Identifying Edited Photos with JPEGsnoop
About JPEGsnoop
JPEGsnoop is a free Windows application that examines and decodes the inner details of JPEG and MotionJPEG AVI files. It can also be used to analyze the source of an image to test its authenticity. Every digital photo contains a wealth of hidden information -- JPEGsnoop was written to expose these details to those who are curious. You can download JPEGsnoop here.
How It Working
Simply open an image in JPEGsnoop and scroll down to the section titled, *** Searching Compression Signatures ***. This option can be enabled/disabled with the Signature Search item in the Options menu.
The utility will compare the compression characteristics of the photo against an internal database of thousands of camera "signatures" to locate a match. If a match is found, the matching digital camera or editor is shown. If the signature matches a photo editor (such as Photoshop), then there is a good chance that the photo has been edited (i.e. not original!).
Examples :
Not Original (fake.jpg) Original (original.jpg)
I have two pictures, one is original and others are fake. How do we detect this using JPEGsnoop :
Here's the JPEGsnoop log for fake.jpg
*** Searching Compression Signatures ***
Signature: 01A20F69263117021CD16AEF44D6E650
Signature (Rotated): 01A20F69263117021CD16AEF44D6E650
File Offset: 0 bytes
Chroma subsampling: 1x1
EXIF Make/Model: OK [Canon] [Canon DIGITAL IXUS 700]
EXIF Makernotes: NONE
EXIF Software: OK [Adobe Photoshop CS Windows]
Searching Compression Signatures: (3314 built-in, 0 user(*) )
EXIF.Make / Software EXIF.Model Quality Subsamp Match?
------------------------- ----------------------------------- ---------------- --------------
SW :[Adobe Photoshop ] [Save As 08 ]
NOTE: Photoshop IRB detected
NOTE: EXIF Software field recognized as from editor
ASSESSMENT: Image is processed/edited
And for original.jpg
*** Searching Compression Signatures ***
Signature: 01A84EC0DDFAE937A0336DB825C85028
Signature (Rotated): 01A9B171AA8560DD8EA55A93D29361E4
File Offset: 0 bytes
Chroma subsampling: 2x1
EXIF Make/Model: OK [Canon] [Canon DIGITAL IXUS 700]
EXIF Makernotes: OK
EXIF Software: NONE
Searching Compression Signatures: (3314 built-in, 0 user(*) )
EXIF.Make / Software EXIF.Model Quality Subsamp Match?
------------------------- ----------------------------------- ---------------- --------------
CAM:[Canon ] [Canon DIGITAL IXUS 330 ] [fine ] Yes
CAM:[Canon ] [Canon DIGITAL IXUS 40 ] [fine ] Yes
CAM:[Canon ] [Canon DIGITAL IXUS 400 ] [fine ] Yes
CAM:[Canon ] [Canon DIGITAL IXUS 50 ] [fine ] Yes
CAM:[Canon ] [Canon DIGITAL IXUS 70 ] [fine ] Yes
CAM:[Canon ] [Canon DIGITAL IXUS 700 ] [fine ] Yes
CAM:[Canon ] [Canon DIGITAL IXUS 850 IS ] [fine ] Yes
CAM:[Canon ] [Canon DIGITAL IXUS 900Ti ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A20 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A520 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A620 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A630 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A640 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A650 IS ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A710 IS ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A720 IS ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A75 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot A95 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot G2 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot G6 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot G7 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot S2 IS ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot S200 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot S3 IS ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot S30 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot S45 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot S80 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot SD300 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot SD400 ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot SD800 IS ] [fine ] Yes
CAM:[Canon ] [Canon PowerShot SD950 IS ] [fine ] Yes
ASSESSMENT: Image is original
JPEGsnoop result for fake.jpg is assessting it would been the edited one using Adobe Photoshop CS. Very good guess.
With this application we can also analyse fake photos on web, for example hot celebrities photo. I would like give an example one of indonesian artist photos who lately being publish in web. SD
Here are the log for the artist picture :
Y= 1000.. 1007: 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000,
Y= 1008.. 1015: 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000,
Y= 1016.. 1023: 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000, 0x000000,
*** Marker: EOI (End of Image) (xFFD9) ***
OFFSET: 0x000019F0
*** Searching Compression Signatures ***
Signature: 013BA18D5561625796E986FDBC09F846
Signature (Rotated): 01AC57E12793DFA7C46C704625C5AF0F
File Offset: 0 bytes
Chroma subsampling: 2x2
EXIF Make/Model: NONE
EXIF Makernotes: NONE
EXIF Software: NONE
Searching Compression Signatures: (3314 built-in, 0 user(*) )
NOTE: JFIF COMMENT field is known software
ASSESSMENT: Image is processed/edited
From the result, it was not original picture (have been processed/edited before).
JPEGsnoop is small but very usefull utility. It was develop by Calvin Hass.
- roemasa's blog
- Add new comment
- 1519 reads