[NITINCEH]

Hello All,

I am looking for some help on getting some images fixed, since these images i cannot upload or post to the forums due to the LEGAL and privacy issues,

I am investigating a case, well I am a Cybercrime investigator but i do not posess much information about JPEG forensics.

I am handling a case in which the pics are recovered from the forums and some from the Suspects HDD and to my shock the Thumbs.db is missing, FTK and Encase is still showing me up those modified / Doctored images.

I am looking a way by which i am able to recognize the face as it was in the original Photo taken by Sony Cybershot and Kodak express Digicams.

some of the images still has some Exif data stored, but majority of them are not having exif related metadata, maybe the suspect had used "Save for web" options or some tool which could have stripped off the exif data.

so now the pics what i have investigated into are only the JPEGS with no face shown/visible due to the usage of Photoshop ver 7.0, since some exif related data has revealed that PSv7.0 had been used.

now the JPEG has the face but which is been patched either with black color / or white color or patch or some special effects only covering the face.

and i did confirmed that there are no layers available, which i thought might help me a list of layers prior to editing the JPEG's

I would request the experts in this forum to help me or atleast suggest me some information on how to get the original image with face visible or image re-construction.

Also if someone can guide me through the process of how to recover/restore the same, It would be really helpful.

As i really need to get hold of this evidence, since this is a civil case, due to privacy issues i cannot submit the evidence.

If required i can post my photographs with the same alterations done.

I am sorry as i havent gone through the forum rules and posts if a similar post exists.

Thanks.

Nitin Kushwaha
CHFI
INDIA

[Syd]

Thumbs.db can be very easily turned off so, perhaps, that explains why you can't find them.

Also there is no way, that I know of, to take a flattened jpeg back to its original state. The information that you want has been permanently replaced with black or a pattern or whatever. Once flattened, all you are left with is what you can see.

Syd

[NITINCEH]

Hello Syd,

Thanks for your prompt reply.

yes i am aware about thumbs.db, however i thought maybe someone with good expertise with Photoshop may guide me with the process of trying to recover the original image.

because in theory, it should be possible to revert back, however since i have not been trained in this field i lack the knowledge on this specific topic.

Thanks for your concern and prompt reply.

I am still having some hope that it is possible.

Nitin Kushwaha
India

[creeduk]

This question is spread over several forums now and needs to be consolidated

[Kraellin]

now the JPEG has the face but which is been patched either with black color / or white color or patch or some special effects only covering the face.

and i did confirmed that there are no layers available, which i thought might help me a list of layers prior to editing the JPEG's

cant be done if the black and white 'patches' are solids. there is no metadata or exif or anything else that would even help. it's not like a piece of paper where you color over something with something else and then try to erase just the last one used. it's just not like that. even if you split the image into channels, all channels are going to show that patch as black or white if it's a solid. this is a case of where that patch BECOMES the image, not something overlaying it. without layers and if it's a complete solid, there's no recovery of the original information.

you can try splitting it into channels just to make sure it is a solid or not, but from what you're saying, i'm guessing not.

[winwintoo]

If you have the hard drive, have you tried to do a recovery on it? Is there a chance that the person altered the image, saved it as a new name and then deleted the original? If so, running a recovery on the hard drive might turn up the originals as long as nobody erased the whole hard drive.

I trashed my whole iPhoto library once and was able to recover most of it using an online recovery service. I'm not sure of the name of it right now, but if you want, I can probably find it again.

Take care, Margaret