Image forensics plays an integral role in online investigations. Providing investigators with the ability to analyse media and uncover previously inaccessible insights, these tools are only growing more and more important in an age of AI-generated imagery and rising new media trends.
But what does image forensics involve? Why does it matter? And what’s next for the image forensics landscape?
Below, we’re diving into all of these questions and more, bringing you a full guide to image forensics while exploring an example of the processes that make them possible.
First things first, what is image forensics?
Image forensics involves the analysis and examination of digital images to uncover a wide range of useful information. This could include information about the image’s origin, authenticity, any potential manipulations or alterations, and more.
Often, an investigator will turn to the use of image forensics with three objectives in mind:
- Manipulation analysis
- Metadata analysis
- Content analysis
Ongoing innovations in image generation and manipulation tools like Midjourney, Dall-E, and Adobe Photoshop / Firefly have made it easier than ever before to manipulate existing images beyond recognition, or to create entirely new and photorealistic images. For investigators, this creates a big challenge.
Firstly, offenders can confidently claim that an image is fake, and that it was manipulated to include them. Without the correct tools and processes available, these claims can be difficult to overcome with certainty. Image forensics can help, enabling investigators to analyse specific images and determine if they are the original, or if they have been manipulated – as well as providing details on how.
Investigators may also end up spending valuable time pursuing false lines of enquiry based on generated or manipulated images. With tools only getting more realistic, the use of image forensic tools will be extremely helpful in determining image authenticity by indicating a source. To learn more about the challenges of AI-generated imagery, read our full blog here.
Metadata analysis is one of the most significant components in any image forensics research. It involves using specialised tools like CameraForensics, Griffeye, or Bluebear, to explore the hidden data that sits behind an image. This could be lens type, camera model, username, GPS, serial numbers, and more.
Once this metadata is revealed, users can filter wider databases against this to discover other related imagery that may contain additional information, context, or identifiers.
Content analysis involves exploring the specific content of imagery, rather than analysing the metadata behind imagery. Here, experts examine the content of an image to detect hidden information, inconsistencies, or any other insights that may forward their research.
Many of Bellingcat’s investigations make effective use of content analysis to aid their online research. To see this in action, explore the example below, which saw image forensics being applied by Bellingcat investigators to debunk imagery of Ukrainian soldiers harassing women.
Exploring image forensics in action with Bellingcat
Investigative journalists, Bellingcat, set out to explore a dashcam video captured on March 24th that was circulating pro-Russian forums. It depicted supposed Ukrainian soldiers harassing a woman at a traffic stop, firing their guns into the air and verbally abusing a mother in front of her child. They set out to answer two questions:
- What was the full story?
- Were the two soldiers Ukrainian?
Collaborating with online geolocation specialists, Bellingcat were able to identify and link the imagery to a specific road by comparing a user-submitted video to the March 24th dashcam footage.
The March 24th dashcam footage showing specific tree branches and features