Digital Image Metadata and Exif Files - Research Paper Example

? Digital Image Metadata and Exif files - Forensics Introduction The real world images are stored in the digital form on many types of electronic storage devices such as memory cards, computer hard disks, USB and CD/DVD. These images are captured through varieties of digital cameras and cam-recorders easily available in the market. Printed images are captured through different types of scanners. The information of digital image so captured or created is electronically represented in binary digits. There are two ways in which data of digital images are represented in the digital memory; raster images and vector images. (University of Reading, 2011) Data of raster images are represented in the form of a pixel which is the smallest part of a display screen. Each pixel represents the colour and its intensity. Raster is a display space of x and y grid for two dimension image and x, y and z coordinate for three dimension images. The raster images are difficult to modify without loosing any information as they are mapped directly to the raster space. The size of raster image files is usually far more than the size of vector image files. The most common types of raster images files include BMP, GIF, TIFF, JPEG and PNG. (Whatis.com?, 1997) Tagged Image File Format (TIFF) type of digital images contains complete information about the images and no data is lost when saved. It is generally referred as “lossless” format. Their sizes are too big to be suitable for delivery by web. (University of Reading, 2011) Joint Photographic Experts Group (JPEG) type of digital images compresses data when saved. It looses its data whenever any modification is done and therefore generally referred as “lossy” format. It is good for delivery of photographic images by web. (University of Reading, 2011) Graphical Interchange Format (GIF) type of digital images is used for icons and graphics having limited range of colours. It does not loose information when saved and therefore generally referred as “lossless” format. It is good only for some types of images and used mostly on internet. (University of Reading, 2011) Portable Network Graphics (PNG) type of digital images is added recently in graphics file types. It has better compression result and support true colours. It is high quality and small size digital image file. (University of Reading, 2011) Data of vector images on the other hand is represented by vector objects which are geometrical figures such as lines, circles, rectangles, curves and many more shapes of geometry. Scaling, transformation, resizing, and reshaping are accurately done on vector images as its data is based on mathematical instructions. The most common types of vector image files have extension of SVG. They are used in software that is dedicated towards drawing and illustration such as Adobe Flash, CorelDraw, Inkscape, ACD Canvas, etc. Figure 1 shows comparison between digital images of Raster and Vector types. (JISC Digital Media, 2009) Figure 1: Comparison of Raster Images and Vector Images (JISC Digital Media, 2009) Metadata Metadata is the digital information that describes structure and relationship amongst different contents of digital data files. Earlier databases stored metadata as headers of the actual data files. Metadata is stored in a separate database file generally referred as registry or repository. For example, Windows operating system have registry in which the structure of entire hardware, device drivers and actual data is stored. (Bargmeyer & Gillman) The simplest example of metadata is an index of a book which gives the name of the chapters in the book and page numbers where it is located. If an index is removed from the book, it becomes extremely difficult to find any chapter whenever some information is needed. Similarly, metadata helps in organizing, storing, processing, retrieving and displaying contents of a data file which is otherwise meaningless. Metadata adds meaning to a data file by interpreting its contents according to its context. Digital Image files did not have any metadata some fifteen years ago. However, today any digital image captured through a digital device contains metadata about the digital image which tells about how, when, where, what and who captured the digital image. Each digital image contains its metadata and moves with the image file whether it is downloaded, uploaded or copied from one place to another. Extent of metadata contained in a digital image file depends largely on the type of camera or any other electronic device used to capture the image and whether it has been transformed, modified or changed by any other equipment or image editing software like Photoshop, etc. (The Assurer, 2010) Exif Files Exchangeable image file (Exif) format files have digital image format based on the standard for digital still cameras set by Standard of Japan Electronics and Information Technology Industries Association. The image file format JPEG is used as compressed file and image file format TIFF is used as uncompressed file in the Exif file-recording. The specification of Exif image file includes definition of the version of the format, image data and its recording, tags (fields), and segments of JPEG marker. Figure 2 shows the image formats employed in Exif file based on the type of primary image data. (Technical Standardization Committee on AV & IT Storage Systems and Equipment, 2002) Figure 2: Image formats employed for structuring primary image data Figure 3 shows a complete structure about real image data file when saved digitally in a still camera. File is saved using TIFF file format specification. The first part of the file is a TIFF header which points to the first initial Image File Directory (0th IFD). Four of the tags of metadata created in primary image data points to four different pointers of the image file. “StripsOffset” points to the address of file where actual image data is saved. “Exif IFD Pointer” points to the address of file where information about Exif versions, date and time, etc is stored. “GPS IFD Pointer” points to the address of file where geographical location where picture is captured is stored. “Next IFD Pointer” points to the address of file where thumbnail metadata is stored which have tags for image width any many other attributes plus a pointer giving address of the file where thumbnail image data is stored. (Technical Standardization Committee on AV & IT Storage Systems and Equipment, 2002) Figure 3: Exif Image files Structure of Uncompressed Data It can be observed in Figure 3 that there are two main sections; the first being the “TIFF header” and second being the “Exif IFD header”. Both of these are metadata and provide valuable information about the image and its environment. Figure 4 shows TIFF header structure which has parent tags related to data structure of image, pointers to file addresses where various types of data are stored, characteristics of image data and other tags. (Technical Standardization Committee on AV & IT Storage Systems and Equipment, 2002) Figure 4: Structure of TIFF header used in an Exif data file Figure 5 shows Exif IFD structure which has parent tags related to Exif version, characteristics of image data, configuration of image, information of user, information of other related files, capturing date and time, conditions at picture-taking time and other tags. (Technical Standardization Committee on AV & IT Storage Systems and Equipment, 2002) Figure 5: Structure of Exif IFD in an image file The most important information in metadata of Exif IFD is about the Picture-Taking conditions as shown in Figure 6 which includes several tags that give detailed information about the exposure conditions of the object as well as of the camera from which it was captured. It is this information about the picture that play key role in the forensics analysis and determining many important aspects of an illegal activity. (Technical Standardization Committee on AV & IT Storage Systems and Equipment, 2002) Figure 6: Structure of Picture-Taking conditions (Technical Standardization Committee on AV & IT Storage Systems and Equipment, 2002) Identifying Location of Captured Image To identify any global location geographical data is required. Each and every location of the world is identified by its longitude, latitude, direction and degree. Digital images use the process of Geotagging in which all the important geographical information is saved in the Image file. (Wikipedia, 2011) In Exif Image file structure shown in Figure 3, “GPS IFD” is used as metadata for storing geographical information about the image. Figure 8 shows the contents stored in GPS IFD which is generally used to identify the location of any captured image. (Technical Standardization Committee on AV & IT Storage Systems and Equipment, 2002) Figure 8: Information stored in a GPS Tag Software like Google Map and Bing Map allow the users to find any global location by giving geographical information. Figure 9 shows how an apple phone device uses Google Map to directly locate the position of the selected picture if the GPS tag is stored in it. (Apple Inc, 2011) Figure 9: Identification of location of an Image File using Google Map Forensics The digital image files are analysed in forensics by way of identifying color space and classifying skin color. Color space contains three basic colors; red, green and blue commonly referred as RGB. The effect of luminance is reduced in color space by normalizing each color as under:- (Silva Eleuterio & Castro Polastro, 2010) Many methods are developed to classify pixels of skin-color using the color spaces that already exist. The Red, Green and Blue which are three basic colors are used to establish arithmetical relationship after normalizing them as per earlier arithmetical equation. The equation used to classify skin-color is as under:- (Silva Eleuterio & Castro Polastro, 2010) It can be observed that it is quite tedious to do so much comparison and calculation for each pixel. However many computer software has been developed to identify nudity in an image file using Exif file structure specially the metadata of Picture-Taking conditions. One of the most powerful tools used by forensics lab is named “NuDetective Forensic Tool”. Figure 7 gives complete description about main features of this tool and how it can help in searching digital images that have nudity or pornography in it. (Silva Eleuterio & Castro Polastro, 2010) Figure 7: Main features of the NuDetective Forensic Tool (Eleuterio & Polastro) References Apple Inc. (2011). Working with location information in places view. In Aperture 3 User Manual Retrieved from http://documentation.apple.com/en/aperture/usermanual/index.html Bargmeyer, B. E., & Gillman, D. W. (n.d.). Metadata standards and metadata registries: Overview. Retrieved from Bureau of Labor Statistics website: http://www.bls.gov.ore.pdf.st000010.pdf Eleuterio, P., & Polastro, M. (n.d.). Nudetective: Automatic detection of child and teen pornography at crime scenes. In Brazilian Federal Police (Ed.), Session 14.6 (p. 1). Retrieved from http://www.iafs2011.mj.pt/ORALS/Session_14.6.pdf JISC Digital Media. (2009). Introduction to the vector image format. In Creating new digital media Bristol, U.K.: Retrieved from http://www.jiscdigitalmedia.ac.uk/stillimages/advice/introduction-to-the-vector-image-format/ Silva Eleuterio, P. M., & Castro Polastro, M. (2010). Identification of high-resolution images of child and adolescent pornography at crime scenes. The International Journal of FORENSIC COMPUTER SCIENCE, 1, 49-59. Retrieved from http://www.IJoFCS.org The Assurer. (2010, SEPTEMBER 30). How dangerous is image file metadata? [Web log message]. Retrieved from https://theassurer.com/p/1367.html Technical Standardization Committee on AV & IT Storage Systems and Equipment. (2002). Exchangeable image file format for digital still cameras: Exif version 2.2. In JEITA CP-3451 Japan Electronics and Information Technology Industries Association. Retrieved from http://exif.org/Exif2-2.PDF Whatis.com? (1997). Raster graphics. In TechTarget Network (Ed.), DEFINITION: From Whatis.com? TechTarget.com. Retrieved from http://searchcio-midmarket.techtarget.com/definition/raster-graphics Wikipedia. (2011). Exchangeable image file format. In Wikimedia Foundation Inc. Retrieved from http://en.wikipedia.org/wiki/EXIF Wikipedia. (2011). Metadata. In Wikimedia Foundation Inc. Retrieved from http://en.wikipedia.org/wiki/Metadata University of Reading. (2011). Image formats. In Using digital images in teaching and learning U.K.: University of Reading. Retrieved from http://www.reading.ac.uk/internal/using-images/UnderstandingDigitalImages/img-imageformats.aspx Read More