Wednesday, October 10, 2007

Forensics: Reversing digital image masking

Interpol has released pictures of a suspected pedophile who had posted incriminating pictures of himself on the Internet.  His face was masked in the images using a standard Photoshop filter but Interpol's forensic unit was able to reverse the effect to restore those portions of the images.  A news report about the case can be found here.  

In filtering terminology, this can be thought of as "image restoration", i.e. the restoration of an image to its condition before the addition of "noise". In this case, the noise was an intentional blurring or smearing of the image pixels by twirling.  It appears that the particular Photoshop filter in question did not alter the pixel values (at least significantly but possibly not at all).  Instead, it simply moved the pixels' locations.  

To reverse the effect required figuring out where the correct pixel locations should be.  In general, this process is known as image deconvolution.   Deconvolution can be done completely blind (where the filtering algorithm is operating "in the dark" and has to estimate the pixel relocation parameters automatically) but works best when there is a priori information (i.e. where helpful information is known "prior" to the filtering).  

Image deconvolution has been used in astronomy for some years now to reverse the effects of smearing by Earth's atmosphere and motion of the telescope optics, which make the images of the deep space and other objects appear less sharp.  In the last eight years or so, deconvolution to deblur images suffering from focus and motion blur has been taken up by the image forensics community, thanks in part to my own efforts (Aside: I hope I don't break my arm off patting myself on the back).

In this case, the Photoshop filter is well known and available, and therefore, once the particular filter was identified, it made it possible to identify how it behaved in order to help in the deconvolution (as a priori information).  Very elegant image forensic work indeed.

4 comments:

Anonymous said...

An informative post Keith. Factual and transparent. Photoshop software was subject to favourable comment at a recent conference in Pittburgh, USA. Are you able to advise if it incorporates an auditing trail for UK evedential procedures?.

Anonymous said...

An informative post Keith. Factual and transparent. Photoshop software was subject to favourable comment at a recent conference in Pittburgh, USA. Are you able to advise if it incorporates an auditing trail for UK evedential procedures?.

Keith said...

Hi Andy,
thanks for the compliment. Adobe has incorporated at form of auditing or history tracking in the recent version of Photoshop CS. Adobe's website has a technical article (PDF) on it (see starting at the bottom of page 3). This history, when combined with other standard and proper procedures, should be sufficient for any Western court system.

One thing I like about Adobe's implementation is that it offers the option for saving the history off in a text file, which I advocate doing because the records will need to be archived for twenty years or more in most cases, which is a long time in the information technology world and standards, products, technology, and companies will all change significantly in that time. Despite these things, the evidence still needs to be readable if the case gets called back to court.

As a closing comment, many mass commercial auditing tools end up actually being optimized and implemented more for the mass users. What this usually means for us niche user, forensic types is that these tools end up being more useful for repeating the same process on bunches of images, which a commercial photographer needs, rather than repeating the restoration and enhancement process in a courtroom situation. As we are such a small customer base for these big companies, it means that we have to accept what we get and then figure out how to make it work in an evidential environment. Such is our lot in life! What it boils down to is this - all labs need to make sure that the history contains the information that is required and if it doesn't then establish procedures to augment the information properly.

Best Regards,
Keith

Anonymous said...

Informative post.Keep on posting such good post.

Regards,
image clipping