Hi J
It is a powershot S20. I guess here is what I pose… A thumbnail, embeded in the larger JPEG. must it be identical?
Thanks,
Brian
"must" is a tricky word brian. think about it. if this guy can "extract" a thumbnail with a hex editor, what’s stopping him from embedding or replacing one…?
We’re looking through a pin hole. Maybe an explanation of why this matters in a court case may allow a better response.
Also, thumbnails tend to be small (200 to 100 pixels across) compared to the original image (4000 to 1000 pixels across).
And some image editors fail to update the thumbnail when altering the main image.
Hi Jim,
Great question.
I hope I can explain this well enough.
I have an image "Dog" > Dog has a logo on it. I have a reference image called "Dog Reference" this does not have a logo on it. Both images came from a Powershot S20. Same q tables.
These images appear to be identical, with the exception of the image size and logo imposed on "Dog"
Using a hex editor, a "Raw" thumbnail image was extracted from the "Dog Reference" image. The "raw" image is in lanscape mode and lack the logo in "Dog" image.
Question: Does the Raw image represent an unaltered depiction of the "Dog" image at the time the photo was captured, before the size and logo changes to the "Dog" image?
Any thoughts?
Thanks, Brian
Brian Carne wrote: The other side says that they can use a hex editor and carve out a >thumbnail from a JPEG.
dave milbut wrote: if this guy can "extract" a thumbnail with a hex editor, what’s >stopping him from embedding or replacing one…?
I tend to think that this would only be feasible if the thumbnail is a full image in itself isolated by a separate initialization sequence in the meta data section. Otherwise, unless he is a coder himself or a wizard of hex math, it may be tricky to replace data in a dynamically compressed stream. The tampering would quickly show by monochrome colored blocks or rainbow colors due to the color being unreconstructable correctly. 😉
Mylenium
the thumbnail is a full image in itself isolated by a separate initialization sequence in the meta data section
It is. 256 color index and all.
Great J Maloney,
That is exactly what I am looking for. So If you change the image, by adding a logo or watermark, the metadata would change, and the thumbnail (in the metadat section) should update and change.
I hope I understand this correctly
Brian
So If you change the image, by adding a logo or watermark, the metadata would change, and the thumbnail (in the metadat section) should update and change.
No. I was stating the opposite. It would be entirely up to the software editing the image to choose when and why the thumbnail would be updated. OTHERWISE IT WOULD REMAIN AS IT WAS ORIGINALLY WRITTEN. My understanding is that files do not update themselves.
I was speaking to Mylen’s post about the possibility the thumbnail was not a separate set of data from the image.
Otherwise, unless he is a coder himself or a wizard of hex math,
yes, that was my expectation when he said the guy was using a hex editor to extract the data. if the thumb is know to exist at offset 123456 and last for 1234 bytes – always – then it would be pretty easy to replace that data with "other" data for someone who knows what they’re doing…
if the thumb is know to exist at offset 123456 and last for 1234 bytes – always – then it would be pretty easy to replace that data with "other" data for someone who knows what they’re doing.
I most certainly do not know what I’m doing but have easily edited JFIF segments. Copying and pasting a new "dog" thumb from another image wouldn’t be much harder.
Dave,
Is the offset different for each image? Is there a "sub-header" for a thumbnail? I wish there was some
In Encase, I sort of guess to find the thumb, basically swipe the first few sectors of a file. Brian
Brian,
Sorry for sounding stupid here, but I am trying to figure out why you need to know about the thumbnail if you have the original image.
The only thing that I can think of is that because one has the time stamp and the other does not, that you are trying to determine if the full size image is genuine.
Is the offset different for each image? Is there a "sub-header" for a thumbnail?
Read the second link in post 1.
Is the offset different for each image?
i’d guess it was the same. and that there’s a limit (or multiple) on the amt of space it takes. you could go read the jpg spec if you really needed to know.
swipe the first few sectors of a file.
no. it’ll be part of the spec and in the exact same place every time. if it’s a true jpeg…
<
http://www.jpeg.org/jpeg/index.html>
Read the second link in post 1.
yes. that’ll work too. 😉
Thanks guys….here is the actual aprt of the report in question….does this make sense to anyone?
Can a thumbnail from a reference image, (without a logo) prove the refrence image is the same as the target image
.read the opposing sides report below.
==========Report starts here
Using a hex editor a thumbnail image was extracted from a reference images, and examined. In the image a raw thumbnail image was located.
This raw thumbnail image is in landscape mode and lacks the superimposed logo observed in the full size target image.
Furthermore, the quantization tables used to encode the raw thumbnail image was found to correspond to the quantization tables used by other CANON POWERSHOT S20 camera. (The same camera as the target image.
Therefore it can be concluded that the raw thumbnail image represents an unaltered depiction of the scene at the time the photograph was captured. The presence of the logo in the full size target image indicates that this feature was added to the image after the original image was taken.
My understanding is that quantization tables are pretty much uniform across a camera brand and quality setting, so I doubt any similarities there mean much.
It does seem to me more likely that the thumbnail reflects the original capture. But by the same logic that allows this deduction, you can easily come up with plausible scenarios where the thumbnail would mean nothing: the photo was edited in software where the thumb was updated, then edited again in other software where the thumb was not updated.
Tests indicate that editing in PS does generate new tables, but doing so in iPhoto does not. Again, I’ll stress that I know just enough to f*ck sh*t up, and my free advice should be taken for what its worth.
