Identifying Edited Photos with JPEGsnoop

About JPEGsnoop

JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity. Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious. You can download JPEGsnoop here.

How It Working

Simply open an image in JPEGsnoop and scroll down to the section titled, *** Searching Compression Signatures ***. This option can be enabled/disabled with the Signature Search item in the Options menu.

The utility will compare the compression characteristics of the photo against an internal database of thousands of camera "signatures" to locate a match. If a match is found, the matching digital camera or editor is shown. If the signature matches a photo editor (such as Photoshop), then there is a good chance that the photo has been edited (i.e. not original!).

Examples :

Not Original (fake.jpg)                                                  Original (original.jpg)

I have two pictures, one is original and others are fake. How do we detect this using JPEGsnoop :

Here's the JPEGsnoop log for fake.jpg

*** Searching Compression Signatures ***

  Signature:           01A20F69263117021CD16AEF44D6E650
  Signature (Rotated): 01A20F69263117021CD16AEF44D6E650
  File Offset:         0 bytes
  Chroma subsampling:  1x1
  EXIF Make/Model:     OK   [Canon] [Canon DIGITAL IXUS 700]
  EXIF Makernotes:     NONE
  EXIF Software:       OK   [Adobe Photoshop CS Windows]

  Searching Compression Signatures: (3314 built-in, 0 user(*) )

          EXIF.Make / Software        EXIF.Model                            Quality           Subsamp Match?
          -------------------------   -----------------------------------   ----------------  --------------
     SW :[Adobe Photoshop          ]                                       [Save As 08      ]                 

  NOTE: Photoshop IRB detected
  NOTE: EXIF Software field recognized as from editor
  ASSESSMENT: Image is processed/edited

And for original.jpg

*** Searching Compression Signatures ***

  Signature:           01A84EC0DDFAE937A0336DB825C85028
  Signature (Rotated): 01A9B171AA8560DD8EA55A93D29361E4
  File Offset:         0 bytes
  Chroma subsampling:  2x1
  EXIF Make/Model:     OK   [Canon] [Canon DIGITAL IXUS 700]
  EXIF Makernotes:     OK 
  EXIF Software:       NONE

  Searching Compression Signatures: (3314 built-in, 0 user(*) )

          EXIF.Make / Software        EXIF.Model                            Quality           Subsamp Match?
          -------------------------   -----------------------------------   ----------------  --------------
     CAM:[Canon                    ] [Canon DIGITAL IXUS 330             ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon DIGITAL IXUS 40              ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon DIGITAL IXUS 400             ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon DIGITAL IXUS 50              ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon DIGITAL IXUS 70              ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon DIGITAL IXUS 700             ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon DIGITAL IXUS 850 IS          ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon DIGITAL IXUS 900Ti           ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A20                ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A520               ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A620               ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A630               ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A640               ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A650 IS            ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A710 IS            ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A720 IS            ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A75                ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot A95                ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot G2                 ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot G6                 ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot G7                 ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot S2 IS              ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot S200               ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot S3 IS              ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot S30                ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot S45                ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot S80                ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot SD300              ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot SD400              ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot SD800 IS           ] [fine            ] Yes             
     CAM:[Canon                    ] [Canon PowerShot SD950 IS           ] [fine            ] Yes             

  ASSESSMENT: Image is original


JPEGsnoop result for fake.jpg is assessting it would been the edited one using Adobe Photoshop CS. Very good guess.

With this application we can also analyse fake photos on web, for example hot celebrities photo. I would like give an example one of indonesian artist photos who lately being publish in web. SD

Here are the log for the artist picture :

    Y= 1000.. 1007: 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000,
    Y= 1008.. 1015: 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000,
    Y= 1016.. 1023: 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000,
 
*** Marker: EOI (End of Image) (xFFD9) ***
  OFFSET: 0x000019F0


*** Searching Compression Signatures ***

  Signature:           013BA18D5561625796E986FDBC09F846
  Signature (Rotated): 01AC57E12793DFA7C46C704625C5AF0F
  File Offset:         0 bytes
  Chroma subsampling:  2x2
  EXIF Make/Model:     NONE
  EXIF Makernotes:     NONE
  EXIF Software:       NONE

  Searching Compression Signatures: (3314 built-in, 0 user(*) )

NOTE: JFIF COMMENT field is known software
  ASSESSMENT: Image is processed/edited

From the result, it was not original picture (have been processed/edited before).

JPEGsnoop is small but very usefull utility. It was develop by Calvin Hass.