Identifying Tampered Images

Summary

The video script introduces viewers to methods for detecting tampered images, a critical skill in open source intelligence investigations. It outlines common manipulation techniques such as cloning, resizing, and adding elements to images. The script demonstrates the use of specialized tools like forensically and the nvid browser extension for Chrome to perform error level analysis and noise analysis on images. By analyzing shadows, lighting, and pixel demarcation, these tools can reveal discrepancies, indicating tampering. The video encourages practice and awareness of potential false positives, emphasizing the importance of image forensics in fields like politics and activism.

Takeaways

• 🔍 Importance of image analysis in open source investigations.
• 🖼️ Identifying image tampering is crucial for the integrity of an investigation.
• 📸 Common tampering methods include cloning, resizing, replacing faces, and removing objects.
• 🧩 Error level analysis can detect cloned sections within an image.
• 🌐 Using tools like Forensically and NVIDIA Browser Extensions for Chrome for image analysis.
• 🔊 Noise analysis helps identify foreign elements in an image.
• 🖼️ Original images can be compared to tampered ones to spot discrepancies.
• 🏞️ Examples provided in the script demonstrate how to detect alterations in images.
• 🔍 Zooming in can reveal clear demarcation lines between colors indicating foreign elements.
• 📈 Practicing with different tools is encouraged to improve image analysis skills.
• 👥 Joining online communities can provide further learning in cybersecurity and image analysis.

Q & A

What is the main topic of the video?

The main topic of the video is how to identify tampered images during an investigation.

Why is it important to determine if an image has been tampered with?

It is important because the authenticity of an image can sometimes direct the course of the entire investigation, affecting the outcome and credibility of the findings.

What are some possible ways an image may have been tampered with?

An image may be tampered with by cloning and resizing parts, replacing faces, removing sections, altering lighting, or making minor corrections like removing blemishes or objects.

What is the first tool introduced in the video for image analysis?

The first tool introduced is error level analysis, which helps identify cloned sections within an image.

How does the noise analysis tool work?

The noise analysis tool identifies foreign elements or noise in an image that are not part of the original, highlighting them as distinct spots.

What does the clone detection tool do?

The clone detection tool identifies identical regions in an image by joining them together with lines, revealing any cloned parts.

How can you tell if a foreign element has been added to an image?

You can use a magnifier tool to zoom into the area where the element is suspected to be added. A clear line of demarcation between two adjacent colors indicates that a foreign element has been added.

What should you do if you need to practice identifying tampered images?

You can download data sets of tampered images from various websites to practice and use different tools to enhance your skills.

What is recommended for those who want to learn more about image forensics and other cybersecurity skills?

They are encouraged to join an online community of students on the video's website to register for a free account and gain access to more learning materials.

How can viewers engage with the content if they find it helpful?

Viewers can hit like, share the video on social media, and subscribe to the YouTube channel for more similar content.

Outlines

00:00

🕵️‍♀️ Image Tampering Identification Techniques

This paragraph introduces the topic of identifying tampered images during an investigation. Erica explains the importance of detecting alterations in images as it can influence the entire investigation's direction. She references a previous video on analyzing images for open source intelligence and suggests using special tools to process and analyze images for signs of tampering. The paragraph outlines various ways an image might be manipulated, such as cloning, resizing, replacing faces, removing objects, or altering lighting and shadows. Erica then demonstrates using tools like error level analysis and noise analysis to identify cloned sections and foreign elements in images, emphasizing the significance of these techniques in investigations.

05:02

🔍 Advanced Image Analysis Tools and Their Applications

In this paragraph, the focus is on advanced tools and techniques used for a deeper analysis of images suspected to be tampered with. Erica discusses the use of the forensically tool, which comprises multiple analysis tools, and the nvid browser extension for Chrome. She explains how these tools can help identify cloned sections, noise, and foreign elements in an image. The paragraph provides examples of how error level analysis and noise analysis can reveal discrepancies in images, such as added objects or edited out characters. It also touches on the use of clone detection and magnification tools to detect and confirm alterations in images. Erica encourages practice and highlights the value of these skills in fields like politics and activism, where tampered images are commonly encountered.

Keywords

💡Image Tampering

Image tampering refers to the process of altering or modifying an image in a way that changes its original content. In the context of the video, it is crucial to identify tampered images during an investigation as it can affect the direction and outcome of the entire inquiry. The video provides examples of tampered images, such as a bird added to a picture or the removal of a boatman from an image, to illustrate how alterations can be detected.

💡Forensic Analysis

Forensic analysis in the context of the video refers to the scientific examination of digital images to determine their authenticity. It involves using specialized tools and techniques to detect any signs of image manipulation. The video emphasizes the importance of forensic analysis in investigations, especially when dealing with open-source intelligence, and provides a walkthrough of using specific tools for this purpose.

💡Error Level Analysis

Error Level Analysis (ELA) is a technique used in digital forensics to identify areas of an image that have been compressed or altered multiple times. A higher error level indicates that a section of the image has been modified or cloned from another part of the image. In the video, ELA is used to detect the cloned bird in the image, as it shows a distinct bright color in the analysis result.

💡Noise Analysis

Noise analysis is a method used to detect foreign elements or 'noise' in an image that are not part of the original content. This tool identifies distinct spots or differences in the image that may indicate tampering or addition of elements. In the video, noise analysis is used to identify the addition of a distinct spot in the middle of an image, suggesting that the image has been altered.

💡Clone Detection

Clone detection is a process that identifies identical or very similar regions within an image that may suggest duplication or replication of parts. This technique is useful in detecting tampering where a section of the image is copied and pasted over another area. The video illustrates the use of clone detection by showing how lines connect cloned regions, revealing that the tree on the right in one image is a clone of the tree on the left.

💡JPEG Quality Slider

The JPEG quality slider is a tool that adjusts the level of detail and compression in a JPEG image. In the video, it is used to increase the image quality to 99, which helps to highlight areas of the image that have been cloned or altered. The higher quality setting makes the outline of the cloned bird more noticeable, aiding in the identification of tampering.

💡Lighting Consistency

Lighting consistency refers to the uniformity of lighting across different parts of an image. In the context of image tampering, if the lighting on a specific object appears different from the rest of the image, it may indicate that the object has been manipulated or added later. The video emphasizes the importance of observing differences in shadows for all objects in the image as a clue to tampering.

💡Digital Forensics

Digital Forensics is the field dedicated to the recovery and investigation of material found in digital devices. It involves the use of various tools and techniques to analyze and draw conclusions from digital data. In the video, digital forensics tools are used to analyze images and determine if they have been tampered with, which is a crucial skill in open-source intelligence gathering and investigations.

💡Open-Source Intelligence

Open-Source Intelligence (OSINT) is the practice of gathering information from publicly available sources to be used in intelligence context. In the video, the process of analyzing images for OSINT is discussed, highlighting the importance of verifying the authenticity of images found in public domains to ensure the reliability of the intelligence gathered.

💡False Positives

False positives occur when a diagnostic test or analysis incorrectly identifies a benign condition or element as harmful or malicious. In image analysis, a false positive might be when a tool indicates an area of an image as tampered when, in fact, it is not. The video mentions that investigators may encounter false positives and that a high level of analysis or expertise may be required to confirm the authenticity of an image.

💡Image Authentication

Image authentication is the process of verifying the integrity and origin of an image to confirm that it has not been altered or manipulated. This is a critical aspect of investigations, especially in fields like politics and activism, where the credibility of visual evidence can have significant implications. The video provides techniques and tools for image authentication to ensure that the images being analyzed are genuine and have not been tampered with.

Highlights

The video demonstrates how to identify tampered images, which is crucial in open source intelligence investigations.

Tampered images may have cloned, resized parts, or faces replaced with others.

Images can be modified to mask the disappearance of a section or to alter the lighting on a specific object.

Error level analysis is a tool to identify cloned sections within an image.

The nVid browser extension for Chrome performs a deeper analysis on target images.

Noise analysis can detect foreign elements in an image that are not part of the original.

Original images can be compared with tampered ones to confirm alterations.

Clone detection tool identifies identical regions in an image that may indicate editing.

Zooming into an image can reveal a clear line of demarcation between adjacent colors, indicating foreign elements.

Practicing with different tools is encouraged to improve image analysis skills.

False positives may occur during investigations, and image forensics experts can be consulted for deeper analysis.

Tampered images are commonly encountered in fields like politics and activism.

The video provides valuable insights for those in the field of cyber security and open source intelligence.

The presenter, Erica, invites viewers to join an online community for learning cyber security skills.

The video concludes with a call to action to like, share, and subscribe for more content on image analysis.

Transcripts

[Music]

hi there welcome to mcsi my name is

Erica in this video I will demonstrate

how you can identify tampered images

during an awesome investigation

have you watched the video on our

Channel where I introduce you to

analyzing images for open source

intelligence

if not you can find the link to it in

the description box below

during an Austin investigation it is

highly likely that you would analyze

images

some of those images may have been

modified or altered in some way

determining whether an image has been

tampered with or not is crucial as it

sometimes directs the course of the

entire investigation

first let us talk about the possible

ways in which an image may have been

tampered with a part of the image may be

cloned resized and placed within the

same image

part of another image may be placed on

the target image for example replacing

the face of one person in the image with

another person's face

a part of the image may have been

removed the image would be modified to

Mask The Disappearance of a section

the lighting on a specific object may

appear to be different from the rest of

the image make sure to observe the

differences in Shadows for all objects

in the image

minor corrections may have been made to

the Target image this is typically in

the form of removing blemishes or

removing articles like bags that the

target is holding in the picture

[Music]

now that you have an idea about the

possible ways in which an image may have

been tampered with let us utilize

special tools to process some pictures

this is the first image that we will

analyze

at first glance nothing appears out of

the ordinary

we will use this image analysis tool

called forensically to analyze the image

this tool is made up of multiple other

tools to perform various types of

analysis on the target image

the first tool we will use is error

level analysis if any sections of the

image are clones that is one section has

been copy formed this image or another

one this tool will help us identify it

now we will move the jpeg quality slider

all the way to 99.

we can see that the outline of this bird

on the top right stands out from the

rest of the image

when any section of the image has been

cloned from another the error level

analysis tool will highlight it with a

bright color

let's process the same image using the

nvid browser extension for Chrome

navigate to the image forensic section

and upload the target image for analysis

[Music]

this tool performs a deeper analysis on

the target image

we can see that the section where the

bird exists on the top right appears

extremely bright

[Music]

now let's compare the tampered image

with the original one

[Music]

we can see that the bird on the top

right has been added later on our image

analysis tools helped hypothesize and

confirm that we are dealing with a

tampered image

let's try another one

this image appears to be of a water body

however you can observe two shadows in

the middle

[Music]

let's use forensically to observe if

this image has been tampered with

this time we will use the noise analysis

tool when an image contains foreign

elements that are not part of the

original image like cloned portions then

the image is said to have noise

if noise or foreign elements are

detected in an image the noise analysis

tool would identify it as distinct spots

on the image

you can also move the slider to view the

noise in the image this image appears to

have a distinct spot in the middle

nvid has also identified that the image

contains a spot in the center

it appears that this image has been

tampered with

let's take a look at the original image

The Boatman in the middle has been

edited out of the image

now I will show you the original image

in forensically

when the noise analysis tool is used

against it observe how the original

image appears there are no abnormal

spots in the image you can follow the

outline of the characters

If You observe noise in an image it is

highly likely that the image has been

tampered with

let's try another one

this appears to be an entrance to a

rock-like structure

when error level analysis is performed

there seems to be a triangle above the

doorway

a preliminary analysis with the noise

analysis tool does not indicate anything

odd

foreign

we can see the same spot above the

doorway

it is possible that the image had been

edited

here is the original image

there had been a triangle above the

doorway other sections of the image may

have been used to cover up the triangle

section

our image analysis tools picked up this

change

[Music]

let's find out if this image had been

tampered with

we will run the Clone detection tool

this tool takes some time to complete

its analysis

identical regions in an image are joined

together by lines

we can see that the two trees visible in

front are clones of each other

here is the original image

the tree on the right is the cloned one

now consider this image

it is quite evident that the yellow line

here has been added into the image it is

not part of the original one

we will use the magnifier tool to hover

over the image

now we are zooming into the section

where the line coincides with the sky

we can see a clear line of demarcation

between the two colors yellow and blue

however between elements of the same

image even in the presence of two

different colors that are adjacent to

each other one color would blend into

the other there is no clear line of

demarcation

only when external elements have been

added to an image you can observe a

separate line when you zoom into the

image

if you suspect that foreign elements

have been added to the Target image you

can zoom into that section to observe

how the pixels of two adjacent colors

exist

you can also adjust the level of

magnification

you can download data sets of tampered

images from different websites to

practice identifying tampered images

I encourage you to practice using

different tools

bear in mind you may also encounter

false positives

during an investigation the Austin

professional typically performs a high

level analysis on the target image if

deeper analysis is required an image

forensics expert can be called in

when conducting Austin investigations on

Targets in fields like politics and

activism you would encounter tampered

images on a regular basis

I hope you have a good idea now about

how tampered images can be identified

if you like this video please hit like

and share this video on social media

don't forget to subscribe to our YouTube

channel to receive more videos like this

one

join our online community of students

learning useful cyber security skills if

you haven't already to register for a

free account right away go to our

website

happy learning and see you soon

[Music]