C:\MVH\Ideas_toLearn_Image_Edited_Or_Not.

txt Saturday, September 06, 2014 1:23 AM

Mission: Come up with ideas to learn if the image file is edited or not. These ideas should
help you to start the testing for knowing if the image is edited or not.
Tester: Ravisuriya
Coverage Areas
-----------------
Image File Extension
Extension of file
Extension info in header
Change of File Extension
Header Info Unchanged
Image File Size
Header Write Blocked
File Size Unchanged
Image File Identifier
File Type Identifier
JFIF
HTTP Request and Response
Media Type Content
Image File Machine Representation
Little Endian
Big Endian
Appearance on different machine architecture
Image File Markers
JPEG Markers Identification
SOI
EOF
Image Edited Info
Processing Software
Data Truncation or Corruption in SOF
EXIF version and Details
Confidential
Unedited Information Identifier
Edited Information Identifier
Pixel Density Information
Zoom In
Pixel Density Unchanged
Image Detail
Zoom Out
Pixel Density Unchanged
Image Detail
EXIF Tag
IFD
SubIFD
App layers
Tag Details and Values
Markers
Data Dump
-1-
C:\MVH\Ideas_toLearn_Image_Edited_Or_Not.txt Saturday, September 06, 2014 1:23 AM
Edited Image
Corrupted
Truncated
Processed and Corrected
Image Attribute | Rastor
Image Attribute | Vector
Image Attribute | Binary
Image Attribute | True Color
Image Attribute | Pseudo
Image Attribute | Grey Scale
Image Surface | Pixel Density
Image Surface | Pixel Intensity
Image Surface | Grey Scale | Pixel Intensity
Grey Scale | Image Pixel Intensity Pattern
True Color | Image Pixel Intensity Pattern
Grey Scale | Image Surface Study
True Color | Image Surface Study
Grey Scale | Image Segmentation
True Color | Image Segmentation
Grey Scale | Image Edges
True Color | Image Edges
Grey Scale | Varied Brightness and Contrast
True Color | Varied Brightness and Contrast
Image Segmentation | Pixel Line
Image Morphology | Grey Scale
Image Morphology | Inner Boundary Pixel Pattern
Image Morphology | Outer Boundary Pixel Pattern
Ideas
-----------
>> SET-1 <<
1. Does the file belong to image family? The file belongs to the image family?
1.1 Identify the type of the file.
2. Changing the file extension will it alter the image file header?
2.1 Changing the extension of the image file will not have impact header properties
indicating the file type.
3. Does the image header indicates the appropriate identifier on change of file extension?
3.1 The image identifier will remain JFIF for JPEG/JPG image
3.2 The image identifier will show media type as image/jpeg in HTTP request and response
for media type
3.3 The image identifier will show GIFf, BMPf, PNGf, TFIF for different image file formats.
3.4 The HTTP header might scan for image header and it reads from file extension and places
it in the request/response query.
3.4.1 This test will fail, if tester is focused only on this cross test.
3.5 The Server might scan for image header content and just look for the file extension type.
3.5.1 If allowed to upload such files, it might result in non-lossy picture, high
-2-
C:\MVH\Ideas_toLearn_Image_Edited_Or_Not.txt Saturday, September 06, 2014 1:23 AM
resolution picture on server whose intention is to reduce consumption space.
3.5.2 The header remains same, but rendering of this image needs to be evaluated on
different machine architecture i.e. little endian and big endian.
3.6 Change in the file extension will not change the size of the file as it cannot write
into the image header information.
4. Does the image file have its respective markers in place?
4.1 JPEG will start SOI and end with EOI markers.
4.2 Evaluate each markers carefully to see the segment analysis of the image for edited or
not detail.
5. Do you know the EXIF version and associated problem with it?
5.1 Associate the problems with each EXIF version. Assess how it affects your image.
6. What is the Pixel Density of the image file?
6.1 The JPEG shows the difference of pixel if there is a drastic change in surface texture.
This can tell image if
6.1.1 it is edited;
6.1.2 compressed to an extent it could identify the beside pixel information -- this
helps in studying the object captured;
6.1.3 is it edited with hack to rearrange the pixel information by sparsely
distributing in captured format.
7. Does the image as Thumbnail preview facility built in?
7.1 Though the OS renders the images in different sizes of icon, image comes with Thumbnail
feature. The image is processed with Thumbnail identification.
8. Does the image have all details of Image File Directory?
8.1 The computer screen captured image will not have details of Tag Name SubfileType.
8.2 The SubfileType tag can appear for an image being captured by Camera and shown on
monitor screen. Evaluate how the image is being captured here with tag names and values.
8.3 Gather as much details of IDF0 i.e. Image Directory File 0 information to know the
source of image and its particulars.
8.4 Screen Captured image might not have all these details or IDF0's Tag Names. This is an
useful indication and info for building further segmentation and morphology tests on the
image.
9. Is image processed or it is a raw captured snap?
9.1 Identify the IDF0 tag Software (in JFIF EXIF v1.1) to know if it is edited.
9.2 Identify the value of the Software used for processing.
9.3 Once the image is opened in the processing software the image's exif details will be
edited with processing software name.
9.3.1 Though no changes made to the image's pixel details, it will have processing
software name. Hence it needs analysis to know if the image is edited or not.
9.3.2 Assess the different Application Layers of the image which will represented as
APPx. Where x is the different layers of image information.
10. The image file is not expanded. How do I study the first details to know image dimension?
10.1 Identify the image width.
10.2 Identify the image height.
10.3 Open the image file in image viewer. Zoom it and recapture it on screen. Study the
image width and height for the new image. Analyze if the pixel density and image's height &
width changes. This gives the information on how the image looks in various view mode.
10.3.1 Different machine architecture.
10.3.2 Time duration to construct the image information on screen.
10.3.3 Differences in intensity of brightness and contrast of screen.
11. Does the image know its orientation?
11.1 This tells if the image was shot in what mode.
11.1.1 If captured from computer screen, it remains to be Horizontal.
11.1.2 The Start of Frame tag information, will have image shot orientation information.
11.1.2.1 It needs detail analysis of how to compare the Digital Camera Capture
-3-
C:\MVH\Ideas_toLearn_Image_Edited_Or_Not.txt Saturday, September 06, 2014 1:23 AM
image and the image captured on computer screen.
12. Does the image have unsafe tags ?
12.1 The JPEG can be reconstructed with below tags. Identify if these tag and its values
are not available in EXIF information.
12.1.1 IFD0:YCbCrPositioning
12.1.2 IFD0:YCbCrCoefficients
12.1.3 IFD0:TransferFunction
12.1.4 ExifIFD:ComponentsConfiguration
12.1.5 ExifIFD:CompressedBitsPerPixel
12.1.6 InteropIFD:InteropIndex
12.1.7 InteropIFD:InteropVersion
12.1.8 InteropIFD:RelatedImageWidth
12.1.9 InteropIFD:RelatedImageHeight
13. That image data dump is not truncated or corrupted.
13.1 The image data in SOS structure needs to be analysed by Scanner.
14. The confidential or sensitive data are not written into exif details of the image.
>> SET-2 <<
1. What type of image it is in storing the image information?
1.1 Rastor image
1.1.1 Assess the properties to know the rastor attributes.
1.1.1.1 Enlarge or Zoom Out the image. See if the image loses its visual
information as it does not have resolution.
1.2 Vector image
1.2.1 Assess the properties to know the vector attributes.
1.2.1.1 Enlarge or Zoom out the image. See if the image loses its visual
information. Identify the threshold where visual data is unreadable. Compare the
observation with Vector image. The image which has higher threshold in losing its
visual data will the vector image and used in multimedia graphics content. JPEG
falls under this category.
2. How the color is stored in this image extension type? Does the image header has any
information of it?
2.1 Binary Image
Assess the context of the image and its Tags to know about it. Identify how the pixel
information is stored with size details.
2.2 True Image
Assess the content of the image and its Tags to know about it. See the elements of RGB
and evaluate it. JPEG falls under this category in usual cases.
2.3 Pseudo Image
Assess the content of the image and its Tags to know about it. Evaluate knowing are
there colors which is not being identified by visual perception.
2.4 Grey Scale image
Assess the content of the image and its Tags to know the size of pixel storation
mechanism.
3. Pixel Density information has to be identified quickly to locate the surface learning.
3.1 Change the True Color image to Grey Scale image.
3.1.1 I use this technique to see the spread of pixel density of true color with
minimal and learnable color data sets.
-4-
C:\MVH\Ideas_toLearn_Image_Edited_Or_Not.txt Saturday, September 06, 2014 1:23 AM
3.1.1.1 Grey Scale uses 256 bits color information which can be mostly
differentiated by human eyes.
3.1.1.2 Try the same reading with True Color image. It covers over 16 million pixel
luminance information. Evaluate this information with 256 bit grey scale information.
3.2 Recognize the Pattern where the Pixel Density and Intensity is concentrated and
diminished in the Grey Scale Image.
3.2.1 Use the different brightness and contrast of the screen to see the minute
patterns existence or breakage.
3.3 Cover each surface which looks unusual in Grey Scale mode.
3.3.1 In True Color mode see if these areas are unusual with any trial of edition.
3.3.1.1 Study the surrounding areas pixel intensity and density information in grey
scale mode. Recognize if it matches in the visual intensity of black or white of
the neighbour area. Locate the surface areas which are differing in coloring and
texture information. This needs further study of DQT.
4. Pick out the region of interest from the visuals of Grey Scale image observation. That is,
locate the areas which is noticed as edited or added upon the actual image.
4.1 Identify the discontinuities in image visuals
4.1.1 Points
4.1.1.1 The point grey scale will be different from background in similar looking
background.
4.1.1.2 Identify the pattern of such similar points in the region of interest.
4.1.1.3 This formulates the broken or edited image possibly.
4.1.2 Edges
4.1.2.1 Look for the outline of the objects in the Grey Scale mode.
4.1.2.2 The change come in form of discontinued in surface connectivity; change in
properties of edges such as intensity and density of pixel; light variation in the
intersections. This gives the indication of edition or lost data in image file.
4.1.2.3 Identify the pattern of edge detection
4.1.2.3.1 Step Edge which shows the adrupt change in pixel intensity.
4.1.2.3.2 Ramp Edge which shows the gradual change in pixel intensity.
4.1.2.3.3 Spike Edge which shows the quick change in pixel intensity between
its pixel information of grey scale monitoring.
4.1.2.3.4 Roof Edge which is not an instantaneous within pixel information.
4.1.2.4 Recognize such patterns of Edges. It gives the area and crop section
probably made around it.
4.1.3 Lines
4.1.3.1 Increase and reduce the brightness of the grey scale image.
4.1.3.1.1 Study the image diminishing and appearing pattern.
4.1.3.1.2 It gives the information if any area surrounding it has been cropped
or edited. Or the line is disturbed by added image on it which does not appear
to be a line.
4.1.3.2 Study the patterns in the region of interest.
4.2 Study the differences of image in surrounding of unusual noticed with points, edges,
and lines. It gives the information about continuity or discontinuity. Possibly this can
make the image's SOF area to show the truncated or corrupted image data.
5. Identify the image areas which looks to be added or changed.
5.1 Identify the boundary of the image in grey scale format.
5.1.1 Increase the brightness and contrast of the image.
5.1.1.1 Identify the boundaries in each variation. See if it forms the outer and inner
-5-
C:\MVH\Ideas_toLearn_Image_Edited_Or_Not.txt Saturday, September 06, 2014 1:23 AM
surface boundaries.
5.2 Locate the broken or invisible boundaries.
5.2.1 See if that area has any edge detection and around its area.
5.2.2 Boundaries concentrating or diluting and not showing information is indication
image edition around there or data loss in image.
-6-