TR2008-638, Dartmouth College, Computer Science

Methods

Digital Image Ballistics from JPEG Quantization: A Followup Study
Hany Farid Department of Computer Science Dartmouth College Hanover NH 03755

Abstract

The lossy JPEG compression scheme employs a quantization table that controls the amount of compression achieved. Because different cameras typically employ different tables, a comparison of an images quantization scheme to a database of known cameras affords a simple technique for conrming or denying an images source. This report describes the analysis of quantization tables extracted from 1,000,000 images downloaded from Flickr.com.

Introduction

Since the JPEG image format has emerged as a virtual standard, most cameras encode images in this format. This lossy compression scheme allows camera manufacturers to balance the amount of compression and the quality of their images. This tradeoff is embodied in the JPEG quantization table. In earlier work [1], we showed that the quantization table is fairly distinct across various cameras, and can therefore be used to conrm or deny the source of an image (see also [2]). This initial study examined one image taken from one of 204 cameras, but suffered from not considering the different quantization tables that are employed with varying camera quality and resolution settings. In this report, we expand on our earlier work by considering a much larger and more diverse collection of images. 1
Using the Flickr API, 1,000,000 images were downloaded from Flickr.com, a popular photo-sharing website. Since we are interested in the JPEG quantization table employed by different cameras, it was necessary to eliminate any images that had been edited or altered by any photo-editing software. To this end, only images tagged as original by Flickr were downloaded. Images were then eliminated if they were not 3-channel color images, and further eliminated if they had incomplete metadata, inconsistent modication and original dates, or a software metadata tag suggesting that the image had been edited by a photoediting software. This ltering eliminated 557,045 images, leaving 442,955 images. The camera make, model, resolution, and JPEG quantization table were extracted from each of the 442,955 images metadata. In order to further eliminate possible edited or altered images, only those entries with ve or more images having the same paired make, model, resolution, and quantization table were retained. This ltering eliminated 105,329 images, leaving 337,626 images for the nal analysis. The remaining 337,626 images spanned 10,153 different distinct pairings of camera make, model, resolution and quantization table (accounting for 48 different camera manufacturers, and 859 different camera models). It is from these 10,153 entries that the distinctness of the paired resolution and quantization table was analyzed. Both the resolution and quantization table were combined in order to provide a more rened criteria for narrowing the search criteria to identify the source camera.

Results

The 10,153 entries described in the previous section fall into equivalence classes of size 1 to 178, where each class has identical resolution and JPEG quantization table. The average class size is 20.13, with a standard deviation of 35.7 (a class of size 1 means that the paired values are unique). The median class size is 5. Of the 10,153 entries, 2,704 entries (26.6%) have a unique paired resolution and quantization table, and 37.2% have at most two matches, and 44.1% have at most three matches.

Figure 1: The distribution of equivalence class sizes for paired resolution and JPEG quantization (a class size of 1 denotes a unique pairing).
Shown in Figure 1 is the distribution of the size of these equivalence classes, and shown in Appendix A are the cameras belonging to the same equivalence class. In the majority of cases, it is cameras from the same manufacturer that share the same quantization table, although in several situations there is a signicant amount of overlap between cameras of different manufacturers. If we ignore resolution and partition only on the quantization tables, then the 10,153 entries fall into equivalence classes of size 1 to 899, where each class has an identical quantization table. The average class size is 273.6, with a standard deviation of 276.1. The median class size is 254, and 517 (5.1%) have a unique quantization table, and 8.3% have at most two matches, and 10.4% entries have at most three matches.
and by the Institute for Security Technology Studies at Dartmouth College under grants from the Bureau of Justice Assistance (2005-DD-BX-1091) and the U.S. Department of Homeland Security (2006-CS-001-000001). Points of view or opinions in this document are those of the author and do not represent the ofcial position or policies of the U.S. Department of Justice, the U.S. Department of Homeland Security, or any other sponsor.

References

[1] H. Farid. Digital image ballistics from JPEG quantization. Technical Report TR2006-583, Department of Computer Science, Dartmouth College, 2006. [2] J.D. Kornblum. Using JPEG quantization tables to identify imagery processed by software. Digital Investigation, 5:S21S25, 2008.

Discussion

While the JPEG quantization table is clearly not unique, it (paired with the image resolution) is reasonably effective at narrowing the source of an image to a single camera make and model or to a small set of possible cameras.

Appendix A

Each entry in the rst table corresponds to a camera with unique resolution and quantization table. Each entry in the second table corresponds to an equivalence class of identical resolution and Acknowledgments quantization table. The size of the equivalence class is in the rst column, and the camera make This work was supported by a gift from Adobe and model and resolution are in the second colSystems, Inc., a gift from Microsoft, Inc., a grant from the National Science Foundation (CNS-0708209), umn. 2