Ad
Ad
Ad
Pages: [1] 2 »   Bottom of Page
Print
Author Topic: Can a raw file be doctored?  (Read 6621 times)
cn15
Newbie
*
Offline Offline

Posts: 28


« on: July 28, 2008, 05:52:59 PM »
ReplyReply

I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
Logged
peteh
Full Member
***
Offline Offline

Posts: 201


WWW
« Reply #1 on: July 28, 2008, 06:14:04 PM »
ReplyReply

Quote
I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
[{POST_SNAPBACK}][/a]
Yes! I believe Canon or I know for sure , at least I read this on the web that NIKON makes a forensic type camera that ,maybe does NOT alter the image.
Do a search for "Forensic camera" FUJI makes one for that type of work.
check her for more info.....
[a href=\"http://www.forensicmag.com/articles.asp?pid=122]http://www.forensicmag.com/articles.asp?pid=122[/url]
Logged
peteh
Full Member
***
Offline Offline

Posts: 201


WWW
« Reply #2 on: July 28, 2008, 06:21:05 PM »
ReplyReply

Quote
Yes! I believe Canon or I know for sure , at least I read this on the web that NIKON makes a forensic type camera that ,maybe does NOT alter the image.
Do a search for "Forensic camera" FUJI makes one for that type of work.
check her for more info.....
http://www.forensicmag.com/articles.asp?pid=122
[{POST_SNAPBACK}][/a]
Also be ready to PAY for such a camera!...another link
[a href=\"http://dpnow.com/4066.html]http://dpnow.com/4066.html[/url]
Logged
Eric Myrvaagnes
Sr. Member
****
Offline Offline

Posts: 8075



WWW
« Reply #3 on: July 28, 2008, 06:46:46 PM »
ReplyReply

But as soon as a picture file is downloaded from any digital camera (even a "forensic" one) to a computer, the file consist of a sequence of binary bits, which can be quite easily altered. To make the alterations appear convincing one would have to understand quite a bit about the format of the raw file, but that should be a piece of cake for any experienced and industrious programmer or hacker.

The only way I can imagine a digital image could be fairly certain not to have been doctored in any way would be to have the original photograph taken in the presence of reliable witnesses, then have the camera sealed and the "chain of custody" recorded until the camera is opened in the courtroom.

So altering any raw file is certainly possible, and I expect it would be easier than many of the "hacks" that go on regularly, IMHO.
Logged

-Eric Myrvaagnes

http://myrvaagnes.com  Visit my website. New images each season.
Panopeeper
Sr. Member
****
Offline Offline

Posts: 1805


« Reply #4 on: July 28, 2008, 07:46:23 PM »
ReplyReply

Quote
I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files
This is a very naive question, I had a hard time to take it seriously.

If you mention file, then you are talking about digitalized data available in computers. Accordingly, the proper question is not *if there is any way*, but *if such programs are readily available the public*.

There are literally tens of thousands of people, who could create such programs if they deemed that rewarding enough.
Logged

Gabor
madmanchan
Sr. Member
****
Offline Offline

Posts: 2110


« Reply #5 on: July 28, 2008, 08:10:26 PM »
ReplyReply

The short answer is yes, absolutely, raw files can be doctored. In some cases it is trivial to do, in other cases difficult.
Logged

rdonson
Sr. Member
****
Offline Offline

Posts: 1422


WWW
« Reply #6 on: July 28, 2008, 08:54:37 PM »
ReplyReply

Quote
I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
[a href=\"index.php?act=findpost&pid=211252\"][{POST_SNAPBACK}][/a]

You've actually asked two questions.

1) if its a data file on a computer it can be modified.  Some expertise required if you wish to make sure no one knows that its been modified.

2) can someone detect if a file (jpeg) has been "photoshopped"?  Yep, there's a professor who specializes in this and he has worked with Adobe.  You can catch a piece on him and his work on Nova Science Now
Logged

[span style='font-size:14pt;line-height:100%'][span style='font-family:Arial'][span style='font-family:Geneva'][span style='font-size:8pt;line-height:100%']Regards,
Ron[/span][/span][/span][/span]
John.Murray
Sr. Member
****
Offline Offline

Posts: 893



WWW
« Reply #7 on: July 28, 2008, 08:57:45 PM »
ReplyReply

The new proposed DNG specification by Adobe actually address' that issue (as well as corruption) by generating a hash or CRC of the raw data and including that within the file.  *Any* change to the original will cause the CRC check to fail

http://blogs.adobe.com/lightroomjournal/20...sta_dng_co.html
Logged

DarkPenguin
Guest
« Reply #8 on: July 28, 2008, 09:00:05 PM »
ReplyReply

Sure.  But they rarely get ill.
Logged
tagor
Newbie
*
Offline Offline

Posts: 16


« Reply #9 on: July 29, 2008, 01:42:58 AM »
ReplyReply

Quote
The new proposed DNG specification by Adobe actually address' that issue (as well as corruption) by generating a hash or CRC of the raw data and including that within the file.  *Any* change to the original will cause the CRC check to fail
It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
Logged
John.Murray
Sr. Member
****
Offline Offline

Posts: 893



WWW
« Reply #10 on: July 29, 2008, 09:43:39 AM »
ReplyReply

Quote
It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
[a href=\"index.php?act=findpost&pid=211325\"][{POST_SNAPBACK}][/a]

Sorry, my post was badly worded - both the hash and CRC serve the same purpose - the CRC *is* easily overcome, better suited for quickly verifying small blocks of data such as disk sectors, or packets on the wire.
Logged

madmanchan
Sr. Member
****
Offline Offline

Posts: 2110


« Reply #11 on: July 29, 2008, 10:20:26 AM »
ReplyReply

The raw digest in the DNG 1.2 spec is designed to protect against accidental corruption/modification. That is, a file transfer error that corrupts a few bits of the image data (which is enough to completely ruin the decoding, if that image was compressed) is highly unlikely to also corrupt the digest in such a way that the corrupted digest matches the corrupted image data.

However, as noted above, this digest does not protect against deliberate modification. An adversary who wants to muck with the image data would simply have to recompute the digest from the modified data and replace the original digest with the modified one.
Logged

Bradley Proctor
Full Member
***
Offline Offline

Posts: 150



WWW
« Reply #12 on: July 29, 2008, 11:36:51 AM »
ReplyReply

Quote
It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
[a href=\"index.php?act=findpost&pid=211325\"][{POST_SNAPBACK}][/a]

Couldn't you just generate a new MD5 on the modified data to replace the old one?  Seems to me that somewhere, other than the file, the MD5 would need to be stored for comparison to verify its authenticity.  Am I missing something here?
Logged

madmanchan
Sr. Member
****
Offline Offline

Posts: 2110


« Reply #13 on: July 29, 2008, 11:43:17 AM »
ReplyReply

Yes exactly. The MD5 hash is stored as a tag in the DNG file (as metadata, in other words). So, as noted above, an adversary can tweak the raw data, recompute the MD5 fingerprint, and update the raw digest tag in the DNG.

Again, the DNG raw digest is designed to help protect against accidental corruption ONLY. It has NO security / authentication powers at all, nor was it intended to.
Logged

John.Murray
Sr. Member
****
Offline Offline

Posts: 893



WWW
« Reply #14 on: July 29, 2008, 12:15:55 PM »
ReplyReply

Quote
Yes exactly. The MD5 hash is stored as a tag in the DNG file (as metadata, in other words). So, as noted above, an adversary can tweak the raw data, recompute the MD5 fingerprint, and update the raw digest tag in the DNG.

Again, the DNG raw digest is designed to help protect against accidental corruption ONLY. It has NO security / authentication powers at all, nor was it intended to.
[a href=\"index.php?act=findpost&pid=211462\"][{POST_SNAPBACK}][/a]

Actually it does - recomputing a new MD5 hash from the altered RAW data will result in a new 16byte value (128bit) in the DNG's RawImageDigest field.  It is this value that is usefull to determine whether the content had been changed.  This value is easilly inspected using Adobes own dng_validate tool:

.
.
.
ProfileCopyright: "Copyright 2008 Adobe Systems, Inc."
ForwardMatrix1:
  0.8259 0.0184 0.1200
  0.3835 0.6715 -0.0550
  0.1129 -0.2582 0.9705
ForwardMatrix2:
  0.8001 0.0303 0.1339
  0.3876 0.7158 -0.1034
  0.0623 -0.1346 0.8975
PreviewApplicationName: "Adobe Photoshop Lightroom"
PreviewApplicationVersion: "2.0"
PreviewSettingsDigest: <383fb6eff82dfb94bec97caa5d29046e>
PreviewColorSpace: sRGB
PreviewDateTime: "2008-07-29T10:27:44-07:00"
RawImageDigest: <2e3eb30e25439958c7819d045a13d6e0>
NextIFD = 0

SubIFD 1: Offset = 88936, Entries = 28
.
.
.
« Last Edit: July 29, 2008, 12:40:57 PM by Joh.Murray » Logged

Panopeeper
Sr. Member
****
Offline Offline

Posts: 1805


« Reply #15 on: July 29, 2008, 01:22:07 PM »
ReplyReply

Quote
Actually it does - recomputing a new MD5 hash from the altered RAW data will result in a new 16byte value (128bit) in the DNG's RawImageDigest field.  It is this value that is usefull to determine whether the content had been changed
What exactly is that supposed to prove?

It proves, that two versions are not identical. However, I don't need any checksum to verify that, I can compare the contents directly.
Logged

Gabor
John.Murray
Sr. Member
****
Offline Offline

Posts: 893



WWW
« Reply #16 on: July 29, 2008, 01:57:06 PM »
ReplyReply

Post processing a DNG files will also "change" it's content.  The point of of the RawImageDigest field is to ensure the original RAW data within the file remains unaltered.
Logged

Panopeeper
Sr. Member
****
Offline Offline

Posts: 1805


« Reply #17 on: July 29, 2008, 02:21:49 PM »
ReplyReply

Quote
The point of of the RawImageDigest field is to ensure the original RAW data within the file remains unaltered.
It does not ensure that the raw data remain unaltered. It makes an alteration recognizable (with high probability), if the digest has not been recalculated after the alteration. This is good against accidantal change of the data or destruction through transfer, etc.

However, if a program changes the raw data and recalculates the digest, then everything look ok (as it is supposed to).
Logged

Gabor
John.Murray
Sr. Member
****
Offline Offline

Posts: 893



WWW
« Reply #18 on: July 29, 2008, 02:42:27 PM »
ReplyReply

But after recalculating the value will have changed - comparing this using dng_validate.exe  will immediately identify whether the DNG's RAW data has in fact been altered.

Of course this pre-supposes whether you would have access (EDIT: or documented) to the original DNG (or even the original RAW file - DNG also has a OriginalRawFileDigest field as well).
« Last Edit: July 29, 2008, 03:22:55 PM by Joh.Murray » Logged

Panopeeper
Sr. Member
****
Offline Offline

Posts: 1805


« Reply #19 on: July 29, 2008, 03:44:45 PM »
ReplyReply

Quote
But after recalculating the value will have changed - comparing this using dng_validate.exe  will immediately identify whether the DNG's RAW data has in fact been altered
LOL, how do you know which one is the original?
Logged

Gabor
Pages: [1] 2 »   Top of Page
Print
Jump to:  

Ad
Ad
Ad