Forensics Focuses on Digital Photography

Forensics Focuses on Digital Photography

Forensics Magazine

By Douglas Page 
Dec. 2006/Jan. 2007 


Last summer, Reuters admitted that two digital photographs presented as part of its coverage of the 2006 Israel-Lebanon conflict had been significantly altered before being published. One photo showed two heavy columns of black smoke billowing from Beirut buildings after an Israeli air attack. Another showed an Israeli aircraft supposedly firing several missiles.

The images were withdrawn after manipulation was exposed by a U.S. blogger (, who accused Reuters of distorting the first photograph to include more smoke and damage than actually existed. In the other, an Israeli Air Force F16 that had deployed a single flare was digitally doctored to make it appear that several missiles had been fired. Reuters subsequently admitted that the photographer had altered the images using photo-editing software.

The incident illustrates the principle issue with the use of digital photography in forensics, especially in fields like news gathering and criminal justice where the pressures of ethics and public trust are pervasive and presumably paramount.

“Manipulation of digital photographs is not only quite possible, but quite easy,” said Howard Adelman, M.D., a New York forensic pathologist. “With digital photography, I always try to imprint the date and time on the photo and, especially with specimens and bodies, have a ruler in the picture.”

Alteration of digital photographs is far simpler than traditional film. Almost anyone with just a little practice with basic imaging software can produce changes that are nearly impossible to detect without special steps. A person can remove a blemish or a scar from a portrait, a scratch or dent on a car in a newspaper add, or change a license plate, the time on a clock, or background objects in a crime scene photo.

The potential for image manipulation provides a basis for broad admissibility challenges in court. The judiciary has had to increase its scrutiny to be assured digital evidence is authentic and has not been altered or ‘Photo-shopped.’ There have always been legal issues associated with the introduction of photographic evidence, but the digitalization of photographs presents new challenges to forensic scientists to track and maintain image integrity.

“The ease with which images can be manipulated heightens the need for proper authentication,” said Florida attorney Catherine M. Guthrie, a staff researcher at the National Clearinghouse for Science, Technology, and the Law at Stetson University College of Law. Guthrie is co-author of an upcoming law review article titled “The Authentication of Digital Images: The Swinton Six.”

Authentication essentially means that evidence, in this case digital images, are in fact what they purport to be. In other words, the pictures and the processes used to generate them are accurate and reliable, Guthrie said.

Los Angeles attorney Darren Enenstein said one way to authenticate digital images is by using hash functions, or algorithms that give a mathematical formula (or hash value) to each image.

“You can then compare the photo’s hash value if it is moved or copied. If the hash value matches then it is the exact same image, with no changes,” Enenstein said. Enenstein cautioned that algorithms used to compress images for storage can change a hash value.

Software packages, such as Adobe Photoshop CS, are available that produce change reports for digital photo files. Camera manufacturers are also sensitive to the image integrity issue. Several years ago Olympus released its Image Authentication System that can be used to verify if an image has been altered. Canon currently has a Data Verification Kit for its EOS 1Ds and EOS-1D mark II cameras that can detect changes as small as one bit.

“Case law supports the use of these tools,” said Robyn Diehl Lacks, an assistant professor of law in the Wolder School of Government and Public Affairs, Virginia Commonwealth University.

Some camera manufacturers now offer a read-only raw file format. The benefit of raw files is that they are virtually unalterable, an advantage for archival purposes. There is a problem with this format, however. According to a 2004 Adobe White Paper titled “Digital Image Integrity,” written by George Reis, Imaging Forensics (Fountain Valley, California), when a raw file is opened, the raw data is read from disk and processed into a file that can be viewed on a monitor, which completely transforms the file from raw state.

“The data cannot then be re-saved in a raw format,” the paper states. “The processing information used when a raw file is opened cannot ever become part of the original archive file. So, although the raw file largely retains its integrity as an unaltered file, it doesn’t include processing information that is frequently crucial to forensics.”

In general, courts have held that the proponent of the evidence needs to prove that either the proffered photograph is an unedited original or, if editing or enhancement was involved, that the changes were made on a copy of the original, with the original being preserved, and every step in the process was recorded such that each step could be repeated if necessary.

Challenges to digital evidence rarely occur in court, however. Jill Witkowski, writing in Can Juries Really Believe What They See? New Foundational Requirements for the Authentication of Digital Images (10 Wash.U.J.L. & Pol’Y 267,273(2002)) says a possible explanation for this is the legal community’s general lack of awareness of the characteristics of digital images that could make them less reliable than traditional film as evidence.

“Because of the few challenges and therefore scarcity of case law on the subject, the lack of awareness of the unique evidentiary issues digital images present is perpetuated,” Witkowski said.

One 2004 case (Connecticut v. Swinton) involving challenges to digital photographic evidence did wind its way to the Connecticut Supreme Court. In Swinton, the defendant challenged the admissibility of two digitally enhanced submissions – photographs of a bite-mark on the victim’s body and images of the defendant’s teeth superimposed on the bite mark.

Case law established in Swinton provides guidance in how to lay proper foundation when submitting digitally produced evidence. There must be testimony by a person with some degree of computer expertise, who has sufficient knowledge to be examined and cross-examined about the software and its operation. Further, beyond the reliability of the evidence itself, the proponent must establish:

  • the equipment used is accepted as standard equipment in the field;
  • the operator of the equipment was qualified to use the equipment;
  • that proper procedures were followed in connection with the input and output of information; and
  • the software used is reliable.

Federal Rules do not currently set forth admissibility requirements for digital photographs (McCormick on Evidence, 214 (5th Ed.,2003 Pocket Part), so traditional notions of relevancy and authentication apply.

The forensic community is well aware that concerns regarding manipulation of digital images are just as crucial as they were with film.

“Digital photography has not only penetrated the forensic front, it has become incumbent upon the forensic sciences to embrace applications if the current state of the science is to be achieved,” said Gregory S. Golden, chief odontologist for the County of San Bernardino, California.

Organizations such as SWGIT (Scientific Working Group on Imaging Technology) are responsible for setting down protocol and guidelines for digital imaging applications.

SWGIT has worked for a decade to help criminal justice transition from a film-based to a digital-based society. One of its documents, “Recommendations and Guidelines for use of Digital Image Processing in the Criminal Justice System,” helps ensure that processed images can be successfully introduced in court.

“Legal challenges have mostly been concerned with processed images,” said SWGIT chair Carl Kriigel. SWGIT’s position is that any changes to an image made through digital image processing are acceptable in forensic applications provided the following criteria are met: 
· The original image is preserved; 
· The processing steps are logged when they include techniques other than those used in a traditional photographic darkroom; and 
· The end result is presented as an enhanced image, which may be reproduced by applying the logged steps to the original image.

SWGIT has produced several other documents, including guides for management (“Considerations for Managers Migrating to Digital Image Technology”) and training (“Recommendations and Guidelines for Training in Imaging Technologies”).

“The consistent and reliable use of video and digital imaging technologies in the criminal justice system requires competent and appropriate training of personnel,” Kriigel said. All 15 of SWGIT’s documents are available online at the International Association for Identification website.

The American Board of Forensic Odontology has adopted similar guidelines for image management.

Digital imaging began penetrating the criminal justice community about 15 years ago; although at that time only low resolution digital cameras were affordable.

“Some agencies attempted to replace all their film cameras only to be disappointed with the quality digital gave them,” Kriigel said. “Some of these same agencies re-thought their procedures and have kept film cameras until the resolution of digital cameras began to approach film resolution.”

During this transition, many agencies opted for a hybrid system wherein film cameras were used for identification photography and digital cameras for recognition photography, Kriigel said.

With increased resolution of digital technology and cost of high-end digital cameras dropping to affordable levels, digital photography is now replacing film in those agencies anxious to eliminate toxic chemical developing systems, opting instead for computers, monitors, and printers.

“Processing film has become a thing of the past,” Kriigel said. “Many agencies find they actually have more digital cameras being used than they ever had film cameras.”

Herbert Blitzer, executive director of the Institute for Forensic Imaging at Indiana University-Purdue University at Indianapolis said, “Everybody is going digital, because you can save a lot of time and money if you don’t have to process film and make paper prints.” Another reason, Blitzer said, is film is going away. Kodak, for instance, stopped making black-and-white paper in 2005.

“Specialized film in particular is hard to find anymore,” Blitzer said. Even when special film can be found, processing times have become impractical.

Cincinnati odontologist Franklin Wright said it can take up to two weeks to get black-and-white infrared images back from the lab. “By then, if you have a deceased victim, there is no bite mark to re-photograph, if necessary, and if the victim is living the wound has healed,” he said.

Digital photography offers other advantages over film.

“Immediate viewing of images via LCD minimizes errors and the need to re-shoot subjects or scenes,” Golden said.

The ability to store, transfer, and reproduce images electronically from anywhere to any other location in the world within minutes, with no loss of resolution, presents another unique advantage to forensic investigation.

One issue forensic photographers had with digital imaging was recently addressed. As digital photography penetrated deeper into the forensic world, there was concern among forensic specialists that digital technology would leave a capacity vacuum. Golden, Wright, Robert Chessman of RC Forensics in California, and others began pleading with digital camera manufacturers to provide a digital camera with at least the same capabilities that existed with traditional film cameras.

“Business models of most digital manufacturers is to sell large quantities of cameras at a small profit,” Wright said. “They weren’t concerned with forensic applications.”

At least one manufacturer heard the demands. In August, Fujifilm broke new ground with the introduction of its FinePix S3 Pro UVIR camera, the world’s first production D-SLR (digital single lens reflex) camera capable of taking photographs in the ultraviolet and infrared light spectrums.

The UVIR camera was designed specifically for use in science, medicine, forensics, and fine arts. Law enforcement agencies have used special ultraviolet and infrared photography for years to uncover evidence difficult if not impossible to see with the human eye, such as gun shot residue and blood stains, as well as to recover altered, burned, or obliterated writing.

The Fuji camera is the first DSLR to feature a live CCD previewing feature, a significant aid to the forensic photographer because it enables manual focusing while dark filters are attached to the lens, as well as precapture verification. Some beta testers of the UVIR camera, however, have noticed that the digital UV images look different than images taken with traditional panchromatic films.

“That may be because the film has a wider latitude at the low end of the spectrum, or the chip is picking up something other than pure UV,” Golden said. Golden intends to determine what level of the spectrum is transmitted through the two different filters used for each application, UV and IR.

“My hunch is that some IR is passing through the 18A UV filter,” he said, “however this needs to be confirmed with a spectrophotometer.”

There are other issues inherent in digital photography.

While digital offers substantial cost savings over traditional film processing, you still have to store those digital images. That means agencies can end up with large, fragile libraries stored on electronic media that is subject to obsolescence.

“Storing all those photographs can be a huge issue,” Blitzer said. “You can’t just save images on a hard drive and expect them to be there forever.”

Courts require that trial documents be kept for decades. Indiana forensic photographers, for instance, shoot 400,000 to 500,000 pictures a year, and Indiana court rules specify that evidence must be kept 55 years.

“That’s a lot of data to archive for half a century,” Blitzer said.

Compression is one solution, but it comes with its own downside. Compression refers to processes that reduce the size of image data files, which tend to be quite large, so that less storage space is required. The two techniques used for this form of alteration are lossless and lossy compression.

Lossless compression reduces the file size by removing redundant data. Because the redundant data can be retrieved during reconstruction of the image for display, lossless compression results in no loss of information. An example of a file format that uses lossless compression is the graphical interchange format (GIF).

Lossy compression, such as JPEG (Joint Photographic Experts Group) achieves even greater reduction in file size by removing both redundant and irrelevant information. Because the irrelevant information (as determined by the compression algorithm), cannot be retrieved during reconstruction, this method not only results in some loss of image content but can add artifacts, rendering the images less useful forensically. The higher the compression ratio, the greater the data loss.

“Compression is considered a form of alteration, and any alteration may arguably distort the accuracy of the image,” Guthrie said.

Most legal experts agree that the ‘best evidence’ rule should apply when offering digital photographs as evidence, and that the original ‘best evidence’ version of a digital photo is the disk drive in the camera itself, prior to being downloaded to a computer.