Site Loader
Get a Quote
Rock Street, San Francisco

INTRODUCTION
Computer Forensics
It is the branch of forensics using investigative processes to collect, analyze and present digital evidence for legal proceedings. It is also called as “Cyber forensics”, these digital and computer based techniques can often provide the evidence necessary to solve a crime.

Computer forensic expert uses a variety of software and other applications to retrieve, identify and extract data, even data that have been hidden or deleted, and then offer their report or interpretation of data collected.

We Will Write a Custom Essay Specifically
For You For Only $13.90/page!


order now

We Will Write a Custom Essay Specifically
For You For Only $13.90/page!


order now

There are generally three types of computer forensics that are
Media Forensics
It is the scientific study into the collection, analysis, interpretation, and presentation of audio, video and image evidences obtained during the course of investigating processing.

Network Forensics
It coincides with the monitoring and analysis of computer network traffic both LAN&WAN, internet for the purpose of information gathering. Evidence collection or intercepted at the packet level and either stored for later analysis or filtered in real time.

Machine Forensics
Due to VMare virtual machine we run any software without installation of the software, if we want to test our machine we can easily test using VMare software.
Computer forensic investigations usually follow the standard digital forensic process or phases-
Acquisition
Examination
Analysis
Reporting
Investigations are performed on static data rather than “live” systems. This is a change from early forensic practices where a lack of specialist tool led to investigators commonly working with live data.

Techniques
Generally several different – different types of techniques were there for the analysis and enhancement of audio evidence and image evidence for the purpose of law and justice.

For the Analysis of Audio Samples
Generally audio analysis consists of several stages such as cross-drive analysis, live analysis, deleted file recovery, audio enhancement, noise reduction etc such as –
Cross-Drive Analysis
It is a forensic technique that correlates data from multiple hard drives live analysis, which obtains data acquisitions before a computer is shut down.

Live Analysis
It involves examination of computers within the operating system using custom forensics or existing admin tool to extract evidence. The practice is useful when dealing with an encrypting file system, for example, where the encryption keys may be collected and, in some instances, the logical hard drive volume may be imaged before the computer is shut down.

Deleted File Recovery
A common technique used in computer forensics is the recovery of deleted files. Modern forensics software has their own tools for recovering or carving out deleted data. Most operating system and file system do not always erase physical file data, allowing investigators to reconstruct it from the physical file carving involves searching for known file headers within the disk image and reconstructing deleted materials.

For the Analysis of Image Samples
Generally image processing consists of several stages such as image import, analysis, manipulation and image output. There are two methods of image processing:
Digital and Analogue
Image Acquisition
Generally it is the creation of photographic images, such as of a physical scene of the interior structure of an object. The term is often used for the processing, compression, storage, printing and display of images.

It is also defined as the action of retrieving an image from some source, usually a hardware based source for processing.

Simply It means how an image was acquired. It is critical, as it helps the human user understand how remote sensing images differ from what humans are used to seeing from the ground. Remote sensing captures data from an overhead view and can include radiance outside of the visible spectrum.

Fig. 1 (Image Acquisition)
Digitization
An image captured by a sensor is expressed as a continuous function f (x, y) of two coordinates in the plane. Image digitization means that the function f (x, y) is sampled into a matrix with M rows and N columns. It assigns an integer value to each continuous sample.

The continuous range of the image function f (x, y) is split into K intervals.

The finer the sampling (such as the larger M and N) and quantization (the larger K) the better the approximation of the continuous image function f (x, y).Two questions should be answered in connection with an image function sampling
First, the sampling period should be determined – the distance between two neighboring sampling points in the image.

Second, the geometric arrangement of sampling points (sampling grid) should be set
It includes three basic steps such as,
Sampling
A continuous image function f (x, y) can be sampled using a discrete grid of sampling points in the plane.
The image is sampled at points x = j (Delta x), y = k (Delta y). Two neighboring sampling points are separated by distance Delta x along the x axis and Delta y along the y axis. Distances Delta x and Delta y are called the sampling interval and the matrix of samples constitutes the discrete image. The ideal sampling s (x, y) in the regular grid can be represented using a collection of Dirac distributions

Digital recording is not a continous but a discrete process of data acquisition. Pixel is recorded through the regular samples and these samples are taken at a specific rate.

It includes two principles as
coverage of the image plane
uniform sampling (pixels are same size and shape).

Fig. 2 (a. Square grid, b. Hexagaonal)
One infinitely small sampling point in the grid corresponds to one picture element (pixel) in the digital image.

The set of pixels together covers the entire image.

Pixels captured by a real digitization device have finite sizes.

The pixel is a unit which is not further divisible, sometimes pixels are also called points.

Image Resolution
The density of the sampling denotes the separation capability of the resulting image. The image resolution defines the finest details that are still visible by the image.

We used a cyclic pattern to test the separation capability of an image.

Frequency = number of cycles per unit length.

And
Wavelength = unit length per number of cycles i.e. 1/frequency
Quantization
A magnitude of the sampled image is expressed as a digital value in image processing. The transition between continuous values of the image function (brightness) and its digital equivalent is called quantization.

The number of quantization levels should be high enough for human perception of fine shading details in the image. Most digital image processing devices use quantization into k equal intervals. If b bits are used … the number of brightness levels is k=2b. Eight bits per pixel are commonly used, specialized measuring devices use twelve and more bits per pixel.

Significance of Audio and Image Analysis
Audio and image evidences can often be one of the most important pieces of evidence in a case. Presence of an audio and image sample will help to solve a criminal case as these types of samples help to reconstruct the crime scene, they also help to get the useful information or hidden information such as vehicle number in the case of a hit and run, etc.

The admissibility of the audio and iamge evidence in the court of law depends on its authentication and genuineness. For most crimes, however, high-quality audio recordings and captured images are often not available. This is where forensic audio and image expertise can help. Forensic experts have many techniques to enhance audio recordings and images that can bring out the hidden details and hidden information and provide a clearer picture, or make an audio recording more audible. This in turn helps investigators, lawyers and jurors better conduct their duties.

However, although some analogue recording technologies are considered a thing of the past, they still have huge significance in today’s audio forensics world. Analogue recordings may be less common within forensic audio, but a sound working knowledge of analogue functionality and an appreciation of its characteristics is crucial to understanding where we have been and where we may go in the future. Law enforcement agencies are gradually trusting the digital world in every aspect of forensics, and it could be said that even the audio forensics community are catching up with the professional audio industry.

Audio Recording and image files of an incident is very helpful to determine about the real-time scenario of the situation and enables us to recreate the crime scene activities which may have happened in an appropriate order.

The aim of a forensic audio and image laboratory is to provide an audio evidence in criminal or civil investigations. On a daytoday basis, a forensic audio laboratory will deal with sensitive lawenforcement recordings, audio from mobile phones, DVD, CCTV, computers, solidstate devices, memory cards. In fact, just about every type of recorded audio media there is and has ever been. Many of the tasks will at some point involve forensic enhancement audio for use as evidence at trial. However, general advice and guidance concerning the correct capture and subsequent review of audio material is also essential. This provides what is commonly referred to as ‘best evidence’.

In many cases, audio and iamge evidences are used to corroborate subject or witness statements.

Sample Audio Analysis
The audio signal is proposed for various applications, for example recognition, compression, pitch detection and speaker identification etc. Each processing task is presented with different sets of challenges and limitations due to the very complex nature of speech.

In the speaker recognition problem is the complexity of a system is proportional to the size of the speech set and the speaker dependency required, such as a single speaker, multi speaker or speaker independent.

For compression purposes, one would like to represent a given speech signal with the least possible number of data bits while maintaining acceptable audible reconstructed signal. For this purpose, wavelet analysis plays a vital role since it concentrates speech information such as energy and perception into a few neighboring coefficients. This translates into retaining a small number of coefficients to represent a given segment of speech and ignoring the other majority of the coefficients. After the segmentation and analysis of the signal, a threshold is applied to coefficients of each of the levels.

Sample Image Analysis
Image analysis methods extract information from an image by using automatic or semiautomatic techniques known as, scene analysis, image description, image understanding, pattern recognition, computer/machine vision etc.

Image analysis differs from other types of image processing methods, such as enhancement or restoration in that the final result of image analysis procedures is a numerical output rather than a picture.

Image Analysis steps involves
Pre-processing
It is a common name for operations with images at the lowest level of abstraction both input and output are intensity images. The aim of pre-processing is an improvement of the image data that suppresses unwanted distortions or enhances some image features important for further processing.

Segmentation
It is a key step in image analysis. Segmentation subdivides an image into its components. It distinguishes objects of interest from background, e.g. Optical Character Recognition (OCR) systems first segment character shapes from an image before they start to recognise them. The segmentation operation only subdivides an image; it does not attempt to recognise the segmented image parts.

Thresholding
Amplitude thresholding (i.e. in the brightness domain) is the basis approach to image segmentation. A threshold T is selected a that would separate the two modes, i.e. any image point for which f(x, y) ;T is considered as an object; otherwise, the point is called a background point. The threshold image (binary image) is defined by,
g (x, y) = 1 for f (x, y) ; T and 0 for f (x, y) ; T.

T = T p(x, y),f (x, y)
Feature extraction
It starts from an initial set of measured data and builds derived values intended to be informative and non-redundant, facilitating the subsequent learning and generalization steps, and in some cases leading to better human interpretations. Feature extraction is related to dimensionality reduction.

Feature extraction involves reducing the amount of resources required to describe a large set of data.

Classification and Interpretation
To derive useful spatial information from images is the task of image interpretation. It includes
Detection
Detection such as search for hot spots in mechanical and electrical facilities and white spot in x-ray images. This procedure is often used as the first step of image interpretation.

Identification
Identification and recognition of certain target. The higher the spatial/spectral resolution of an image, the more detail we can derive from the image.

Delineation
To outline the recognized target for mapping purpose. Identification and delineation combined together are used to map certain subjects. If the whole image is to be processed by these two procedures, then it is said to be the image classification.

Enumeration
This can be done on the basis of detection and identification.

Mensuration
To measure the area, the volume, the amount, and the length of certain target from an image. This often involves all the procedures mentioned above.

Elements of image interpretation
Generally there are several different types of elements
Image tone, grey level, or multispectral grey-level vector
Human eyes can differentiate over 1000 colors but only about 16 grey levels. Therefore, colour images are preferred in image interpretation. One difficulty involved is use of multispectral image with a dimensionality. In order to make use of all the information available in each band of image, one has to somehow reduce the image dimensionality.

Image texture
Texture is used as an important clue in image interpretation. It is very easy for human interpreters to include it in their mental process. Most texture patterns appear irregular on an image.

Pattern
Regular arrangement of ground objects. Examples are residential area on an aerial photograph and mountains in regular arrangement on a satellite imagery.

Association
A specific object co-occurring with another object.

Shadow
Object shadow is very useful when the phenomena under study have vertical variation.

Shape
Agricultural fields and human-built structures have regular shapes. These can be used to identify various target.

Representations of Audio and Speech
In order to digitally process a signal x (t), it has to be sampled at a certain rate. The standard sampling rate is 2000Hz. Most speech processing schemes assumes slow changes in the properties of speech with time, usually every 10-30 milliseconds. This assumption influenced the creation of short time processing, which suggests the processing of speech in short time processing, which suggests the processing of speech in short but periodic segments called analysis frames or just frames. Each frame is then represented by one or set of numbers, and the speech signal has then a new time dependent representation. In many speech recognition systems like the ones introduced in frame of size 200 samples and sampling rate of 8000Hz i.e., 200 * 1000/800 = 25 milliseconds are considered.
Representation of Time Frequency
Generally, there are two classes of time, frequency representation, linear and non-linear. The Wigner Distribution is an example of the non-linear class. It was first introduced by Wigner in quantum physics. Gabor introduced the short time Fourier transform in 1946 to analyze the finite duration signals.

Representation of Time Scale
Another two dimensional signal processing tool that remedy problems arising from time, frequency domain methods such as trade off in time, frequency resolutions and limitations in analyzing non-stationary signals is the time-scale representation. The Wavelet Transform (WT) accomplishes such representation.

It partitions the time-frequency plane in a non-uniform fashion and shows finer frequency resolution than time resolution at low frequencies and finer time resolution than the frequency resolution at higher frequencies. This type of transform decomposes the signal into different frequency components, and then analyzes each component with a resolution that matches its scale.

The Continuous Wavelet Transform (CWT) 5 of a signal x (t), is given by:
CWT (a, b) (x(t)) = 1 ? a Z ? ?? x(t)? t ? b a dt
Where a and b are the real numbers that represent the scale and the translation parameter of the transform respectively. The function ? (t) is called the mother wavelet.

Wavelet Compression
The goal of using wavelets to compress speech signal is to represent a signal using the smallest number of data bits commensurate with acceptable reconstruction and smaller delay. Wavelets concentrate speech information (energy and perception) into a few neighboring coefficients, this means a small number of coefficients (at a suitably chosen level) will remain and the other coefficients will be truncated. These coefficients will be used to reconstruct the original signal by putting zeros instead of the truncated ones.

Principles of Audio Analysis
Forensic audio analysis is the scientific examination, comparison of audio in legal matters. Some following requirements for forensic audio analysis are-
Pitch
Pitch is a quality that makes it possible to judge sounds as “higher” and “lower”. Pitch can be determined only in sounds that have a frequency that is clear and stable enough to distinguish from noise.

Although we can say it is an auditory sensation. A listener may be perceived a pitch as the frequency of vibration. It is closely related to frequency, but these two are not equivalent.

Frequency is an objective, scientific attribute that can be measured. Pitch is each person’s subjective perception of a sound wave. And a pitch cannot be directly measured.

Bandwidth
The bandwidth indicates the frequency range of a sound. The simplest definition of the bandwidth is the frequency difference between the highest frequency and the lowest frequency of the non-zero spectrum components. Bandwidth of a speech signal is from 50 Hz through to 10 kHz and that of a music signal is from 15Hz through to 20KHz.

Frequency
An audio frequency is characterized as a periodic vibration whose frequency is audible to the average human. The generally accepted range of audible frequency of human is 20 – 20,000 Hz. A voice frequency is present within the part of the audio range that is being used for the transmission of speech. In general the frequency is continuously in any kind of speech or audio sample.

Timbre
Timbre is the perceived sound quality of a musical note, sound or tone. Timbre distinguishes different types of sound production, such as choir voices and musical instruments, such as string instrument. It also enables listeners to distinguish the different instruments in the same category. The physical characteristics of sound that determine the perception of timbre include the spectrum.

Spectrum
Spectrum is a condition that is not limited to a specific set of values, but can vary, without steps, across a continuum. A sound spectrum displays the different frequencies present in a sound.  It is usually presented as a graph of pressure as a function of frequency. A spectrogram is a graphic representation of the frequencies of the voice spectrum, as they change in time while a word or sound is produced.

Principle of Image Analysis
Forensic image analysis is the scientific examination, comparison and/or evaluation of images in legal matters. Mentioned below are some common techniques and requirements for forensic image analysis.

Contrast
It refers to the amount of color or grayscale differentiation that exists between various image features in both analog and digital images. Images having a higher contrast level generally display a greater degree of color or grayscale variation than those of lower contrast. It is the scale of difference between black and white in images. Without contrast you wouldn’t have an image because there wouldn’t be any differentiation between light and dark; everything would be black, white, or a single shade of grey somewhere in between.

Brightness
It is a visual perception of reflected light. Increased brightness refers to an image’s increased luminance. Brightness is a measure of intensity after the image has been acquired with a digital camera or digitized by an analog-to-digital converter. Brightness of an image is defined by the higher grey-scale values. Such as, if an image has grey-scale values like 175,200,255 etc, it can be said that brightness of the image is high. That is, the higher the grey-scale value the higher the brightness of an image. Thus brightness of an image is the higher values of the grey-scale levels.

Hue
The property of light by which the color of an object is classified as red, blue, green, or yellow in reference to the spectrum. Hue is the wavelength within the visible-light spectrum at which the energy output from a source is greatest. This is shown as the peak of the curves in the accompanying graph of intensity versus wavelength. In this example, all three colors have the same hue, with a wavelength slightly longer than 500 nano-meters, in the yellow-green portion of the spectrum.

Saturation
It is an expression for the relative bandwidth of the visible output from a light source. As saturation increases, colors appear more “pure.” As saturation decreases, colours appear more “washed-out.”
Intensity
An intensity image is a data matrix, whose values represent intensities within some range. MATLAB stores an intensity image as a single matrix, with each element of the matrix corresponding to one image pixel. The matrix can be of class double, uint8, or uint16.While intensity images are rarely saved with a colormap, MATLAB uses a colormap to display them.The elements in the intensity matrix represent various intensities, or gray levels, where the intensity 0 usually represents black and the intensity 1, 255, or 65535 usually represents full intensity, or white.

Histogram
The histogram of an image normally refers to a histogram of the pixel intensity values. This histogram is a graph showing the number of pixels in an image at each different intensity value found in that image.

For an 8-bit gray-scale image there are 256 different possible intensities, and so the histogram will graphically display 256 numbers showing the distribution of pixels amongst those gray-scale values.

Histograms can also be taken of colour images – either individual histograms of red, green and blue channels can be taken, or a 3-D histogram can be produced, with the three axes representing the red, blue and green channels, and brightness at each point representing the pixel count.

Image Acquisition
Is a systems that translate a visualized scene into an analog or digital form. The critical factor when determining whether useful information can be gleaned from an image is whether there is sufficient contrast between the features of interest and the background. The acquisition device presents its own set of constraints, which must be considered during the image processing phase of analysis.

Frame-acquisition electronics (often referred to as a frame grabber), the complimentary part to the imaging sensor, converts the signal from the camera into a digital array. The frame grabber selected must match the camera being used.

Pixel Point Operations
Pixel point operations are a class of image enhancements that do not alter the relationship of pixels to their neighbors. This class of algorithms uses a type of transfer function to translate original gray levels into new gray levels, usually called a look-up table (LUT). For instance, a pseudocolor LUT enhancement simply correlates a color with a gray value and assigns a range of colors to the entire gray-level range in an image. This technique can be very useful to delineate subtle features. For example, it is nearly impossible to distinguish features having a difference of, say, five gray levels.

Histogram Equalization
An image can be displayed as a histogram by summing up all the pixels in uniform ranges of gray levels and plotting the number of pixels versus gray level. An algorithm is used to transform the histogram, uniformly distributing intermediate brightness values evenly throughout the full gray-level range (usually 0–255), a technique called histogram equalization
Analysis and Examination of Audio Exhibits
The aim of this project work report is to provide the authenticity report of sample audio files in reference to Forensic Standard Operating Procedures that is followed in the analysis.

Forensic Sample Audio File Examination
Forensic audio examiner can examine a variety of characteristics of the audio recording to determine whether the evidence has been altered or not. This includes the verification of the recording, as well as authenticating the content of the file either it is genuine or not.

To assist in an investigation, forensic experts can repair, recover, enhance and analyze audio recordings using an array of scientific tools and techniques. I work upon more than 100 voice/audio samples, for the examination and analysis of the audio files, firstly we have to look up for the recorded media in which the recording has been done to know the real hash value or properties of the audio file, to calculate the genuineness and authenticity. There are following steps involed in this process as –
Repair and Recovery of the Sample Audio Files –
In today’s digital world, CDs, DVDs, cell phones, portable cameras and other sources of digital media and recording devices can be damaged by heat, misuse, the environmental conditions of a crime scene, or simply on purpose by an offender. Even in these situations, the digital files can be recovered and used for analysis.

But firstly we have to repair the device for the examination of the device and for the recovery of important evidence/sample that might be helpful for the justice in the court of law.

Before audio evidence can be analyzed, it may first need to be repaired or recovered from damaged media or a damaged recording device.

lefttop
Fig. 3 (a. Damaged Mobile, b. Damaged CD, c. Damaged magnetic tape recoreder).Repairing evidence is especially common for analogue and digital magnetic tape. It may need to be spliced back together or put into a new audio housing in order to recover the audio evidence.

A forensic examiner can also recover data or media files through the locked devices such as Mobile Phones, Laptops, Computers etc. We extract audio files as well as image files with certain other data like documents, video files, chat history, contacts etc. from the locked devices to conduct the analysis for the purpose of project work.

Evidence Enhancement
The most common function of forensic audio experts is to clarify a recording and enhance the recording or to make the recording audible via removing and reducing the background noises or unwanted noises so that it is more apparent to investigators, attorneys and jury members what the evidence demonstrates.

To enhance an audio recording
Filters can be employed to improve clarity. This may entail removal of unwanted noise or enhancing the intelligibility of speech. Recordings will often be made in less than ideal circumstances, such as when someone is wearing a body wire. Utilizing audio engineering techniques may allow faint voices or events to be heard more clearly on playback.

Analysis of Audio Samples
I collect more than 100 samples of voice to find out the genuineness or authentication of the speech and to identify the speaker identity.

The Audio file was thoroughly examined with Forensic Standard Operating Procedures and following properties were came to known.

Audio Authentication
The audio file was analysed with the help of audio analysis tools and the authentication of the file was done based on the various facts/findings as –
First step involved the “Forensic Imaging”, in which the storage media or the exhibit in which the audio sample is present is copied by bit to bit to make an exact bit by bit copy of an exhibit/sample i.e. an hard-drive, pen-drive, CD drive, or any other storage media by the use of forensic software and tools such as “FTK Imager”.

Second step involves the “Auditory Examination”, in which the audio signals in the footage of the audio file were listened to its entirety numerous times to determine continuity of background sounds or an indication of edits, frequency graph, firstly using the human trained ear and secondly analyzing the recording through a spectrum analyzer and spectrogram.

Third steps involves the “Forensic Typescript” of an sample, in which the audio conversation that is we listened thoroughly has to be written exactly word to word either it is of any language such as Hindi, English, Punjabi, Urdu, Tamil, etc.

The Following more steps were taken in order to check the authenticity and genuineness of the recording –
Metadata of the audio sample has to be checked very carefully to know the media information of the sample such as total length of the sample, size of the audio sample, size on disk of the audio sample, modified date etc.

Hash value is calculated by using forensic software tools to find out the genuineness of the audio sample.

We also used the some other kind of forensic tools to calcualate the Bonafide Spacing and for Spectrogram Analysis.

The spectrogram analysis shows either continuity or disconuity through which we can detect the alteration.

The unusal spacing between the two frequencies of bonafides indicates the presence of discourse marker, through which we can detect that the audio sample is tampered by any means.

Analysis and Examination of Image Exhibits
The aim of this project work report is to provide the authenticity report of sample image files in reference to Forensic Standard Operating Procedures that is performed in the analysis of image files.

Forensic Sample Image File Examination
.Forensic image can examine by a variety of characteristics to determine whether the evidence has been altered or not. This includes confirming the verification of the pixels distribution, colour distribution, light distribution etc.

To facilitate an investigation a forensic expert/examiner can repair, recover, enhance and analyze image capturing devices and image recorded devices using an array of scientific tools and techniques. I work on more than 50 samples, for the examination and analysis of the sample image files, firstly I look up for the recorded media and the image capturing device in which the image was captured to know the real hash value or properties of the sample image file, to find out the genuineness or authentication of the image or to identify either the image is tampered by any means or not. This type of examination involves following steps such as –
Repair and Recovery of Image Capturing Device
An image caputing device such as a Portable Camera (DSLR, SLR or a Mobile Phone Camera) and other sources of digital media, storage media and recording devices can be damaged by heat, misuse, the environmental conditions of a crime scene, or simply on purpose by an offender. Even in these situations, the digital files can be recovered and used for analysis by the use of forensic software and tools or techniques.

But firstly we have to repair the device for the examination of the device and for the recovery of an important evidence, sample that can give a led to a case or it might be helpful in justice in the court of law.

Fig. 4 (a.Damaged Camera, b.Damaged Mobile Phone’s Camera, c.Damaged Cameras Chip).Before an sample image file is analyzed, this may first need to be repaired or recovered from damaged media or a damaged devices Such as, Mobile phones, Cameras, Portable Cameras Chip, or any other recording devices or storage media.

Evidence Enhancement
The sample image files can be enhanced bythe analysis of various parameters such as by increasing or decreasing the brightness, contrast, hue, saturation and by the analysis of luminance gradient, by analysis of pixel distribution etc. The image can be enchnaced by applying different types of filters to extract the valuable information or some hidden information for the purpose of law and justice.

Image Samples
I collect more than 50 samples of images to find out the genuineness or authentication of the image or to identify either the image is tampered by any means or not? The following steps were taken in order to check the authenticity and genuineness of the images, the following items used in the examination.

Image Authentication
The image samples were analysed with the help of sophisticated forensic tools and the authentication of the file was done based on the various facts/findings as –
The first step that is involved in the analysis of image file is same to the analysis of audio sample files as it also involves the “Forensic Imaging” of the storage device or capturing device through which the image sample was captured or present, the exhibit is copied exactly bit to bit to make an exact bit by bit copy of the sample exhibit either it is any Camera-Chip, Hard-drive, Pen-drive, Phone Camera or any kind of storage media etc.

The second step involves the “Visual Examination”, in this type of process we normally see the images without any use of sophisticated tools or softwares, just to differentiate the pictures from forground to the background and to compare the pictures from one to another. If any kind of marks/injuries present in the photographs then we have to differentiate the injuries from one image to other or we have to identify the type of injury.

Next step involves the analysis of images with the use of sophisticated tools and softwares through which we analysed the images at every point of pixels, colour distribution, luminanace distribution, and also by increasing or decreasing the brightness to know the actual brightness level or color level of the image.

We also has to analysed the greyscale level, noise level or clone detection of the image file by the use of forensic tools.
We also has to analysed the metadata and hash value of the image.

Analysis and Examination
Some Useful Tools and Software for the Analysis of Sample Image Files
Adobe Photoshop
Adobe Photoshop is the standard image editing application used by the majority of design professionals throughout the world and is increasingly being used for detailed forensic analysis and resulting court presentation.

It offers incredible creative freedom both in terms of manipulating existing images, creating new art work, and integrating all design elements. This software is easy to use and helps in the analysis or differentiation. It is a raster graphics editior developed and published by Adobe Systems for MacOS and Windows.

Forensically
It is a set of free online tools for digital image forensics. It includes clone detection, error level analysis, meta data extraction and more. It also helps to compress the images or to applying the filters in the image for the purpose of enhancement.

Other Processes of Analysis of Sample Image File
Physical Handling and Inspection
Under in this process we has to written the condition and properties of the image files, including the length and condition of the image, any manufacturing serial numbers or batch numbers if present.

Detailed continuity analysis of the image file title
On thorough and cumulative analysis with the help of sophisticated tools of image files mentioned above it is concluded that in all the image files injuries and bruishes were found, when viewed the section through the Forensically and Adobe Photoshop cs6 it is found that in one image injury are present in an area of skin and in other images it is present somewhere else and absent which indictes that the image files are not genuine. Some kind of editing/tampering was done in these image files. These are shown as –
Authentication of Audio and Image Recordings
In many criminal cases, the authenticity of the audio recording and the image content may be called in to question. Forensic audio and image experts can examine a variety of characteristics of the audio recording and captured images to determine whether the evidence has been altered or not. This includes confirming the integrity and verification of the recording, as well as authenticating that the content of the image or audio is what it purports to be.

If the ambient sound present on an audio recording changes abruptly, this could indicate that the environment where the recording took place suddenly changed. The volume and tone of a voice on the recording can provide clues as to distance and spatial relationships within a scene.

Lighting conditions can be examined to estimate the time of day or environmental conditions at the time of the recording.

Technical details may also confirm information about a recording. For instance, an unnatural waveform present in the audio signal may indicate that an edit has been made.

A physical identifier may be present in the signal on magnetic tape that can identify it as a copy or indicate that it was recorded on a particular device. Sometimes, a perpetrator will try to destroy the evidence, however by using these above mentioned methods, the recording can be analyzed to determine what occurred..Identifying people or objects on audio or image recording
Identifying a person or object from an image or voice of an audio recording requires training in image content analysis or speech science. These examinations are detailed comparisons of an unknown recording to a known recording, or an unknown object to a known object in an attempt to make a positive identification.
For instance, an image of a hat at the crime scene may be compared with a hat found on a suspect. The comparison techniques used in image analysis follow the same detailed comparison techniques as Fingerprint and Document examiners.

EXAMPLES
As i already mentioned above that my project work i worked more than 100 audio and more than 50 samples of audio and images, to find out the authenticity of these samples, I used various types of tools and techniques. Here i’m giving some following example from those samples as –
AUDIO SAMPLE-1
Subject
I received an android phone containing audio file titled as “Voice21-42.amr” for the verification of the audio file present in the mobile phone and verifying the authenticity.

Article Specifications
The audio file which is titled as “Voice21-42.amr” of containing an audio clip with sound track having modified date as 22 ?October ?2015, ??14:34:13 which is AMR Audio File (.amr) type file having size 1.14 MB (11,99,526 bytes) and size on disk 1.14 MB (12,00,128 bytes).

Cell Phone iphoneModel Number Iphone 5s
Version 6.0
RAM 4 GB
Space 16 GB
IMEI Number 8822110432122
Examination Required
To determine the factor of whether the audio files titled as “Voice21-42.amr” are edited/tampered or not? Perform the Physical Examination, Auditory Analysis, and Authentication and prepare their typescript.

Tools used
System – Windows 8.1 AMD A6-63110 APU Processor
Wavepad – NCH Suite for analysis of an audio file.

MediaInfo – To calculate the Metadata.Hashcalc – To calculate the Hash value.Analysis and Examination
The Audio file name as “Voice21-42.amr” duration 0:11:15.749 Hour was thoroughly examined with Forensic Standard Operating Procedures and following prpoerties were came to known.

The audio file name as “Voice21-42.amr” was examined through. The first step involved in the examination is “Auditory Examination”.

Audio Authentication
The audio file “Voice21-42.amr” was analysed with the help of audio analysis tools and the authentication of the file was done based on the various facts and findings as –
On thorough and cumulative analysis it is concluded that, In this audio files the conversation is in between two persons.

Voice 1 is of Male
Voice 2 is of Female
And when viewed the section through the Wave Pad analyzer, the discourse marker point indicates a dropout in recording which gives indications of some kind of tampering.

Following steps were taken in order to check the authenticity and genuineness of the recording –
Metadata of the audio clip named as “Voice21-42.amr” is as –
Complete Name “Voice21-42.amr”
Format AMR
File Size 1.14 MB
Duration 0:11:15.749
Overall Bit Rate Mode Constant
Overall Bit Rate 12.8 kb/s
Channel 1 channel
Sampling rate 8,000 Hz
Bit Depth 13 bits
Stream Size B
Hash value
Audio file MD5
The Bona fide Spacing between the two frequencies were found to be and irregular in the graphical description of the audio clip.

The Bona fide Spacing between the two frequencies were found to be irregular.

The Spectral Analysis shows that the alterations/tampering made in the audio clip “”.

Conclusion
The audio is examined on both physical and forensic parameters, the standard procedure is followed. The audio is examined by splitting it into frames for frame by frame analysis and examination. Frames of the recording are picked and filtered on multiple filters for observing any addition, anomaly or abnormality
On the basis of above examination it is opined that the audio fille named as “” is not genuine or authentic as –
There is a sign of alteration in the audio file which can be seen from the above observations of facts and findings made in the audio file.

The audio file has been tampered by any means.

The integrity of the file is compromised by addition or deletion of some area/portion from the audio clip.Thus it is concluded that the audio file named as is an tampered audio file.

AUDIO SAMPLE – 2
Subject
I received an android phone containing audio file titled as “Voice21-42.amr” for the verification of the audio file present in the mobile phone and verifying the authenticity.

Article Specifications
The audio file which is titled as “Voice21-42.amr” of containing an audio clip with sound track having modified date as 22 ?October ?2015, ??14:34:13 which is AMR Audio File (.amr) type file having size 1.14 MB (11,99,526 bytes) and size on disk 1.14 MB (12,00,128 bytes).

Audio Authentication
The audio file “Voice21-42.amr” was analysed with the help of audio analysis tools and the authentication of the file was done based on the various facts and findings as –
On thorough and cumulative analysis it is concluded that, In this audio files the conversation is in between two persons.

Voice 1 is of Male
Voice 2 is of Female
And when viewed the section through the Wave Pad analyzer, the discourse marker point indicates a dropout in recording which gives indications of some kind of tampering.

Following steps were taken in order to check the authenticity and genuineness of the recording –
Metadata of the audio clip named as “Voice21-42.amr” is as –
Complete Name “Voice21-42.amr”
Format AMR
File Size 1.14 MB
Duration 0:11:15.749
Overall Bit Rate Mode Constant
Overall Bit Rate 12.8 kb/s
Channel 1 channel
Sampling rate 8,000 Hz
Bit Depth 13 bits
Stream Size B
Hash value
Audio file MD5
The Bona fide Spacing between the two frequencies were found to be and irregular in the graphical description of the audio clip.

The Bona fide Spacing between the two frequencies were found to be irregular.

The Spectral Analysis shows that the alterations/tampering made in the audio clip “”.

Conclusion
IMAGE SAMPLE – 1
Subject
I have received a storage device (pen drive) in person containing 12 image samples titled as “img045.jpg”, “img046.jpg”, “img047.jpg”, “img048.jpg”, “img049.jpg”, “img050.jpg”, “img051.jpg”, “img052.jpg”, “img053.jpg”, “img054.jpg”, “img055.jpg”, and “img056.jpg” from Mr. Singh who sbmitted the pen drive (storage media) to our laboratory on 23-05-2018 regarding the analysis and verification/authentication of image files.

Examination Required
To determine the factor whether the image files are edited/tampered or not?ARTICLE SPECIFICATIONS
In Folder Marked as (Audio):
The Image file named as “img045.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 10:19:04 having size 122 KB (1,25,930 bytes) and size on disk is 124 KB (1,26,976 bytes).

The Image file named as “img046.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 10:19:14 having size 129 KB (1,32,870 bytes) and size on disk 132 KB (1,35,168 bytes).

The Image file named as “img047.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 11:12:47 having size 242 KB (2,48,385 bytes) and size on disk 244 KB (2,49,856 bytes).

The Image file named as “img048.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 11:10:28 having size 245 KB (2,51,080 bytes) and size on disk 248 KB (2,53,952 bytes).

The Image file named as “img049.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 11:18:49 having size 204 KB (2,09,674 bytes) and size on disk 208 KB (2,12,992 bytes).

The Image file named as “img050.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, ??11:15:49 having size 235 KB (2,41,025 bytes) and size on disk 236 KB (2,41,664 bytes).

The Image file named as “img051.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 11:24:51 having size 230 KB (2,35,872 bytes) and size on disk 232 KB (2,37,568 bytes).

The Image file named as “img052.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 11:22:17 having size 219 KB (2,24,433 bytes) and size on disk 220 KB (2,25,280 bytes).

The Image file named as “img053.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, ??11:30:17 having size 226 KB (2,32,243 bytes) and size on disk 228 KB (2,33,472 bytes).

The Image file named as “img054.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, 11:26:41 having size 242 KB (2,48,749 bytes) and size on disk 244 KB (2,49,856 bytes).

The Image file named as “img055.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, ??11:34:13 having size 267 KB (2,73,772 bytes) and size on disk 268 KB (2,74,432 bytes).

The Image file named as “img056.jpg” is JPEG image (.jpg) type of file having modified on 21 December 2017, ???11:31:50 having size 221 KB (2,26,381 bytes) and size on disk 224 KB (2,29,376 bytes).

Methods Involved n Preliminary Examination
Equipment and Software used in the voice analysis process
Computer
Windows 8.1AMD A6-63110 APU Processor
Image analysis software
Forensically, Adobe Photoshop CS6
Final Examination
The aim of this report is to provide the authenticity report of image files in reference to procedure performed in the analysis and to document all the findings.
Observation
Image Forensic analysis is used to determine whether the image files are edited/tampered or not?
Image File Examination
Forensic image can examine by a variety of characteristics to determine whether the evidence has been altered or not. This includes confirming the verification of the pixels distribution.

The Following Steps were taken by the expert in order to check the authenticity and genuineness of the images, the following items used in the examination;
Physical Handling and Inspection
Under in this analysis i written the condition and properties of the image files, including the length and condition of the image, any manufacturing serial numbers or batch numbers if present.

Properties of the image file name as “img045.jpg”
Complete Name “img045.jpg”
Format JPEG
File Size 123 KB
Width 788 Pixels
Height 1140 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 123 KB (100%)
ColorSpace_ICCRGB
Properties of the image file name as “img046.jpg”
Complete Name “img046.jpg”
Format JPEG
File Size 130KB
Width 784 Pixels
Height 1155 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 130 KB (100%)
ColorSpace_ICCRGB
Properties of the image file name as “img047.jpg”
Complete Name “img047.jpg”
Format JPEG
File Size 243 KB
Width 1722 Pixels
Height 1175 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 243 KB (100%)
ColorSpace_ICCRGB
Properties of the image file named as “img048.jpg”
Complete Name “img048.jpg”
Format JPEG
File Size 245 KB
Width 1722 pixels
Height 1175 pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 245 KB (100%)
ColorSpace_ICCRGB
Properties of the image file named as “img049.jpg”
Complete Name “img049.jpg”
Format JPEG
File Size 205 KB
Width 1728 Pixels
Height 1176 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 205 KB(100%)
ColorSpace_ICCRGB
Properties of the image file name as “img050.jpg”
Complete Name “img050.jpg
Format JPEG
File Size 235 KB
Width 1733 Pixels
Height 1170 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 235 KB (100%)
ColorSpace_ICCRGB
Properties of image file named as “img051.jpg”
Complete Name “img051.jpg
Format JPEG
File Size 230 KB
Width 1727 Pixels
Height 1176 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 230 KB (100%)
ColorSpace_ICCRGB
Properties of the image file name as “img052.jpg”
Complete Name “img052.jpg”
Format JPEG
File Size 219 KB
Width 1733 Pixels
Height 1182 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 219 KB (100%)
ColorSpace_ICCRGB
Properties of the image file named as “img053.jpg”
Complete Name “img053.jpg”
Format JPEG
File Size 227 KB
Width 1173 Pixels
Height 1176 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 227 KB (100%)
ColorSpace_ICCRGB
Properties of the image file named as “img054.jpg”
Complete Name “img054.jpg”
Format JPEG
File Size 243 KB
Width 1733 Pixels
Height 1170 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 243 KB (100%)
ColorSpace_ICCRGB
Properties of the image file named as “img055.jpg”
Complete Name “img055.jpg”
Format JPEG
File Size 267 KB
Width 1740 Pixels
Height 1283 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 267 KB (100%)
ColorSpace_ICCRGB
Properties of the image file named as “img056.jpg”
Complete Name “img056.jpg”
Format JPEG
File Size 221 KB
Width 1782 Pixels
Height 1182 Pixels
Color Space YUV
Bit-depth 8 bits
Compression Mode LossyStream Size 221 KB (100%)
ColorSpace_ICCRGB
Detailed continuity analysis of the image file titled
On thorough and cumulative analysis with the help of sophisticated tools of image files mentioned above it is concluded that in all the image files injuries and bruishes were found, when viewed the section through the Forensically and Adobe Photoshop cs6 it is found that in one image injury are present in an area of skin and in other images it is present somewhere else and absent which indictes that the image files are not genuine. Some kind of editing/tampering was done in these image files. These are shown as –
The image files titled as “img045.jpg”, “img046.jpg” and “img047.jpg” has the injury on the side of lips which is present near the lips and forms the L-shape structure in the image first (img045.jpg), and present on the lips in the image second (img046.jpg), and is present at a distant and forms a inner side curve like structure in the image third (img047.jpg). ). As shown below

The image files titled as “img045.jpg”, “img046.jpg” and “img047.jpg” shows an injury near the lips which is changed in position from one image to other.

The image files files titled as “img045.jpg”, “img046.jpg” and “img047.jpg” has the bruises on both of the eyes which is is changed from one image to other.

As image first (img045.jpg) is completely dark black in colour and the image second (img046.jpg) is lightly dark in colour as compared to image first and the image third (img047.jpg) is discontinued black as white colour patches were appears. As shown below –

Brusing color on the eyes is changed from one image to other.
The image files files titled as “img045.jpg”, “img046.jpg”, “img047.jpg”, “img048” and “img054” shows the injury on chin. Its shape and colour is changes from image to image.

As its colour in image first (img045.jpg) shows the light yellow in color while in image second (img046.jpg), it is asbent.

In image third (img047.jpg), it is again colourless and in image fourth (img048.jpg) it is yellowish in colour and is of irregular and deeper in shape and size as compared to image fifth (img054.jpg). As shown below –

Post Author: admin

x

Hi!
I'm Lillian

Would you like to get a custom essay? How about receiving a customized one?

Check it out
x

Hi!
I'm Camille!

Would you like to get a custom essay? How about receiving a customized one?

Check it out