‭A Mini - Project on‬

‭Design and develop a tool for digital forensic of images.‬

‭SUBMITTED TO THE SAVITRIBAI PHULE PUNE UNIVERSITY, PUNE‬

‭FOURTH YEAR ENGINEERING‬

‭(COMPUTER ENGINEERING)‬

‭SUBMITTED BY:‬

‭ agar Sameer J‬
P ‭[BE - B - 27]‬
‭Shukla Advait Upendra [BE - B - 41]‬
‭Tupe Yogesh Atul‬ ‭[BE - B - 50]‬

‭In the subject of‬

‭Cyber Security and Digital Forensics‬

‭Under the guidance of‬

‭Ms. T. S. Atre‬

‭DEPARTMENT OF COMPUTER ENGINEERING‬

‭GES’S R H SAPAT COE MANAGEMENT STUDIES AND RESEARCH‬

‭PRIN T A KULKARNI VIDYANAGAR, NASHIK - 422005‬

‭SAVITRIBAI PHULE PUNE UNIVERSITY‬

‭2024 -2025‬
1. Introduction
In the digital age, images are frequently used as evidence in legal and investigative contexts. However, with
the rise of image manipulation tools and techniques, ensuring the authenticity and integrity of digital images
has become crucial. This project aims to design and develop a digital forensic tool for images, which will
help investigators verify the originality of an image and detect any modifications. The purpose of this tool is
to support digital forensic investigations by providing a reliable method to analyze and validate image files.

2. Definition of Digital Image Forensics

Digital image forensics refers to the process of examining digital images to determine their authenticity,
detect signs of manipulation, and gather metadata that can be used in legal and investigative settings. This
forensic process includes analyzing aspects such as file metadata, hash values, image noise, and pixel
patterns. The primary goal of the tool is to automate the extraction of this information, helping investigators
easily identify if an image has been altered.

3. Tool Functionality
The developed tool will offer several core functions:
• Image Metadata Analysis: Extracts key metadata such as the camera model, date/time of capture,
location, and software used to edit the image.
• Hash Value Generation: Uses hashing algorithms (e.g., MD5, SHA-256) to generate unique
identifiers for the image, which can be used to verify its integrity over time.
• Image Tampering Detection: Analyzes the image to identify potential tampering by looking for
inconsistencies in pixel noise, image structure, or digital watermarks.
• Comparison with Original: Allows users to compare two versions of the same image, highlighting
differences and alterations.

4. Characteristics of Forensic Tools and Users

The digital forensic tool for images is specifically designed for professionals working in various domains
of digital investigations and legal cases where image evidence is critical. These users include law
enforcement officers, forensic analysts, and cybersecurity experts who deal with crimes involving digital
images, such as identity fraud, intellectual property theft, and cyber harassment.
4.1. Primary Users
• Law Enforcement Officers: These professionals are responsible for collecting, analyzing, and
presenting digital evidence in criminal cases. For them, the forensic tool must be user-friendly,
capable of quickly verifying the authenticity of an image. They need a tool that can detect tampering
and provide a detailed report on image integrity that can be used in court. For law enforcement,
speed and accuracy are key since they often work under time constraints during investigations.
• Forensic Analysts: Specialists trained in digital forensics who require in-depth analysis of image
data. Forensic analysts will use the tool to extract technical metadata, such as camera details,
timestamps, GPS data, and any software used for editing. They rely on this tool to uncover minute
details that could reveal traces of tampering, such as inconsistent noise patterns or suspicious pixel
modifications. The tool’s ability to delve into file structure and detect anomalies is critical to their
work.
 • Cybersecurity Experts: Cybersecurity professionals working on cases related to data breaches,
image-based threats (such as extortion or deepfake blackmail), or intellectual property violations
would use the tool to authenticate images and ensure they haven’t been manipulated.
4.2. Technical Characteristics of the Tool
• Hashing Algorithms: The tool incorporates cryptographic hashing algorithms such as MD5 or
SHA-256 to create a unique digital signature or hash value for each image. This hash is essential for
verifying whether an image has been altered in any way. A single change in the image would result in
a completely different hash value, enabling investigators to quickly determine whether the image has
been tampered with.
• Noise Analysis: One of the key techniques used in image forensics is analyzing noise patterns.
Digital images often contain noise, or slight variations in pixel values, introduced either by the
camera sensor or during image compression. Manipulating an image—whether by adding or
removing objects, altering the lighting, or using software like Photoshop—can disrupt these natural
noise patterns. The forensic tool leverages sophisticated algorithms to identify these inconsistencies,
indicating possible manipulation.
• Image Processing and Metadata Extraction: The tool uses image processing techniques to
extract embedded metadata from image files. This metadata often includes the make and model of
the camera used, timestamps, geolocation (if available), and any software used to edit the image.
Metadata can be a vital part of an investigation, as it can show whether an image was altered after
capture, and provide a timeline for these modifications.
• Comparison Functionality: Forensic professionals may need to compare multiple images to
determine if any alterations have occurred between versions. The tool enables side-by-side
comparison of two images, highlighting differences in pixel structure, color distribution, and other
technical aspects. This feature is crucial when determining if an image has been doctored or if
multiple versions of the image exist.
4.3. Operational Needs
• Automation and Ease of Use: While the tool is built for highly trained professionals, its interface
must remain intuitive and accessible. Law enforcement officers with limited technical expertise
should be able to upload images, generate forensic reports, and understand the tool's results without
needing to manually analyze the image file. Automation of key tasks—such as hashing, noise
analysis, and metadata extraction—ensures that users can focus on decision-making rather than
manual data handling.
• Report Generation: The tool automatically generates detailed reports that include image metadata,
hash values, tampering analysis, and any detected anomalies. These reports must be clear, well-
structured, and presentable in court or investigative proceedings. The ability to generate exportable
reports (in formats such as PDF or CSV) is essential, especially in legal contexts where digital
evidence needs to be preserved and presented in a standardized manner.
• Scalability and Performance: The forensic tool should be able to process both small and large
image files, as well as batches of images, without significant delays. For investigations involving
multiple images or high-resolution content, the tool must maintain performance, providing rapid
analysis without sacrificing accuracy. This scalability is crucial for organizations like law
enforcement agencies or cybersecurity firms, where time-sensitive investigations may require the
processing of thousands of images.
5. Technical Challenges
Developing a robust digital forensic tool for images presents several challenges. One of the primary
obstacles is dealing with different image formats and compression techniques that can affect the analysis.
Additionally, detecting advanced forms of manipulation such as deepfakes or subtle pixel alterations
requires sophisticated algorithms capable of analyzing the image at both macro and micro levels. Ensuring
the tool runs efficiently while processing high-resolution images is another key challenge.

6. Implementation Details (Code Related)

The core functionalities of the digital forensic tool are centered around a few key processes, primarily
focusing on metadata extraction, hash generation, and image tampering detection. Here's a breakdown of the
technologies and methods used in the code for each of these functionalities:
6.1. Metadata Extraction
The tool uses the Python library Pillow to extract metadata from the image, specifically EXIF data. The code
accesses this metadata to retrieve details such as the camera make and model, timestamp, and any GPS data
embedded in the image.

This code opens the image and extracts its EXIF metadata, which is then printed or displayed in a user-
friendly format in the tool.
6.2. Hash Generation
The tool uses cryptographic algorithms such as MD5 and SHA-256 from Python's hashlib library to
generate a unique hash value for each image. This is crucial for checking the integrity of the image.
Example code for generating a hash:

This function reads the binary data of the image and generates a hash (either MD5 or SHA-256) based on
the selected algorithm.
6.3. Tampering Detection (Pixel-level Analysis)
To detect tampering in images, the tool compares pixel data and looks for irregularities using libraries like
OpenCV. For example, it can perform Error Level Analysis (ELA), which detects image regions that have
been altered by comparing compression artifacts.
Here’s an example of ELA analysis code:

This code compares the original image with its compressed version and highlights any differences, which
might indicate tampering. The resulting image can be displayed to users to visually inspect for anomalies.
6.4. User Interface
The tool provides an interface that allows users to upload images and initiate analyses with just a few clicks.
A simple Flask or Django application could be used to enable this web-based interaction, where users select
an image file, and the tool displays metadata, hash values, and tampering analysis results.
The combination of these functionalities forms the backbone of the digital forensic tool, ensuring that it can
perform reliable image analysis to assist investigators.
7. Code:
metadata_extractor.py
import exifread

def extract_metadata(image_path):
with open(image_path, 'rb') as img_file:
tags = exifread.process_file(img_file)
for tag in tags.keys():
print(f"{tag}: {tags[tag]}")

if __name__ == "__main__":
image_path = 'Test_1.jpg' # Replace with the image file path
extract_metadata(image_path)

ela_analysis.py
from PIL import Image, ImageChops, ImageEnhance

def error_level_analysis(image_path, output_path):

original = Image.open(image_path)
original.save(output_path, 'JPEG', quality=95)

compressed = Image.open(output_path)
diff = ImageChops.difference(original, compressed)

diff = ImageEnhance.Brightness(diff).enhance(30)
diff.save('ela_result.jpg')

print("ELA completed. Check 'ela_result.jpg'.")

if __name__ == "__main__":
image_path = 'Test_1.jpg' # Replace with your image
output_path = 'compressed.jpg' # Temporary compressed image
error_level_analysis(image_path, output_path)
hash_comparison.py
import hashlib

def generate_hash(image_path):
hasher = hashlib.md5()
with open(image_path, 'rb') as img_file:
buf = img_file.read()
hasher.update(buf)
return hasher.hexdigest()

if __name__ == "__main__":
image_path = 'Test_1.jpg' # Replace with your image
hash_value = generate_hash(image_path)
print(f"MD5 Hash: {hash_value}")

8. Output:
Original Image

MD5 Hash: a0582c9c57a680cfaceaa1612082fb1b

Tampered Image

MD5 Hash: 13e8de9f488219659c0b57867cfe7d37

9. Impact and Legacy

The digital forensic tool for images has the potential to become a valuable asset for digital investigators,
providing an automated solution for image analysis and integrity verification. By incorporating key features
like metadata extraction, hash generation, and tampering detection, the tool will simplify and streamline the
forensic process. Its adoption in legal and investigative fields could help enhance the credibility of digital
evidence, supporting the fight against cybercrime, fraud, and image-based manipulation.

10. Conclusion
The development of this digital forensic tool for images addresses a critical need in the field of digital
investigations. As image manipulation becomes more sophisticated, forensic tools must evolve to provide
reliable ways to authenticate and analyze digital content. By combining metadata analysis, hash generation,
and tampering detection, this tool offers a comprehensive solution for verifying the authenticity of images,
ensuring that they can be used as trustworthy evidence in both legal and investigative contexts.