComputingUniversity of KentCanterburyUK

Personalised recommendations