Anthony T.S. Ho, Department of Computing, University of Surrey, UKProf. Ho holds the Personal Chair in Multimedia Security and is currently the Head of the Department of Computing at the University of Surrey. He is a Fellow of the Institution of Engineering and Technology (FIET), a Chartered Electrical Engineer (CEng), Fellow of British Computer Society (FBCS) and a Senior Member of IEEE. He was the recipient of the IET Innovation in Engineering Award (2006) for his research and commercialisation work on digital watermarking in 2006. Prof. Ho is a member of the IEEE Signal Processing Society Technical Community on Information Forensics and Security. He is the editor-in-chief of the international journal Information Security Technical Reports, which covers digital forensics as one of its key topics. He is also the co-editor-in-chief of International Journal of Digital Crime and Forensics which publishes research papers on both digital and multimedia forensics.Shujun Li, Department of Computing, University of Surrey, UKDr. Li is a Senior Lecturer in the Department of Computing at the University of Surrey. Dr Li received his PhD degree in Information and Communication Engineering in 2003 from Xi’an Jiaotong University, China. He has published more than 70 scientific papers at various international journals and conferences. Dr. Li is on the editorial board of Information Security Technical Reports. He is a Senior Member of the IEEE and a Professional Member of the ACM. He is a member of the IEEE Communications Society Technical Committee on Multimedia Communications and of the IEEE Circuits and Systems Society Technical Committee on Nonlinear Circuits & Systems. He is an active contributor to the ISO/IEC RVC standard as a member of the MPEG.

Select Guide Rating

• List of Contributors xviiForeword xixPreface xxiAcknowledgements xxviiPART ONE MULTIMEDIA EVIDENCE HANDLING1 Digital Forensics Laboratories in Operation: How Are Multimedia Data and Devices Handled? 31.1 Introduction 31.2 Digital and Electronics Forensic Service, Metropolitan Police Service, UK 41.3 Digital Forensics Team (Including Affiliated AV Team), Surrey Police, UK 171.4 Shanghai Stars Digital Forensic Centre, Third Research Institute of China’s Ministry of Public Security 231.5 Discussions 281.6 Summary 321.A Appendix: Questionnaires for Interviewing Surrey Police and Shanghai Stars Digital Forensic Centre 32References 342 Standards and Best Practices in Digital and Multimedia Forensics 382.1 Introduction 382.2 Overview 392.3 Electronic Evidence and Digital Forensics 482.4 Multimedia Evidence and Multimedia Forensics 702.5 Digital Forensics Laboratory Accreditation 772.6 General Quality Assurance (Management) 792.7 Training, Education and Certification on Digital and Multimedia Forensics 812.8 Conclusions 84Acknowledgements 86References 863 A Machine Learning-Based Approach to Digital Triage 943.1 Introduction 943.2 Related Work on Digital Triage 963.3 A Machine Learning-Based Digital Triage Framework 1003.4 A Child Pornography Exchange Case Study 1103.5 Conclusion 1283.6 Challenges and Future Directions for the Digital Forensics Community 128Acknowledgements 130References 1304 Forensic Authentication of Digital Audio and Video Files 1334.1 Introduction 1334.2 Examination Requests and Submitted Evidence 1344.3 Laboratory Space 1384.4 Laboratory Software and Equipment 1384.5 Audio/Video Authentication Examinations 1474.6 Preparation of Work Notes and Laboratory Reports 1714.7 Expert Testimony 1724.8 Case Examples 1734.9 Discussion 177References 178PART TWO DIGITAL EVIDENCE EXTRACTION5 Photogrammetry in Digital Forensics 1855.1 Introduction 1855.2 Different Methods 1885.3 Measurement Uncertainty 1945.4 Case Studies 1955.5 3D Modelling/Scenario Testing 2125.6 Summary 217References 2176 Advanced Multimedia File Carving 2196.1 Introduction 2196.2 Digtal Data Storage 2206.3 File Carving of Binary Data 2256.4 Multimedia Data Structures 2266.5 File Carving of Multimedia Data 2326.6 Content Identification 2416.7 File Carving Frameworks 2536.8 Conclusions 264Acknowledgements 265References 2657 On Forensic Use of Biometrics 2707.1 Introduction 2707.2 Biometrics Performance Metrics 2737.3 Face: The Natural Means for Human Recognition 2747.4 Ears as a Means of Forensic Identification 2837.5 Conclusions 299References 2998 Multimedia Analytics for Image Collection Forensics 3058.1 Introduction 3058.2 Data and Tasks 3088.3 Multimedia Analysis 3098.4 Visual Analytics Processes 3128.5 ChronoBrowser 3138.6 MediaTable 3208.7 An Example Scenario 3238.8 Future Outlook 325References 326PART THREE MULTIMEDIA DEVICE AND SOURCE FORENSICS9 Forensic Camera Model Identification 3319.1 Introduction 3319.2 Forensic Source Identification 3339.3 Digital Camera Model Identification 3379.4 Benchmarking Camera Model Identification Algorithms 3399.5 Model-Specific Characteristics of Digital Camera Components 3419.6 Black Box Camera Model Identification 3519.7 Camera Model Identification in Open Sets 3649.8 Model-Specific Characteristics in Device-Level Identification 3669.9 Open Challenges Towards Practical Applications 368References 37010 Printer and Scanner Forensics 37510.1 Introduction 37510.2 Printer Forensics 37910.3 Scanner Forensics 38610.4 Photocopier Identification 38910.5 Forgery Detection for Printed and Scanned Documents 39110.6 Sample Algorithms with Case Studies 39610.7 Open Problems and Challenges 40610.8 Conclusions 408Acknowledgements 408References 40811 Microphone Forensics 41111.1 Introduction 41111.2 Pattern Recognition for Microphone Forensics 41411.3 Guidelines for Microphone Registration 42111.4 Case Studies 42311.5 Chapter Summary 435Acknowledgements 436References 43712 Forensic Identification of Printed Documents 44212.1 Introduction 44212.2 Special Materials 44912.3 Substrate Forensics 45012.4 Print Forensics 45512.5 Real World Example: Currency Protection 47312.6 Summary and Ecosystem Considerations 475References 478PART FOUR MULTIMEDIA CONTENT FORENSICS13 Digital Image Forensics with Statistical Analysis 48313.1 Introduction 48313.2 Detecting Region Duplication 48813.3 Exposing Splicing Forgery 50013.4 Case Studies 50813.5 Other Applications 51213.6 Summary 515References 51714 Camera-Based Image Forgery Detection 52214.1 Introduction 52214.2 Camera Structure 52414.3 Camera-Based Forgery Detection Methods 53514.4 Forgery Detection Based on PFA: A Case Study 54814.5 Conclusion 564References 56515 Image and Video Processing History Recovery 57215.1 Introduction 57215.2 Coding Artefacts 57315.3 Editing Artefacts 58615.4 Estimation of Processing Parameters 59015.5 Case Studies 60115.6 Conclusions 605References 60716 Anti-Forensics of Multimedia Data and Countermeasures 61216.1 Introduction 61216.2 Anti-forensic Approaches Proposed in the Literature 61316.3 Case Study: JPEG Image Forensics 62316.4 Trade-off between Forensics and Anti-forensics 64416.5 Conclusions 647References 647Index 653

Anthony T.S. Ho, Department of Computing, University of Surrey, UKProf. Ho holds the Personal Chair in Multimedia Security and is currently the Head of the Department of Computing at the University of Surrey. He is a Fellow of the Institution of Engineering and Technology (FIET), a Chartered Electrical Engineer (CEng), Fellow of British Computer Society (FBCS) and a Senior Member of IEEE. He was the recipient of the IET Innovation in Engineering Award (2006) for his research and commercialisation work on digital watermarking in 2006. Prof. Ho is a member of the IEEE Signal Processing Society Technical Community on Information Forensics and Security. He is the editor-in-chief of the international journal Information Security Technical Reports, which covers digital forensics as one of its key topics. He is also the co-editor-in-chief of International Journal of Digital Crime and Forensics which publishes research papers on both digital and multimedia forensics.Shujun Li, Department of Computing, University of Surrey, UKDr. Li is a Senior Lecturer in the Department of Computing at the University of Surrey. Dr Li received his PhD degree in Information and Communication Engineering in 2003 from Xi’an Jiaotong University, China. He has published more than 70 scientific papers at various international journals and conferences. Dr. Li is on the editorial board of Information Security Technical Reports. He is a Senior Member of the IEEE and a Professional Member of the ACM. He is a member of the IEEE Communications Society Technical Committee on Multimedia Communications and of the IEEE Circuits and Systems Society Technical Committee on Nonlinear Circuits & Systems. He is an active contributor to the ISO/IEC RVC standard as a member of the MPEG.

Select Guide Rating

• List of Contributors xviiForeword xixPreface xxiAcknowledgements xxviiPART ONE MULTIMEDIA EVIDENCE HANDLING1 Digital Forensics Laboratories in Operation: How Are Multimedia Data and Devices Handled? 31.1 Introduction 31.2 Digital and Electronics Forensic Service, Metropolitan Police Service, UK 41.3 Digital Forensics Team (Including Affiliated AV Team), Surrey Police, UK 171.4 Shanghai Stars Digital Forensic Centre, Third Research Institute of China’s Ministry of Public Security 231.5 Discussions 281.6 Summary 321.A Appendix: Questionnaires for Interviewing Surrey Police and Shanghai Stars Digital Forensic Centre 32References 342 Standards and Best Practices in Digital and Multimedia Forensics 382.1 Introduction 382.2 Overview 392.3 Electronic Evidence and Digital Forensics 482.4 Multimedia Evidence and Multimedia Forensics 702.5 Digital Forensics Laboratory Accreditation 772.6 General Quality Assurance (Management) 792.7 Training, Education and Certification on Digital and Multimedia Forensics 812.8 Conclusions 84Acknowledgements 86References 863 A Machine Learning-Based Approach to Digital Triage 943.1 Introduction 943.2 Related Work on Digital Triage 963.3 A Machine Learning-Based Digital Triage Framework 1003.4 A Child Pornography Exchange Case Study 1103.5 Conclusion 1283.6 Challenges and Future Directions for the Digital Forensics Community 128Acknowledgements 130References 1304 Forensic Authentication of Digital Audio and Video Files 1334.1 Introduction 1334.2 Examination Requests and Submitted Evidence 1344.3 Laboratory Space 1384.4 Laboratory Software and Equipment 1384.5 Audio/Video Authentication Examinations 1474.6 Preparation of Work Notes and Laboratory Reports 1714.7 Expert Testimony 1724.8 Case Examples 1734.9 Discussion 177References 178PART TWO DIGITAL EVIDENCE EXTRACTION5 Photogrammetry in Digital Forensics 1855.1 Introduction 1855.2 Different Methods 1885.3 Measurement Uncertainty 1945.4 Case Studies 1955.5 3D Modelling/Scenario Testing 2125.6 Summary 217References 2176 Advanced Multimedia File Carving 2196.1 Introduction 2196.2 Digtal Data Storage 2206.3 File Carving of Binary Data 2256.4 Multimedia Data Structures 2266.5 File Carving of Multimedia Data 2326.6 Content Identification 2416.7 File Carving Frameworks 2536.8 Conclusions 264Acknowledgements 265References 2657 On Forensic Use of Biometrics 2707.1 Introduction 2707.2 Biometrics Performance Metrics 2737.3 Face: The Natural Means for Human Recognition 2747.4 Ears as a Means of Forensic Identification 2837.5 Conclusions 299References 2998 Multimedia Analytics for Image Collection Forensics 3058.1 Introduction 3058.2 Data and Tasks 3088.3 Multimedia Analysis 3098.4 Visual Analytics Processes 3128.5 ChronoBrowser 3138.6 MediaTable 3208.7 An Example Scenario 3238.8 Future Outlook 325References 326PART THREE MULTIMEDIA DEVICE AND SOURCE FORENSICS9 Forensic Camera Model Identification 3319.1 Introduction 3319.2 Forensic Source Identification 3339.3 Digital Camera Model Identification 3379.4 Benchmarking Camera Model Identification Algorithms 3399.5 Model-Specific Characteristics of Digital Camera Components 3419.6 Black Box Camera Model Identification 3519.7 Camera Model Identification in Open Sets 3649.8 Model-Specific Characteristics in Device-Level Identification 3669.9 Open Challenges Towards Practical Applications 368References 37010 Printer and Scanner Forensics 37510.1 Introduction 37510.2 Printer Forensics 37910.3 Scanner Forensics 38610.4 Photocopier Identification 38910.5 Forgery Detection for Printed and Scanned Documents 39110.6 Sample Algorithms with Case Studies 39610.7 Open Problems and Challenges 40610.8 Conclusions 408Acknowledgements 408References 40811 Microphone Forensics 41111.1 Introduction 41111.2 Pattern Recognition for Microphone Forensics 41411.3 Guidelines for Microphone Registration 42111.4 Case Studies 42311.5 Chapter Summary 435Acknowledgements 436References 43712 Forensic Identification of Printed Documents 44212.1 Introduction 44212.2 Special Materials 44912.3 Substrate Forensics 45012.4 Print Forensics 45512.5 Real World Example: Currency Protection 47312.6 Summary and Ecosystem Considerations 475References 478PART FOUR MULTIMEDIA CONTENT FORENSICS13 Digital Image Forensics with Statistical Analysis 48313.1 Introduction 48313.2 Detecting Region Duplication 48813.3 Exposing Splicing Forgery 50013.4 Case Studies 50813.5 Other Applications 51213.6 Summary 515References 51714 Camera-Based Image Forgery Detection 52214.1 Introduction 52214.2 Camera Structure 52414.3 Camera-Based Forgery Detection Methods 53514.4 Forgery Detection Based on PFA: A Case Study 54814.5 Conclusion 564References 56515 Image and Video Processing History Recovery 57215.1 Introduction 57215.2 Coding Artefacts 57315.3 Editing Artefacts 58615.4 Estimation of Processing Parameters 59015.5 Case Studies 60115.6 Conclusions 605References 60716 Anti-Forensics of Multimedia Data and Countermeasures 61216.1 Introduction 61216.2 Anti-forensic Approaches Proposed in the Literature 61316.3 Case Study: JPEG Image Forensics 62316.4 Trade-off between Forensics and Anti-forensics 64416.5 Conclusions 647References 647Index 653

Anthony T.S. Ho, Department of Computing, University of Surrey, UKProf. Ho holds the Personal Chair in Multimedia Security and is currently the Head of the Department of Computing at the University of Surrey. He is a Fellow of the Institution of Engineering and Technology (FIET), a Chartered Electrical Engineer (CEng), Fellow of British Computer Society (FBCS) and a Senior Member of IEEE. He was the recipient of the IET Innovation in Engineering Award (2006) for his research and commercialisation work on digital watermarking in 2006. Prof. Ho is a member of the IEEE Signal Processing Society Technical Community on Information Forensics and Security. He is the editor-in-chief of the international journal Information Security Technical Reports, which covers digital forensics as one of its key topics. He is also the co-editor-in-chief of International Journal of Digital Crime and Forensics which publishes research papers on both digital and multimedia forensics.Shujun Li, Department of Computing, University of Surrey, UKDr. Li is a Senior Lecturer in the Department of Computing at the University of Surrey. Dr Li received his PhD degree in Information and Communication Engineering in 2003 from Xi’an Jiaotong University, China. He has published more than 70 scientific papers at various international journals and conferences. Dr. Li is on the editorial board of Information Security Technical Reports. He is a Senior Member of the IEEE and a Professional Member of the ACM. He is a member of the IEEE Communications Society Technical Committee on Multimedia Communications and of the IEEE Circuits and Systems Society Technical Committee on Nonlinear Circuits & Systems. He is an active contributor to the ISO/IEC RVC standard as a member of the MPEG.

Select Guide Rating

• List of Contributors xviiForeword xixPreface xxiAcknowledgements xxviiPART ONE MULTIMEDIA EVIDENCE HANDLING1 Digital Forensics Laboratories in Operation: How Are Multimedia Data and Devices Handled? 31.1 Introduction 31.2 Digital and Electronics Forensic Service, Metropolitan Police Service, UK 41.3 Digital Forensics Team (Including Affiliated AV Team), Surrey Police, UK 171.4 Shanghai Stars Digital Forensic Centre, Third Research Institute of China’s Ministry of Public Security 231.5 Discussions 281.6 Summary 321.A Appendix: Questionnaires for Interviewing Surrey Police and Shanghai Stars Digital Forensic Centre 32References 342 Standards and Best Practices in Digital and Multimedia Forensics 382.1 Introduction 382.2 Overview 392.3 Electronic Evidence and Digital Forensics 482.4 Multimedia Evidence and Multimedia Forensics 702.5 Digital Forensics Laboratory Accreditation 772.6 General Quality Assurance (Management) 792.7 Training, Education and Certification on Digital and Multimedia Forensics 812.8 Conclusions 84Acknowledgements 86References 863 A Machine Learning-Based Approach to Digital Triage 943.1 Introduction 943.2 Related Work on Digital Triage 963.3 A Machine Learning-Based Digital Triage Framework 1003.4 A Child Pornography Exchange Case Study 1103.5 Conclusion 1283.6 Challenges and Future Directions for the Digital Forensics Community 128Acknowledgements 130References 1304 Forensic Authentication of Digital Audio and Video Files 1334.1 Introduction 1334.2 Examination Requests and Submitted Evidence 1344.3 Laboratory Space 1384.4 Laboratory Software and Equipment 1384.5 Audio/Video Authentication Examinations 1474.6 Preparation of Work Notes and Laboratory Reports 1714.7 Expert Testimony 1724.8 Case Examples 1734.9 Discussion 177References 178PART TWO DIGITAL EVIDENCE EXTRACTION5 Photogrammetry in Digital Forensics 1855.1 Introduction 1855.2 Different Methods 1885.3 Measurement Uncertainty 1945.4 Case Studies 1955.5 3D Modelling/Scenario Testing 2125.6 Summary 217References 2176 Advanced Multimedia File Carving 2196.1 Introduction 2196.2 Digtal Data Storage 2206.3 File Carving of Binary Data 2256.4 Multimedia Data Structures 2266.5 File Carving of Multimedia Data 2326.6 Content Identification 2416.7 File Carving Frameworks 2536.8 Conclusions 264Acknowledgements 265References 2657 On Forensic Use of Biometrics 2707.1 Introduction 2707.2 Biometrics Performance Metrics 2737.3 Face: The Natural Means for Human Recognition 2747.4 Ears as a Means of Forensic Identification 2837.5 Conclusions 299References 2998 Multimedia Analytics for Image Collection Forensics 3058.1 Introduction 3058.2 Data and Tasks 3088.3 Multimedia Analysis 3098.4 Visual Analytics Processes 3128.5 ChronoBrowser 3138.6 MediaTable 3208.7 An Example Scenario 3238.8 Future Outlook 325References 326PART THREE MULTIMEDIA DEVICE AND SOURCE FORENSICS9 Forensic Camera Model Identification 3319.1 Introduction 3319.2 Forensic Source Identification 3339.3 Digital Camera Model Identification 3379.4 Benchmarking Camera Model Identification Algorithms 3399.5 Model-Specific Characteristics of Digital Camera Components 3419.6 Black Box Camera Model Identification 3519.7 Camera Model Identification in Open Sets 3649.8 Model-Specific Characteristics in Device-Level Identification 3669.9 Open Challenges Towards Practical Applications 368References 37010 Printer and Scanner Forensics 37510.1 Introduction 37510.2 Printer Forensics 37910.3 Scanner Forensics 38610.4 Photocopier Identification 38910.5 Forgery Detection for Printed and Scanned Documents 39110.6 Sample Algorithms with Case Studies 39610.7 Open Problems and Challenges 40610.8 Conclusions 408Acknowledgements 408References 40811 Microphone Forensics 41111.1 Introduction 41111.2 Pattern Recognition for Microphone Forensics 41411.3 Guidelines for Microphone Registration 42111.4 Case Studies 42311.5 Chapter Summary 435Acknowledgements 436References 43712 Forensic Identification of Printed Documents 44212.1 Introduction 44212.2 Special Materials 44912.3 Substrate Forensics 45012.4 Print Forensics 45512.5 Real World Example: Currency Protection 47312.6 Summary and Ecosystem Considerations 475References 478PART FOUR MULTIMEDIA CONTENT FORENSICS13 Digital Image Forensics with Statistical Analysis 48313.1 Introduction 48313.2 Detecting Region Duplication 48813.3 Exposing Splicing Forgery 50013.4 Case Studies 50813.5 Other Applications 51213.6 Summary 515References 51714 Camera-Based Image Forgery Detection 52214.1 Introduction 52214.2 Camera Structure 52414.3 Camera-Based Forgery Detection Methods 53514.4 Forgery Detection Based on PFA: A Case Study 54814.5 Conclusion 564References 56515 Image and Video Processing History Recovery 57215.1 Introduction 57215.2 Coding Artefacts 57315.3 Editing Artefacts 58615.4 Estimation of Processing Parameters 59015.5 Case Studies 60115.6 Conclusions 605References 60716 Anti-Forensics of Multimedia Data and Countermeasures 61216.1 Introduction 61216.2 Anti-forensic Approaches Proposed in the Literature 61316.3 Case Study: JPEG Image Forensics 62316.4 Trade-off between Forensics and Anti-forensics 64416.5 Conclusions 647References 647Index 653