Image Analysis Report 1000-01

Case No. 1000-01

Conducted by: The Grave Hunters Society, LLC

Presented to: The Public

Researcher: Jonathan Batteas

Revision History

Date	Revision History	Comments
2014/26/10	0.01	Draft of Background Information
2020/06/03	0.1	First Report Draft
2020/06/24	1.0	Final Report

Current Version: 1.0

Confidential Information This report shall not be excerpted without prior written permission of The Grave Hunters Society, LLC

Table of Contents

• Executive Summary
  • part 1.1 - Summary of reasons for report
• Background
  • part 2.1 - In-depth background surrounding the creation of the evidence
• Objectives
  • part 3.1 - Specifics about purpose of report
• Evidence Analyzed
  • part 4.1 - Primary evidence including descriptions and classifications
  • part 4.2 - Secondary evidence including descriptions and classifications
• Methodology
  • part 5.1 - Tests performed and tools used
• Conclusions
  • part 6.1 - Conclusion statement
  • part 6.2 - Conclusion evidence
• Signature
  • part 7.1 - Researcher Signature
• Exhibits
  • part 8.1
    • Exhibit A - Chain of Custody
  • part 8.2
    • Exhibit B - Reference table for further explanation of tools and methods

Executive Summary

part 1.1

On October 25, 2014, Andrea Batteas captured an image that contains an unidentifiable mass. This report was written to preempt claims of digital manipulation, and as a continuation of original EXIF data and Error Level Analysis that was undertaken initially on October 26, 2014. This report is not meant to offer any explanation of what is visible within the photograph, only whether digital artifacts exist that might indicate any kind of digital manipulation.

Background

part 2.1

Originally recorded on October 26, 2014, by Jonathan Batteas.

Andrea and Jonathan Batteas went on the Ghosts and Goblets Quaker Hill Tour in Waynesville on Oct. 25, 2014. The tour ended around nine or 9:30, and they went back to the Museum in the Friends Home for a while, conversing with Linda and Mary at length.

Afterward, they went to the McDonalds on Main St. and had some ice cream. Later, they decided to walk to 237 S. Main St. to take pictures. The time was approximately 10:30. (The last photo at the museum has a timestamp of 10:08:05 from Andrea’s iPhone. Then, the next correct timestamp is 10:45:10 from Jonathan’s iPhone. So, this picture was taken sometime between 10:08 and 10:45.

Objectives

part 3.1

To present evidence to determine whether any digital manipulation of the image in question has taken place. The purpose of this report is not to offer an explanation, nor to determine what is pictured, only that the photograph itself is genuine.

Evidence Analyzed

part 4.1

The jpeg image extracted from the camera media titled DSCF0096.JPG (renamed to DSCF0096.jpg for file format recognition by Sherloq.) on October 25, 2014, which was immediately compressed in a zip format titled Oct 25 2014.zipalong with the rest of that evening’s photographs by myself (Jonathan Batteas). This zip file was kept in sync between multiple machines via Dropbox and Resilio Sync. Any analysis done on the image was performed on copies, verified by MD5 or SHA512 hash comparison.

Image Identification

Filename	DSCF0096.jpg
Size	1.2 MB
MD5	5af3897622be5bb259354c38518b0141
SHA512	02bcf7c1b2354f943c61899c528370b314d49a92efa79f01b1d37b7359946faeaba3d251d4a0f4dd91e4ef62e35b94416d12b496d436b1484943475004ee3c58
Comments

Image Classifications

A nighttime photograph, illuminated by a flash, containing an angled view of the facade of the building located at 237 S. Main St., Waynesville, OH. The front steps are visible. A gaseous shape of unknown substance and origin is located near the roof of the named building in the upper-left of the image. In the lower-right of the image foreground, a bush of purple flowers is visible. There is a white, diagonal shape in the extreme foreground along the right side of the image, making the edges of the image appear as if they are not square.

part 4.2

Secondary evidence exists in the form of contemporaneous photographs taken with an iPhone. These photographs are not considered in this report and will be the subject of their statement.

Methodology

part 5.1

Timeline

Date	Time	Process	Result	Comments
2020/04/19	18:51	Ghiro Automated Digital Image Forensics	Report	Automated report attached
2020/06/12	15:29	Check Quantization Table Matrix Against Known Table Database	Report	Comparing the quantization table of the image against a database of tables which contains known tables from: The Dresden Digital Image Set, The VISION Digital Image Set, The HDR Digital Image Set, Independent Jpeg Group Standard Tables, and Photoshop Tables.
2020/06/12	15:29	Check Quantization Table Matrix Against Quantization Table Database from the Same Device	Report	Since this camera is owned and operated by us, we have a backlog of 3268 photos against which we can run a quantization table comparison.
2020/06/13	12:30	Error Level Analysis using Sherloq	Report	Look for bright, white areas, or purple-red patterns around edges. These indicate a higher potential error level. The overall color should be consistent across the image.
2020/06/13	12:50	Principal Component Analysis Decomposition using Sherloq	Report	Examine first, second, and third principal components looking for mosaic artifacts, or differences in quality among areas of photograph.
2020/06/13	12:22	Luminance Gradient using Sherloq	Report	Look for consistent bumps representing noise, or at higher levels, consistent jagged lines. Flat areas and straight lines could indicate manipulation. Also, pay attention to the light direction and distribution to see that they are consistent.
2020/06/24	22:40	Echo Edge Filter using Sherloq	Report	Look for edges where there should be none, and artificial blurring.
2020/06/13	12:34	Noise Estimation using Sherloq	Report	Look for any pattern at all. Noise should appear consistent and have no underlying shape to indicate that noise was artificially added.

Conclusions

part 6.1

It is my expert opinion that based upon the evidence available in and around the image, that this image is in its original state as created by the camera, and has not undergone any secondary, digital manipulation.

part 6.2

The points supporting the above conclusion:

• EXIF information is consistent with the model of camera and indicates no software manipulation
• Quantization Table analysis matched no well-known software packages including Photoshop and IJG Standard tables
• Quantization Table did match tables from other images produced by the same camera
• Error Level Analysis shows a consistent level of compression throughout the image
• Principal Component Analysis shows very high consistency throughout the image
• The luminance gradient shows consistent lighting and no smooth areas. The edges of the buildings are very sharp, as expected in a photo brightly illuminated from a single direction (like a flash)
• Edge Filter shows no hard edges where they shouldn’t be
• Noise Estimation does show some blocking. However, this seems to be highlighted not by one area, but throughout the entire photo, based on very little noise being applied to the very hard edges of objects. Because of the consistency of noise away from edges, this could be indicative of the way the camera compressed the image

Signature

part 7.1

Printed Name	Signature	Date
Jonathan Batteas	[Signature — image not present in the surviving web copy]	2020/06/12

Exhibits

part 8.1

Exhibit A – Chain of Custody

Chain of Custody

part 8.2

Exhibit B – Reference

Name	Link
Using JPEG Quantization Tables to Identify Imagery Processed by Software	https://www.dfrws.org/sites/default/files/session-files/paper-using_jpeg_quantization_tables_to_identify_imagery_processed_by_software.pdf
VISION: a video and image dataset for source identification	https://link.springer.com/article/10.1186/s13635-017-0067-2
A Picture’s Worth: Digital Image Analysis and Forensics	http://www.hackerfactor.com/papers/bh-usa-07-krawetz-wp.pdf
Digital Image Ballistics from JPEG Quantization	https://farid.berkeley.edu/downloads/publications/tr06a.pdf
Body by Victoria	http://www.hackerfactor.com/blog/index.php?/archives/322-Body-By-Victoria.html