Photo Forensics from Thumbnails

At the time of initial recording, most cameras generate a thumbnail sized version of the full resolution image. Thumbnails are themselves typically stored as a JPEG image and embedded within the header of the full resolution image. A thumbnail is used to preview the image thus avoiding having to load and display the full resolution image. The process by which a thumbnail is created and stored is somewhat distinct across different camera manufacturers and photo editing software. As a result, the image thumbnail, an often over-looked part of a digital image, can be useful in an image forensic setting.

Shown below are two magnified (200%) thumbnails. The thumbnail on the left was generated directly from a Canon PowerShot S500. The thumbnail on the right was generated by Photoshop CS5 (after simply opening and re-saving the image). Most notably, the original thumbnail on the left is more blurry than the thumbnail on the right. Although not visually apparent the JPEG compression parameters are also different.

[Photo credit: Hany Farid]

A thumbnail is typically on the order of 160 x 120 pixels in resolution. Given a full resolution image, a thumbnail is created by a series of six basic steps: crop, filter (blur), re-size, filter (sharpen), adjust contrast and brightness, and JPEG compress. The specifics of these steps varies across different camera manufacturers and photo editing software. For example, in the above example, it is clear that Photoshop applies a stronger sharpening filter to the thumbnail than does Canon (or possibly, Canon applies a stronger blur filter).

Because photo editing software will regenerate the image thumbnail, the characteristics of a thumbnail can be used in an image forensic setting to determine if an image has been altered from the time of its initial recording. Some software will remove the thumbnail, so if it is known that the camera in question generates a thumbnail at the time of recording (not all cameras/cellphones do), then the absence of a thumbnail can be used as evidence of editing.

To be broadly applicable, it is necessary to characterize how different cameras and software generate thumbnails (see “Digital Image Authentication from Thumbnails” for more details). Once characterized, the thumbnail can be highly effective at determining an image’s provenance.