Best Practices for Image Authentication
Scientific Working Group on Imaging Technology (SWGIT)
See also the instructional videos on "Crime Scene and Evidence Photography"
Objective
The objective of this document is to provide personnel with guidance regarding practices appropriate when performing image authentication as part of image analysis.
Introduction
Forensic Image Authentication is the application of image science and domain expertise to discern if a questioned image or video is an accurate representation of the original data by some defined criteria. Image Authentication is a subtask of Image Analysis, and general best practice issues are discussed in SWGIT document “Best Practices for Forensic Image Analysis”. This document addresses issues specific to Image Authentication. Questions involved in authentication include issues of image manipulation, image creation, and consistency with prior knowledge about the circumstances depicted.
Image Authentication must not be confused with the requirement to authenticate evidence as a precondition to admissibility in court. Likewise, authenticity differs significantly from integrity. Integrity ensures that the information presented is complete and unaltered from the time of acquisition until its final disposition. For example, the use of a hash function can verify that a copy of a digital image file is identical to the file from which it was copied, but it cannot demonstrate the veracity of the scene depicted in the image. For further information on digital image integrity, refer to SWGIT document “Best Practices for Maintaining the Integrity of Digital Images and Digital Video”.
The process of Image Authentication can involve several tasks. These tasks include, but are not limited to, evaluation of image structure and content. Image structure issues include discovery of artifacts consistent with image manipulation or degradation, metadata analysis, and indications of provenance. Image content issues include continuity issues, evidence of manipulation, evidence of staging, and anachronism. General principles and procedures for such evaluations are described below.
Image authentication may involve the evaluation of a number of technical issues as discussed below; the image analyst should demonstrate a command of them. Training and proficiency are discussed in the SWGDE/SWGIT document “Guidelines & Recommendations for Training in Digital & Multimedia Evidence”.