Main text

Since 1990, the Japan Business Machine Makers Association (JBMA) adopted a Counterfeit Protection System to decrease the counterfeiting and positively identify color laser copiers used illegally (MAFS Workshop, 2000) (Tweedy, 2001). In 2010, with a concordance between the US Secret Service and Freedom of Information Act (FOIA) and printer manufacturers (Canon, Brother, Casio, Hewlett-Packard, Konica, Minolta, Ricoh, Sharp and Xerox) agreed for commitments for identification counterfeiting crimes had committed via color laser machines. Therefore, the determination of color laser printers source seized in forgery crimes became one of the most challenges in digital forensic labs today. In the last decade, digital forensic labs have introduced excess approaches to try catching a source of a defendant color laser printer such as, halftone analysis (Kim & Lee, 2014), statistical analysis of discrete wavelet transform (J. Choi et al., 2009) and noisy features analysis (J. H. Choi, Lee, & Lee, 2013), etc. have used. Notwithstanding, the previous methods could give good evidence but didn’t reach to hundred percent in their detections. So, we have explored a new methodology for identifying the color laser printer source in a good attend enabling us to achieve an accuracy ratio hundred percent in our investigations. In our work, we have followed an active strategy for the identification. The active strategy has presented as a form of steganography for securing color laser printouts (Mace, 2010). The printer steganography consisted of embedded small microdots in their sizes, appeared in yellow color for a naked eye by zooming in with 36 X and called tracking dots (van Beusekom, Schreyer, & Breuel, 2010). These tracking dots called Machine identification code (MIC)(van Beusekom, Shafait, & Breuel, 2013), counterfeiting protection system code (CPS) (van Beusekom et al., 2010), and Coded dots matrix (CDM) pattern. In our route of work, we have explored color laser printers of Xerox® brand via Adobe® Photoshop® CC 2018 as a nondestructive and indirect tool to implement the steganalysis process. We have tracked these yellow dots or machine identification code because they have contained the covert information about the source of a color laser machine candidate (or a defendant). The covert information mainly has contained a serial number of a color laser machine. According to the size of a color laser printer of Xerox® brand, we could notice that not all small office color laser printers have contained the information about a date or time for the printing process. In contrary, all studied color laser multifunction printers of Xerox® brand contained a date and time for the printing process (as given in Table 1). Characteristic regions that have exhibited, a serial number, a date and time (if found) in color laser printouts of Xerox® brand has been tracking to achieve our goal for the identification step.

Table 1 The color laser printer models of Xerox® brand used in our study
Full size table

In the present study, we have applied the defined steps as shown in (Fig. 1).

Fig. 1
figure 1

The defined steps for identifying the color laser printer source

Full size image

Based on complementary colors, white papers selected to produce more vivid visual contrast for representation in the HSL (hue, saturation, and lightness) mode. Furthermore, the yellow dots had embedded in a different color paper, but the extraction step could be difficult in the tracking than occurred in white papers. So, all color laser printouts printed onto A4 white paper and collected from different photocopiers and printing offices. The details of selected color laser machines of Xerox® brand presented in Table 1.

All color laser printouts have scanned on CanoScan® LIDE 100 with a resolution of 1200 dots per inch (DPI). Due to the smallest size of the tracking dots (≈ 0.005 in.) we have increased a resolution degree to get more vivid images convenient for the scanning step.

In this step, we have converted a hard copy of a color laser printout into a digital data (soft copy). A raster image or bitmap image is a digital data copy that has contained all details about the scanned image as given in (Fig. 2).

Fig. 2
figure 2

Data conversion process for scanning step

Full size image

The major scope for the extraction step has aimed to track the hidden yellow dots (MIC) from the soft copy of color laser printouts. Therefore, we have applied a new preset in Adobe® Photoshop® CC 2018 as a tool for an image processing. This preset has aimed to separate the scanned image into three channels using the RGB mode as given in Fig. 3.

Fig. 3
figure 3

The RGB mode selected in Adobe® Photoshop® CC 2018 for separation layers

Full size image

The corresponding module that is convenient with the RGB mode is the HSL (hue, saturation, and lightness) cylindrical-coordinate system and could depict as given in Figs. 4 and 5. A blue channel is the last step exhibited the overall adjustments implemented on the soft copy scanned and presented in Fig. 6. The extraction step is the vital step enable us to extract and track all active security features that had embedded in color laser printouts.

Fig. 4
figure 4

The HSL colors combined system selected in Adobe® Photoshop® CC 2018 for adjustments layers

Full size image
Fig. 5
figure 5

The HSL window opened in Adobe® Photoshop® CC 2018 for the adjustment process

Full size image
Fig. 6
figure 6

A blue channel exhibited MIC pattern for a color laser printout of Xerox® brand sample after adjustments in Adobe® Photoshop® CC 2018

Full size image

In this step, we have measured all distances (both inside and outside the basic units – see Fig. 12) concerning with the tracking dots that have formed the security features for each color laser printout. In these measurements, we have used Adobe® Photoshop® CC 2018 for tracking all security features at zoom 100% to the original images. Moreover, we have calibrated all measurements against live measurements carried out directly on color laser printouts.

In this paper, we have explored ninety-one color laser printout samples from twenty-two color laser machines (printers & multifunction printers) with the same and different models and presented in Table 1. All color laser printouts contained both text and images. In the given study, we figured out that all color laser printouts have contained the tracking dots (MIC) spread onto the printout samples. Therefore, we have studied the configurations, distributions, and distances for these tracking dots via Adobe® Photoshop® CC 2018. We could extract and present the clear precise machine identification code corresponding to each color laser printer candidate of Xerox® brand. The configuration and the distribution of the extracted tracking yellow dots for color laser printout samples of Xerox® brand have characterized by the following features:

  1. 1.

    Spread and grouped in a regular grid of dots (pattern) all over the printout samples as regular horizontal rows and vertical columns.

  2. 2.

    The repetition of grid dots (pattern) of basic units of the tracking dots differed horizontally for each printer than the other but same for the same models.

  3. 3.

    The repetition of grid dots (pattern) of basic units of the tracking dots differed vertically for each printer than the other but same for the same models.

  4. 4.

    The repeated basic unit of the tracking dots is composed of fifteen columns with eight rows (15*8) in a form of a coded dots matrix.

  5. 5.

    There was a constant distance between the repeated basic units of the tracking dots horizontally and vertically.

  6. 6.

    Each color laser printer or multifunction printer had its unique distribution of the tracking dots inside the coded dots matrix (a repeated basic unit).

The defined repeated configuration of Xerox® color laser printers and their different distributions can be seen clearly in Figs. 7, 8 and 9 in RGB, CMYK, and Grayscale modes.

Fig. 7
figure 7

The RGB mode of the coded dots matrix embedded in a color laser printout of Xerox® sample

Full size image
Fig. 8
figure 8

The CMYK mode of the coded dots matrix embedded in a color laser printout of Xerox® sample

Full size image
Fig. 9
figure 9

The grayscale mode of the coded dots matrix embedded in a color laser printout of Xerox® sample

Full size image

Form Figs. 7, 8 and 9 we could discriminate three vital regions: the time region that appeared from column two to column four, wherever column one is a constant and column five is a separator between regions. The second region exhibited the date of the printing process from column six to column eight. The third region exhibited a serial number of any model of the color laser printer of Xerox® brand.

The calculations of both the time and date obeyed the binary coded decimal (BCD) system with no decryption in any dot in these regions. But a serial number region had been coded with some decryption for specific numbers appeared in the actual serial number. The calculations direction stats from down to up.

As shown in Figs. 7, 8 and 9 above we found no information has exhibited for the time or date of the printing process. But the region of the serial number has appeared a constant for the same machine.

As seen from Figs. 10 and 11 we have noted that the date region could be calculated and visualized as viz.:

Fig. 10
figure 10

The exhibition of the day, Month, and year (D, M, and Y) calculated, 11/1/2015 in the grayscale mode of a coded dots matrix embedded in a color laser printout of Xerox® sample

Full size image
Fig. 11
figure 11

(a) The RGB mode representation of the actual printed date of the printing process in black dots, (b) The grayscale representation for the calculated date (5/2/2018) in red, green and brown circles

Full size image

We have measured all distances of basic repeated units of the coded dots matrix embedded onto each color laser printout studied to get an insight of their configurations. Also, Adobe® Photoshop® CC 2018 has used with a custom preset after calibration. We have found all studied color laser printouts had constant distances that can summarize as viz.:

  1. 1.

    The distance between two adjacent dots inside the coded dots matrix = 0.1 cm.

  2. 2.

    The width of the basic unit of the coded dots matrix = 1.4 cm.

  3. 3.

    The length of the basic unit of the coded dots matrix = 0.7 cm.

  4. 4.

    The horizontal distance between two adjacent repeated basic units of the coded dots matrix in each row = 1.8 cm.

  5. 5.

    The vertical distance between two adjacent repeated basic units of the coded dots matrix in each column = 0.9 cm.

We have visualized these distances and measurements as shown in Fig. 12.

Fig. 12
figure 12

The visualizations of all distances measured in the grayscale mode for the coded dots matrix embedded in a color laser printout of Xerox® sample

Full size image

A new preset of Adobe® Photoshop® CC 2018 has applied as an indirect and nondestructive technique on ninety-one color laser printout samples from twenty-two color laser machines (printers & multifunction printers) with the same and different models of Xerox® brand. We could successfully extract and measure all distance spaces around and inside the coded dots matrix corresponding to each color laser printout of Xerox® samples. Furthermore, we have figured out that all color laser printout samples studied from the same and different Xerox® brand models had the tracking dots with a defined configuration spread onto the color laser printouts in a regular grid of dots (pattern) – as row and column arrangements. The defined configuration of the basic unit of the tracking dots matrix (pattern) corresponding to the color laser of Xerox® brand named with “the coded dots matrix” pattern. All studied coded dots matrices composed of fifteen columns and eight rows in a regular grid pattern with a unique distribution of yellow tracking dots inside their patterns. The coded dots matrix (CDM) patterns studied exhibited mainly information about the machine serial number and model. Furthermore, according to the variation in the model sizes of the color laser printers of Xerox® brand, we found not all the coded dots matrix patterns exhibited the time and date for the printing process, but all multifunction printers only exhibited this feature. Therefore, we have introduced a new method could be applied to distinguish between two or more color laser Xerox® printouts of the same model with different serial numbers, and different models in digital forensic labs – with an accuracy ratio reached to 100%. This study is being a part of series studies that currently have been carrying out on different color laser brands.

Background

Since 1990, the Japan Business Machine Makers Association (JBMA) adopted a Counterfeit Protection System to decrease the counterfeiting and positively identify color laser copiers used illegally (MAFS Workshop, 2000) (Tweedy, 2001). In 2010, with a concordance between the US Secret Service and Freedom of Information Act (FOIA) and printer manufacturers (Canon, Brother, Casio, Hewlett-Packard, Konica, Minolta, Ricoh, Sharp and Xerox) agreed for commitments for identification counterfeiting crimes had committed via color laser machines. Therefore, the determination of color laser printers source seized in forgery crimes became one of the most challenges in digital forensic labs today. In the last decade, digital forensic labs have introduced excess approaches to try catching a source of a defendant color laser printer such as, halftone analysis (Kim & Lee, 2014), statistical analysis of discrete wavelet transform (J. Choi et al., 2009) and noisy features analysis (J. H. Choi, Lee, & Lee, 2013), etc. have used. Notwithstanding, the previous methods could give good evidence but didn’t reach to hundred percent in their detections. So, we have explored a new methodology for identifying the color laser printer source in a good attend enabling us to achieve an accuracy ratio hundred percent in our investigations. In our work, we have followed an active strategy for the identification. The active strategy has presented as a form of steganography for securing color laser printouts (Mace, 2010). The printer steganography consisted of embedded small microdots in their sizes, appeared in yellow color for a naked eye by zooming in with 36 X and called tracking dots (van Beusekom, Schreyer, & Breuel, 2010). These tracking dots called Machine identification code (MIC) (van Beusekom, Shafait, & Breuel, 2013), counterfeiting protection system code (CPS) (van Beusekom et al., 2010), and Coded dots matrix (CDM) pattern. In our route of work, we have explored color laser printers of Xerox® brand via Adobe® Photoshop® CC 2018 as a nondestructive and indirect tool to implement the steganalysis process. We have tracked these yellow dots or machine identification code because they have contained the covert information about the source of a color laser machine candidate (or a defendant). The covert information mainly has contained a serial number of a color laser machine. According to the size of a color laser printer of Xerox® brand, we could notice that not all small office color laser printers have contained the information about a date or time for the printing process. In contrary, all studied color laser multifunction printers of Xerox® brand contained a date and time for the printing process (as given in Table 1). Characteristic regions that have exhibited, a serial number, a date and time (if found) in color laser printouts of Xerox® brand has been tracking to achieve our goal for the identification step.

Materials and methods

In the present study, we have applied the defined steps as shown in (Fig. 1).

Printing and collecting samples

Based on complementary colors, white papers selected to produce more vivid visual contrast for representation in the HSL (hue, saturation, and lightness) mode. Furthermore, the yellow dots had embedded in a different color paper, but the extraction step could be difficult in the tracking than occurred in white papers. So, all color laser printouts printed onto A4 white paper and collected from different photocopiers and printing offices. The details of selected color laser machines of Xerox® brand presented in Table 1.

Scanning

All color laser printouts have scanned on CanoScan® LIDE 100 with a resolution of 1200 dots per inch (DPI). Due to the smallest size of the tracking dots (≈ 0.005 in.) we have increased a resolution degree to get more vivid images convenient for the scanning step.

In this step, we have converted a hard copy of a color laser printout into a digital data (soft copy). A raster image or bitmap image is a digital data copy that has contained all details about the scanned image as given in (Fig. 2).

Extraction

The major scope for the extraction step has aimed to track the hidden yellow dots (MIC) from the soft copy of color laser printouts. Therefore, we have applied a new preset in Adobe® Photoshop® CC 2018 as a tool for an image processing. This preset has aimed to separate the scanned image into three channels using the RGB mode as given in Fig. 3.

The corresponding module that is convenient with the RGB mode is the HSL (hue, saturation, and lightness) cylindrical-coordinate system and could depict as given in Figs. 4 and 5. A blue channel is the last step exhibited the overall adjustments implemented on the soft copy scanned and presented in Fig. 6. The extraction step is the vital step enable us to extract and track all active security features that had embedded in color laser printouts.

Measurements

In this step, we have measured all distances (both inside and outside the basic units – see Fig. 12) concerning with the tracking dots that have formed the security features for each color laser printout. In these measurements, we have used Adobe® Photoshop® CC 2018 for tracking all security features at zoom 100% to the original images. Moreover, we have calibrated all measurements against live measurements carried out directly on color laser printouts.

Results and discussion

In this paper, we have explored ninety-one color laser printout samples from twenty-two color laser machines (printers & multifunction printers) with the same and different models and presented in Table 1. All color laser printouts contained both text and images. In the given study, we figured out that all color laser printouts have contained the tracking dots (MIC) spread onto the printout samples. Therefore, we have studied the configurations, distributions, and distances for these tracking dots via Adobe® Photoshop® CC 2018. We could extract and present the clear precise machine identification code corresponding to each color laser printer candidate of Xerox® brand. The configuration and the distribution of the extracted tracking yellow dots for color laser printout samples of Xerox® brand have characterized by the following features:

  1. 1.

    Spread and grouped in a regular grid of dots (pattern) all over the printout samples as regular horizontal rows and vertical columns.

  2. 2.

    The repetition of grid dots (pattern) of basic units of the tracking dots differed horizontally for each printer than the other but same for the same models.

  3. 3.

    The repetition of grid dots (pattern) of basic units of the tracking dots differed vertically for each printer than the other but same for the same models.

  4. 4.

    The repeated basic unit of the tracking dots is composed of fifteen columns with eight rows (15*8) in a form of a coded dots matrix.

  5. 5.

    There was a constant distance between the repeated basic units of the tracking dots horizontally and vertically.

  6. 6.

    Each color laser printer or multifunction printer had its unique distribution of the tracking dots inside the coded dots matrix (a repeated basic unit).

The defined repeated configuration of Xerox® color laser printers and their different distributions can be seen clearly in Figs. 7, 8 and 9 in RGB, CMYK, and Grayscale modes.

Form Figs. 7, 8 and 9 we could discriminate three vital regions: the time region that appeared from column two to column four, wherever column one is a constant and column five is a separator between regions. The second region exhibited the date of the printing process from column six to column eight. The third region exhibited a serial number of any model of the color laser printer of Xerox® brand.

The calculations of both the time and date obeyed the binary coded decimal (BCD) system with no decryption in any dot in these regions. But a serial number region had been coded with some decryption for specific numbers appeared in the actual serial number. The calculations direction stats from down to up.

As shown in Figs. 7, 8 and 9 above we found no information has exhibited for the time or date of the printing process. But the region of the serial number has appeared a constant for the same machine.

As seen from Figs. 10 and 11 we have noted that the date region could be calculated and visualized as viz.:

We have measured all distances of basic repeated units of the coded dots matrix embedded onto each color laser printout studied to get an insight of their configurations. Also, Adobe® Photoshop® CC 2018 has used with a custom preset after calibration. We have found all studied color laser printouts had constant distances that can summarize as viz.:

  1. 1.

    The distance between two adjacent dots inside the coded dots matrix = 0.1 cm.

  2. 2.

    The width of the basic unit of the coded dots matrix = 1.4 cm.

  3. 3.

    The length of the basic unit of the coded dots matrix = 0.7 cm.

  4. 4.

    The horizontal distance between two adjacent repeated basic units of the coded dots matrix in each row = 1.8 cm.

  5. 5.

    The vertical distance between two adjacent repeated basic units of the coded dots matrix in each column = 0.9 cm

We have visualized these distances and measurements as shown in Fig. 12.

Conclusion

A new preset of Adobe® Photoshop® CC 2018 has applied as an indirect and nondestructive technique on ninety-one color laser printout samples from twenty-two color laser machines (printers & multifunction printers) with the same and different models of Xerox® brand. We could successfully extract and measure all distance spaces around and inside the coded dots matrix corresponding to each color laser printout of Xerox® samples. Furthermore, we have figured out that all color laser printout samples studied from the same and different Xerox® brand models had the tracking dots with a defined configuration spread onto the color laser printouts in a regular grid of dots (pattern) – as row and column arrangements. The defined configuration of the basic unit of the tracking dots matrix (pattern) corresponding to the color laser of Xerox® brand named with “the coded dots matrix” pattern. All studied coded dots matrices composed of fifteen columns and eight rows in a regular grid pattern with a unique distribution of yellow tracking dots inside their patterns. The coded dots matrix (CDM) patterns studied exhibited mainly information about the machine serial number and model. Furthermore, according to the variation in the model sizes of the color laser printers of Xerox® brand, we found not all the coded dots matrix patterns exhibited the time and date for the printing process, but all multifunction printers only exhibited this feature. Therefore, we have introduced a new method could be applied to distinguish between two or more color laser Xerox® printouts of the same model with different serial numbers, and different models in digital forensic labs – with an accuracy ratio reached to 100%. This study is being a part of series studies that currently have been carrying out on different color laser brands.