how to view the face ! need help on JPEG forensics

[NITINCEH]

Hello All,

I am looking for some help on getting some images fixed, since these images i cannot upload or post to the forums due to the LEGAL and privacy issues,

I am investigating a case, well I am a Cybercrime investigator but i do not posess much information about JPEG forensics.

I am handling a case in which the pics are recovered from the forums and some from the Suspects HDD and to my shock the Thumbs.db is missing, FTK and Encase is still showing me up those modified / Doctored images.

I am looking a way by which i am able to recognize the face as it was in the original Photo taken by Sony Cybershot and Kodak express Digicams.

some of the images still has some Exif data stored, but majority of them are not having exif related metadata, maybe the suspect had used "Save for web" options or some tool which could have stripped off the exif data.

so now the pics what i have investigated into are only the JPEGS with no face shown/visible due to the usage of Photoshop ver 7.0, since some exif related data has revealed that PSv7.0 had been used.

now the JPEG has the face but which is been patched either with black color / or white color or patch or some special effects only covering the face.

and i did confirmed that there are no layers available, which i thought might help me a list of layers prior to editing the JPEG's

I would request the experts in this forum to help me or atleast suggest me some information on how to get the original image with face visible or image re-construction.

Also if someone can guide me through the process of how to recover/restore the same, It would be really helpful.

As i really need to get hold of this evidence, since this is a civil case, due to privacy issues i cannot submit the evidence.

If required i can post my photographs with the same alterations done.

I am sorry as i havent gone through the forum rules and posts if a similar post exists.

Thanks.

Nitin Kushwaha
CHFI
INDIA

-------------------------------------------------------------------
Hi all,

this is my 2nd post,

As already mentioned in my earlier post, i am handling a case and i am facing a lot of problems due to similar pics which belongs to my client.

however the ones i am posting is not of my client this is similar problem what i am facing.

Please have a look and please help me and suggest how the steps need to be followed, in order to view the face clearly.

I am sure many of you in this forums are working for Digital forensics, and many are from JPEG forensics experts.

Please help.

Thanks in advance.

here are the links:

http://www.retouchpro.com/forums/att...6&d=1189348264

http://www.retouchpro.com/forums/att...1&d=1189348303


sorry for re-posting it, but i need to post it under this forum which is meant for Forensic Imaging.

Thanks

[creeduk]

Looking at the examples I really doubt you will have any success. If the image were large enough you could attempt to blur the edges of the pixelation and then see if it helped visual recognition.

A final JPG of an edit will contain no salvageable data, on rare occasions (Anybody remember the tech TV incident) the original thumbnail is captured inside the jpg and can reveal the original data but this extremely rare.

You would be better looking at using more sophisticated data retrieval on the HD.

[Dave.Cox]

Hi Nitin,

I'm afraid that you are probably not going to have much luck with this. unlike a photo that someone has covered with ink on top, when something like this is done in photoshop, and the image is flattened, the original pixels are replaced by photoshop with the new pixels, and the original pixels are discarded.

[manpreetahuja]

contact www.pixartindia.com may be they can help u

[martjno]

If you have several pictures of the same subject with the face hidden by the big pixel maybe it is possible to do something. If you have only one nope.
To see if some more metadata is stored in the picture maybe they should be investigated with an hexidecimal editor.

[Chain]

The pixelation over the face is like making it very low resolution (in the large example image effectively like 14 pixels wide). Getting the original data back from that is impossible as it doesn't exist. If you had several of the same face from the same angle I guess it might be possible to blend them together to get a more recognisable result. If it's a large image showing a lot of the person like one of the examples that will help people recognise it if they know the person.

I've attached two pictures, one showing the actual face information (see how tiny it is?) and one version where I've enlarged it back up to fit the big image (basically just blurring it).

Ps: I'm not into forensic imaging

Note: If you had plain text on a smooth background where some had been pixellated like this I saw a technique to actually guess what was behind the "blur" by having a program typing different things (with the same settings) and pixellating them with the same blur to see what gave the closest match...

[阿弥陀佛]

does this case involve....... marriage infidelity or prostitution? interesting!