How to Tell If an Image Has Been Altered

[christopher_o.]

<p>Hello,</p>

<p>I am new to these forums and had planned on joining up next week, but my current situation has ushered that a bit sooner.</p>

<p>I am currently involved in a court case where we are suing my former landlord for not returning our security deposit. In short, we took photos of the house when we moved in showing the condition of it and had them datestamped since the house was dirty and filled with stains, scratches, etc.</p>

<p>Now, since we submitted the photos to the court showing that the damage he is claiming was done by us was in fact a preexisting condition, he is saying that he will have someone come into court and testify that the date was superimposed. They are stating that the "pixelation pattern and colors are inconsistent while a shadowbox emerges around the date".</p>

<p>I am a photographer and know some things about editing, and can tell by my own eyes that there is no color inconsistencies and that the pixelation pattern is only because the image is low-res. I know when I took the photos and know that I did no such thing and he is simply trying to discredit the images since their validity means that we will receive double our security deposit. On top of that, the EXIF data shows when the photo was actually taken and that it corresponds with the date stamp. He owns a design firm so I'm guessing that he is just going to have one of his employees come in and say whatever he tells them to.</p>

<p>So my question is, can anyone provide some "advanced" knowledge or opinions on the attached photo and perhaps tell me how the photo is actually not edited?</p>

<p>Thank you for any help.<br>

Christopher</p><div></div>

[kyleweems]

<p>I have to say that there does appear to be a 'box' around the date.. however that isn't to say the camera doesn't normally display the date that way.</p>

<p>If that is the case, show other shots from the same camera where the date is displayed in that manner.</p>

<p>Otherwise, you'd have to pay a digital forensics expert to examine the image.</p>

<p>Kyle</p>

[photomark]

I too see some funny discolored pixels around the date. Hopefully this is a reproducible artifact of either the date imposition

or the compression. If so, I would be prepared to demonstrate it in front of the judge with a live shot—I don't know much

about real court cases, but if this was on TV you would be able to demonstrate this conclusively right after the landlord's

'expert' testifies that the date is faked maybe even using a just-produced photograph of the expert himself showing the

same discoloration. Good luck.

[christopher_o.]

<p>@ Mark and Kyle:</p>

<p>Thank you kindly for your responses. I see the boxes as well. In the full-res versions I have here, the boxes are not apparent, so it is due to compression since I had to size it down from 1mb to 80k for this posting. That makes sense as well since our lawyer sent low-res versions via email to his lawyer, which would produce the boxes as well.<br>

I just blew the full-res photos up to 100% and start to see a very small amount of artifacts, but nothing compared to the low-res version shown here. So my "educated" guess is that the camera produces some artifacts when it posts the date on the photo, and they become much worse when compressed.<br /> <br /> @ Mark specifically:</p>

<p>That is brilliant! Thank you. I will bring my laptop and camera to court and show how the photo taken two minutes ago produces the same artifact when resized. Or I can compare how both full-res images do not have them unless you blow it up to 100%, and that the amount of any apparent artifacts are identical when compared. Thanks Mark.</p>

[Hector Javkin]

<p>1. The authenticity of photographic evidence typically relies on the photographer testifying that the photograph represents what the photographer saw. Since you were the photographer and you are a party to the lawsuit, it's a bit harder for you.</p>

<p>2. I have testified as an expert witness for a few cases in voice identification. In the cases in which I was involved, experts had their credentials "qualified" by the court, away from the jury if was a jury trial. If the other side is bringing his employee, you can question his objectivity as well as his knowledge. He can be asked in the qualification process and, if the judge allows it, in the regular testimony. There are lots of phony "experts" out there, but a decent lawyer can get some thrown out. (After examining the evidence, I turn down cases if I think the side that wants to hire me is wrong, but I know people that don't. Good lawyers can sometimes get that to come out.)</p>

<p>3. If you still have that camera, and can show in court how it prints the date, possibly on a laptop screen, it can be better than showing printed or displayed photos of something prepared outside of court.</p>

<p>4. If you're in small claims, it might not pay to do this, but if not, discuss with your lawyer bringing your own expert if the other side is bringing one. At least in California, each side has to tell the other side in advance who it plans to bring.</p>

[kelly_flanigan1]

<p><img src="http://i4.photobucket.com/albums/y148/ektar/PNretouch/00Vd3W-215091684.jpg?t=1264727822" alt="" width="600" height="800" /></p>

[christopher_o.]

<p>@ Hector: <br /> <br /> Your advice is invaluable, especially on examining both his qualifications and his relationship to the landlord. I'll run by all your points to our lawyer, but I would assume that they all apply to our state as well as they seem very logical. I'm definitely going to bring the camera in and do a demonstration in court.<br /> <br /> @ Kelly:<br>

I see your point, but even I can tell that the last zero looks a bit off, especially on the inside-bottom. Additionally, the EXIF data would need to be manipulated as well reflecting the new date and - at least on my computer - it will tell what program (if any) was used to edit. If no program was used, the space will be blank.</p>

[Matt Laur]

<p>Note: regardless, Christopher, of whether you in anyway contradict yourself or head into a non-helpful area in this thread, remember that Google will have this thread indexed this evening, with your name attached to it. Tread carefully in public forums, when you're tied up in court.</p>

[Uhooru]

<p>Shouldn't be a problem, bring your camera, bring the exif data re the date to rebut his proposition, and then simply testify when you took the photo, and that it accurately depicts what you saw. that should lay sufficiant foundation. There are some books out about presenting digital evidence in court, google them, maybe go to your local law library. If it's small claims court, it should be let in. It seems the cost of an expert would be more than the recovery on the matter?</p>

<p>Good luck.</p>

[christopher_o.]

<p>@ Matt:</p>

<p>Thank you for the heads-up, but I have not said anything in here that he will not be aware of shortly. I do see your point about entering into the non-helpful areas, however. Thank you.</p>

<p>@ Barry:<br /> <br /> I will definitely look into those books about presenting digital evidence. I didn't even know they made those, but I suppose that there is a book out for everything these days!</p>

[derek_hofmann]

<p><a href="http://www.hackerfactor.com/blog/index.php?/archives/322-Body-By-Victoria.html">Here</a> is a good page on digital image forensics.</p>

[endre_st_lsvik]

<p>The "boxing" around the numbers are obvious JPEG compression artifacts. The reason for them appearing around the numbers, is that the number represent such a hard delimiting opposed to natural shading in an image. You'd get the same if you simply took a picture of such numbers written on a textured wall or whatever, and compressed it as hard. The same goes for that "bug" on one of the zeros.</p>

<p>http://en.wikipedia.org/wiki/Jpeg#Effects_of_JPEG_compression</p>

<p>The exif info doesn't sadly do jack - at least I'd discredit it. Somebody pointed out that the editingprogram would leave data about itself. That is absurd: I can just edit the file in a hex editor - I happen to be very confident in that one aspect, since I've personally made a JPEG/TIFF decoder (the Exif information inside a JPEG file is actually, strangely enough, embedded as a complete TIFF file inside it! That TIFF file is embedded in the APP1 segment of the file).</p>

<p>Also, if you have the higher resolution without the artifacts, why don't you use that instead?</p>

<p>The way to proof that the numbers are consistent with the artifacts, is to take some RAW file, stick those same numbers on it, then compress it to JPEG with hard compression. You'd get the same.</p>

<p>The problem is that any such file is just not proof at all. They are just bytes - I can make it by hand right here. I could have taking it with a recent high quality canon camera where I zoomed some lens to the correct width, stuck on the numbers, cropped and resized it, compressed it to the right compression ratio and with the same technique as that camera does, and then just taken another image that WAS taken around that time with that camera and ripped out the "data stream" of that and inserted my newly doctored picture. The date is really not a problem - I'd just change that in the Exif info. Or way more simply, if I still had the camera, just take a picture with the camera, setting the date back!</p>

<p>Exif and the on-image date should at least lend some credit, but it would not be a "proof" in any way.</p>

<p>The only way to get a proof, is if you'd get the files somehow actually datestamped, e.g. physically by putting the images on a CD or stick, put that in an envelope, tape it with "non-tamper-tape", and have it dated and signed by some official. (The same procedure is to establish copyright, I believe). You'd have to open it again in court with all the judges present - let the judge open it of course - after some guy told everone that this cannot be a faked.</p>

<p>HOWEVER: You'd have a really good case if somehow Google or/and Yahoo or/and Internet Archive had these pictures indexed some time around that date. So if you have put them online for some reason - go find some index of it!</p>

<p>The judge should use "common sense" - you found the place that disgusting, so you took that many pictures. It seems absurd that you'd go to this length to discredit the landlord. Does the landlord have other complaints? That might be helped by the "shocking proof" of taking an image in court.</p>

<p>He might also just be trying to scare you. </p>

<p>Finally, I just have to say: Poor you folks. I had that same shit happen to me in Calif. USA when I was there studying. Apparently all landlords there see the deposit as THEIR money. Here in Norway, you'd have to pretty much burn down the place, on purpose, before it was allowed to take any of the depoist money. You ALWAYS get your money back, unless you really have done some bad stuff to the place.</p>

 

[sarah_fox]

<p>Next time...</p>

<p>Print out the pics after you take them, and have the prints notarized at your bank.</p>

[christopher_o.]

<p>@ Endre:</p>

<p>Thank you very much for taking all that time to respond. I see your point, and your knowledge is obviously quite vast in this area - I didn't know EXIF data could be changed. <br /> <br /> I do have full-res versions of the photos showing almost non-existent artifacts which I will bring in. I used a compression setting in-camera (Postcard setting to be exact) since that was the only setting that allowed a datestamp, so there are minor artifacts present, but only when blown up to 100%. The artifacts are much more visible in the low-res version here which show that compression = artifacts.<br /> <br /> For future reference, that is a solid idea about having them stamped (or notarized like Sarah said). <br /> <br /> While it would take too long to explain, we do have proof documented through email which shows that the landlord blatantly lied, so that will help.<br>

In the end, it does come down to common sense. I am, however, going to demonstrate the camera in-court which I think is a solid idea and pretty much show that the artifacts come from the camera and compression, not by superimposing.<br /> <br /> Funny you should mention CA - that is not where we are, but we do know someone out there who said they see this all the time as well. People assume the deposit is theirs. Thankfully here there are additional damages against landlords who do that so in the end it will not be worth it.<br>

Thank you again for your high-quality reply! It was very informative.</p>

[kelly_flanigan1]

<p>Christopher; what does your computer say about the EXIF in the image I posted?</p>

[christopher_o.]

<p>@ Kelly:<br /> <br /> It looks like the EXIF data has been erased.</p>

[gene thornton]

<p>I have done extensive expert witness work regarding marine insurance claims, all photos of the damage are presented in a detailed type written report. They are then saved to a write only CD, often the owner is unhappy with the insurance companies decision and the case winds up in court.<br>

Then I as the marine surveyor end up as an expert witness be it for the insured or the insurance company. The CD is taken to court accompanied by an affidavit stating that the photographs have not been altered.<br>

Judges in the beginning of digital photography were sometimes skeptical, but that has changed over the years and usually without further question the photographs are accepted as evidence.</p>