Articles ~ Skeptics Corner ~ Determining if a photograph has been altered in Photoshop using quantization tables

“Sometimes in order to tell a fake paranormal photo from a real one you first must be familiar with what the fake ones actually looks like.”

The idea is a simple one. If you can replicate the look of a “paranormal” photo in Photoshop, then surely the photo must be a fake. However something that is seen or recreated cannot be definitively proven to be a hoax, because the “analyst” wasn't there to witness the event.

Sound slightly illogical?

It is. The process being used is skipping a very important step in the scientific method.

“Assumptions are for asses” is a common phrase that is often used humorously to describe the flaw. A hypothesis (this ghost photo is faked) must be based on tangible data. So before we can assume that a ghost photo was created in Photoshop, we must first prove that the image was in that program or another image editor.

The problem with image editors extends well beyond the realm of the paranormal. Some photographic evidence presented by prosecutors in one criminal court case, was discovered to have been altered by Photoshop. The judge had no option but to thrown that evidence out because it had been tampered with (although it was discovered that the image had only been cropped).

As a result the FBI and other Federal agencies began to tackle the problem of how to determine if a photo was altered in image editing software. This article covers one of the techniques that they have implemented.

In computing, JPEG is a commonly used method of compression for photographic images. The degree of compression can be adjusted, allowing a selectable tradeoff between storage size and image quality. JPEG typically achieves 10:1 compression with little perceptible loss in image quality. JPEG compression is used in a number of image file formats. JPEG/Exif is the most common image format used by digital cameras and other photographic image capture devices; along with JPEG/JFIF, it is the most common format for storing and transmitting photographic images on the World Wide Web. These format variations are often not distinguished, and are simply called JPEG.

A vital code of the compression is called the JPEG quantization table. A JPEG-decoder will do the following: 1) Decode quantized DCT values (thru huffman encoding) from stream, 2) dequantize them with the quantizer tables, 3) perform an inverse DCT.

Different cameras use different quantization tables. Adobe Photoshop and other image editing software also have their own distinct quantization tables. When a photo is opened up in an editing program, photoshop for instance, it re-codes the original quantization table into its own. This enables you to work with the image and alter it. However, when the image is saved, it is saved with the quantization table of the image editing program. As a result, software can tell if a photo has been run through Photoshop or came from a source other than claimed.

Example of a Quantization Table The following diagram shows a typical luminance DQT found in a high-quality digital photo. Note that the numbers increase in magnitude as one approaches the bottom-right corner, which describes the amount of compression (loss) applied to high-frequency image components. Numbers towards the top-left corner (low-frequency & "DC") decrease as we typically don't want to discard this image information as the human visual system will tend to notice "errors" here. Comparison of Quantization Tables In trying to evaluate the differences between different software packages and their "quality settings" when saving to JPEG, The JPEGsnoop utility locates the offset of the JFIF marker tags within each image, and then extracts the linear stream of bytes from this marker, recreated the zig-zag representation of the quantization (DQT) coefficient matrix.

For comparison one photograph was entered in its original format through the program. The same picture was then put into photoshop and re-sized. The program notices the change in the quantization tables.

Unaltered JPG

Altered JPEG

Software of this nature cannot decipher exactly what was done to the image (re-sized, brightness adjust etc.). Regardless of what was done, photographs with incorrect quantization tables cannot be considered reliable for analysis because there is a possibility that the photo could have been manipulated. Only the the original, unaltered photograph can be considered.

"The burden of proof is upon the claimant"

If the claimant cannot produce the original unaltered photo, the claim is invalid.

Sources: http://www.impulseadventure.com, http://en.wikipedia.org/wiki/JPEG