Handbook of Digital Forensics of Multimedia Data and Devices

List of Contributors xvii Foreword xix Preface xxi Acknowledgements xxvii PART ONE MULTIMEDIA EVIDENCE HANDLING 1 Digital Forensics Laboratories in Operation: How Are Multimedia Data and Devices Handled? 3 1.1 Introduction 3 1.2 Digital and Electronics Forensic Service, Metropolitan Police Service, UK 4 1.3 Digital Forensics Team (Including Affiliated AV Team), Surrey Police, UK 17 1.4 Shanghai Stars Digital Forensic Centre, Third Research Institute of China's Ministry of Public Security 23 1.5 Discussions 28 1.6 Summary 32 1.A Appendix: Questionnaires for Interviewing Surrey Police and Shanghai Stars Digital Forensic Centre 32 References 34 2 Standards and Best Practices in Digital and Multimedia Forensics 38 2.1 Introduction 38 2.2 Overview 39 2.3 Electronic Evidence and Digital Forensics 48 2.4 Multimedia Evidence and Multimedia Forensics 70 2.5 Digital Forensics Laboratory Accreditation 77 2.6 General Quality Assurance (Management) 79 2.7 Training, Education and Certification on Digital and Multimedia Forensics 81 2.8 Conclusions 84 Acknowledgements 86 References 86 3 A Machine Learning-Based Approach to Digital Triage 94 3.1 Introduction 94 3.2 Related Work on Digital Triage 96 3.3 A Machine Learning-Based Digital Triage Framework 100 3.4 A Child Pornography Exchange Case Study 110 3.5 Conclusion 128 3.6 Challenges and Future Directions for the Digital Forensics Community 128 Acknowledgements 130 References 130 4 Forensic Authentication of Digital Audio and Video Files 133 4.1 Introduction 133 4.2 Examination Requests and Submitted Evidence 134 4.3 Laboratory Space 138 4.4 Laboratory Software and Equipment 138 4.5 Audio/Video Authentication Examinations 147 4.6 Preparation of Work Notes and Laboratory Reports 171 4.7 Expert Testimony 172 4.8 Case Examples 173 4.9 Discussion 177 References 178 PART TWO DIGITAL EVIDENCE EXTRACTION 5 Photogrammetry in Digital Forensics 185 5.1 Introduction 185 5.2 Different Methods 188 5.3 Measurement Uncertainty 194 5.4 Case Studies 195 5.5 3D Modelling/Scenario Testing 212 5.6 Summary 217 References 217 6 Advanced Multimedia File Carving 219 6.1 Introduction 219 6.2 Digtal Data Storage 220 6.3 File Carving of Binary Data 225 6.4 Multimedia Data Structures 226 6.5 File Carving of Multimedia Data 232 6.6 Content Identification 241 6.7 File Carving Frameworks 253 6.8 Conclusions 264 Acknowledgements 265 References 265 7 On Forensic Use of Biometrics 270 7.1 Introduction 270 7.2 Biometrics Performance Metrics 273 7.3 Face: The Natural Means for Human Recognition 274 7.4 Ears as a Means of Forensic Identification 283 7.5 Conclusions 299 References 299 8 Multimedia Analytics for Image Collection Forensics 305 8.1 Introduction 305 8.2 Data and Tasks 308 8.3 Multimedia Analysis 309 8.4 Visual Analytics Processes 312 8.5 ChronoBrowser 313 8.6 MediaTable 320 8.7 An Example Scenario 323 8.8 Future Outlook 325 References 326 PART THREE MULTIMEDIA DEVICE AND SOURCE FORENSICS 9 Forensic Camera Model Identification 331 9.1 Introduction 331 9.2 Forensic Source Identification 333 9.3 Digital Camera Model Identification 337 9.4 Benchmarking Camera Model Identification Algorithms 339 9.5 Model-Specific Characteristics of Digital Camera Components 341 9.6 Black Box Camera Model Identification 351 9.7 Camera Model Identification in Open Sets 364 9.8 Model-Specific Characteristics in Device-Level Identification 366 9.9 Open Challenges Towards Practical Applications 368 References 370 10 Printer and Scanner Forensics 375 10.1 Introduction 375 10.2 Printer Forensics 379 10.3 Scanner Forensics 386 10.4 Photocopier Identification 389 10.5 Forgery Detection for Printed and Scanned Documents 391 10.6 Sample Algorithms with Case Studies 396 10.7 Open Problems and Challenges 406 10.8 Conclusions 408 Acknowledgements 408 References 408 11 Microphone Forensics 411 11.1 Introduction 411 11.2 Pattern Recognition for Microphone Forensics 414 11.3 Guidelines for Microphone Registration 421 11.4 Case Studies 423 11.5 Chapter Summary 435 Acknowledgements 436 References 437 12 Forensic Identification of Printed Documents 442 12.1 Introduction 442 12.2 Special Materials 449 12.3 Substrate Forensics 450 12.4 Print Forensics 455 12.5 Real World Example: Currency Protection 473 12.6 Summary and Ecosystem Considerations 475 References 478 PART FOUR MULTIMEDIA CONTENT FORENSICS 13 Digital Image Forensics with Statistical Analysis 483 13.1 Introduction 483 13.2 Detecting Region Duplication 488 13.3 Exposing Splicing Forgery 500 13.4 Case Studies 508 13.5 Other Applications 512 13.6 Summary 515 References 517 14 Camera-Based Image Forgery Detection 522 14.1 Introduction 522 14.2 Camera Structure 524 14.3 Camera-Based Forgery Detection Methods 535 14.4 Forgery Detection Based on PFA: A Case Study 548 14.5 Conclusion 564 References 565 15 Image and Video Processing History Recovery 572 15.1 Introduction 572 15.2 Coding Artefacts 573 15.3 Editing Artefacts 586 15.4 Estimation of Processing Parameters 590 15.5 Case Studies 601 15.6 Conclusions 605 References 607 16 Anti-Forensics of Multimedia Data and Countermeasures 612 16.1 Introduction 612 16.2 Anti-forensic Approaches Proposed in the Literature 613 16.3 Case Study: JPEG Image Forensics 623 16.4 Trade-off between Forensics and Anti-forensics 644 16.5 Conclusions 647 References 647 Index 653