Digital Still Camera Forensics

In many instances computer forensic practitioners come across digital photographs within an investigation. Examples include law enforcement examining computers for child pornography, intellectual property disputes involving proprietary digital images, or file recovery for individuals who have lost personal photos due to accidental deletion or electronic media corruption. More technical examples include locating steganographic images and digital rights management. Photographic images residing on electronic media most likely originated from digital still cameras (“DSC”). To identify the origin of a DSC image, a forensic examiner should understand the characteristics of a DSC image. This paper describes some of the characteristics associated with DSC images. Knowledge allows a forensic practitioner to isolate specific attributes within a DSC image to identify exact replicas, derivates, or additional images that fall within a particular group set. This paper further outlines some open source software that can be used to extract images based upon the characteristics of a DSC image.