HBKU - QCRI
Digital Forensics

This project aimed at developing new attribution and data recovery capabilities to advance the knowledge and practice of digital forensics.

Description, Goals, and Focus

The project had two interrelated objectives with the main focus of extending available attribution and file carving capabilities to video data.

Media Attribution: Source attribution is a crucial task in digital forensics that deals with the problem of reliably identifying the source (camera) of a photo or video. The use of photo-response non-uniformity (PRNU) noise of an imaging sensor for source attribution has been one of the most influential findings in digital forensics, and the method for estimating a sensor’s PRNU pattern from photographic images is now well established. This method, however, performs quite poorly when applied to videos due to additional processing steps involved in the generation of a video file. To bridge this gap, we introduced methods for mitigating video compression . We also developed a class-level source attribution method (i.e., source camera model or editing software identification) utilizing encoding- and encapsulation-related video file metadata as well as photographic images .

Publications

  1. E. Altinisik, K. Tasdemir, and H. T. Sencar, “Mitigation of H.264 and H.265 Video Compression for Reliable PRNU Estimation,” IEEE Trans. Information Forensics & Security, vol: 14, no:10, pp. 1-15, 2019 PDF
  2. E. Altinisik, K. Tasdemir, H. T. Sencar, “PRNU Estimation from Encoded Videos Using Block-Based Weighting” Proc. of EI, Media Watermarking, Security, and Forensics, 2021, Society for Imaging Science and Technology, Jan. 2021 PDF 
  3. E. Altinisik and H. T. Sencar, “Source Camera Attribution from Strongly Stabilized Videos,” IEEE Trans. Information Forensics & Security, Vol: 16, pp. 643-657, 2021 PDF
  4. E. Altinisik and H. T. Sencar “Camera Model Characterization Using Container and Encoding Characteristics of Video Files,” IEEE Trans. Information Forensics & Security, vol: 17, no: 9, pp. 3211-3224, 2022 PDF
  5. E. Altinisik and H. T. Sencar, “Automatic Generation of H.264 Parameter Sets to Recover Video File Fragments,” IEEE Trans. Information Forensics & Security, vol:16, no:10, pp. 643-657, 2021 PDF 
  6. E. Uzun and H. T. Sencar, “JpgScraper: An Advanced Carver for JPEG Files” IEEE Transactions on Information Forensics and Security, Vol: 14, no:11, pp. 1-12, 2019 PDF

Patents

  1. H. T. Sencar  and E. Altinisik. “Automatic Generation of H.264 Parameter Sets to Recover Video File Fragments.” QF Disclosure No. D2022-0011, 2022.

Impact

By providing an in-depth understanding of how video generation steps in an imaging pipeline affect PRNU estimation, we significantly improved source identification accuracy over the conventional method. The estimation method is made publicly available for the use of researchers and practitioners, and it is the de facto method used for estimating PRNUs from videos. (https://github.com/VideoPRNUExtractor)Our approach to file carving in essence introduces the ability to recover a new class of digital evidence that is left unretrieved by existing tools. Our methods based on this approach allow display of standalone fragments of JPEG-coded images andH.264-coded video files–the two most frequently coding standards. Developed techniques are implemented as part of a new carving tool, named FileScraper, to be used by practitioners. (https://github.com/FileScraper/tool)