Pages: [1] 2   Go Down

Author Topic: Can a raw file be doctored?  (Read 7228 times)

cn15

  • Newbie
  • *
  • Offline Offline
  • Posts: 28
Can a raw file be doctored?
« on: July 28, 2008, 06:52:59 PM »

I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
Logged

peteh

  • Full Member
  • ***
  • Offline Offline
  • Posts: 200
    • http://
Can a raw file be doctored?
« Reply #1 on: July 28, 2008, 07:14:04 PM »

Quote
I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
[{POST_SNAPBACK}][/a]
Yes! I believe Canon or I know for sure , at least I read this on the web that NIKON makes a forensic type camera that ,maybe does NOT alter the image.
Do a search for "Forensic camera" FUJI makes one for that type of work.
check her for more info.....
[a href=\"http://www.forensicmag.com/articles.asp?pid=122]http://www.forensicmag.com/articles.asp?pid=122[/url]
Logged

peteh

  • Full Member
  • ***
  • Offline Offline
  • Posts: 200
    • http://
Can a raw file be doctored?
« Reply #2 on: July 28, 2008, 07:21:05 PM »

Quote
Yes! I believe Canon or I know for sure , at least I read this on the web that NIKON makes a forensic type camera that ,maybe does NOT alter the image.
Do a search for "Forensic camera" FUJI makes one for that type of work.
check her for more info.....
http://www.forensicmag.com/articles.asp?pid=122
[{POST_SNAPBACK}][/a]
Also be ready to PAY for such a camera!...another link
[a href=\"http://dpnow.com/4066.html]http://dpnow.com/4066.html[/url]
Logged

Eric Myrvaagnes

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 10138
    • http://myrvaagnes.com
Can a raw file be doctored?
« Reply #3 on: July 28, 2008, 07:46:46 PM »

But as soon as a picture file is downloaded from any digital camera (even a "forensic" one) to a computer, the file consist of a sequence of binary bits, which can be quite easily altered. To make the alterations appear convincing one would have to understand quite a bit about the format of the raw file, but that should be a piece of cake for any experienced and industrious programmer or hacker.

The only way I can imagine a digital image could be fairly certain not to have been doctored in any way would be to have the original photograph taken in the presence of reliable witnesses, then have the camera sealed and the "chain of custody" recorded until the camera is opened in the courtroom.

So altering any raw file is certainly possible, and I expect it would be easier than many of the "hacks" that go on regularly, IMHO.
Logged
-Eric Myrvaagnes

http://myrvaagnes.com  Visit my photo website. New images each season. Also visit my new website: http://ericneedsakidney.org

Panopeeper

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 1805
Can a raw file be doctored?
« Reply #4 on: July 28, 2008, 08:46:23 PM »

Quote
I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files
This is a very naive question, I had a hard time to take it seriously.

If you mention file, then you are talking about digitalized data available in computers. Accordingly, the proper question is not *if there is any way*, but *if such programs are readily available the public*.

There are literally tens of thousands of people, who could create such programs if they deemed that rewarding enough.
Logged
Gabor

madmanchan

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 2110
Can a raw file be doctored?
« Reply #5 on: July 28, 2008, 09:10:26 PM »

The short answer is yes, absolutely, raw files can be doctored. In some cases it is trivial to do, in other cases difficult.
Logged

rdonson

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 1776
Can a raw file be doctored?
« Reply #6 on: July 28, 2008, 09:54:37 PM »

Quote
I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
[a href=\"index.php?act=findpost&pid=211252\"][{POST_SNAPBACK}][/a]

You've actually asked two questions.

1) if its a data file on a computer it can be modified.  Some expertise required if you wish to make sure no one knows that its been modified.

2) can someone detect if a file (jpeg) has been "photoshopped"?  Yep, there's a professor who specializes in this and he has worked with Adobe.  You can catch a piece on him and his work on Nova Science Now
Logged
Regards,
Ron

John.Murray

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 886
    • Images by Murray
Can a raw file be doctored?
« Reply #7 on: July 28, 2008, 09:57:45 PM »

The new proposed DNG specification by Adobe actually address' that issue (as well as corruption) by generating a hash or CRC of the raw data and including that within the file.  *Any* change to the original will cause the CRC check to fail

http://blogs.adobe.com/lightroomjournal/20...sta_dng_co.html

DarkPenguin

  • Guest
Can a raw file be doctored?
« Reply #8 on: July 28, 2008, 10:00:05 PM »

Sure.  But they rarely get ill.
Logged

tagor

  • Newbie
  • *
  • Offline Offline
  • Posts: 16
Can a raw file be doctored?
« Reply #9 on: July 29, 2008, 02:42:58 AM »

Quote
The new proposed DNG specification by Adobe actually address' that issue (as well as corruption) by generating a hash or CRC of the raw data and including that within the file.  *Any* change to the original will cause the CRC check to fail
It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
Logged

John.Murray

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 886
    • Images by Murray
Can a raw file be doctored?
« Reply #10 on: July 29, 2008, 10:43:39 AM »

Quote
It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
[a href=\"index.php?act=findpost&pid=211325\"][{POST_SNAPBACK}][/a]

Sorry, my post was badly worded - both the hash and CRC serve the same purpose - the CRC *is* easily overcome, better suited for quickly verifying small blocks of data such as disk sectors, or packets on the wire.

madmanchan

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 2110
Can a raw file be doctored?
« Reply #11 on: July 29, 2008, 11:20:26 AM »

The raw digest in the DNG 1.2 spec is designed to protect against accidental corruption/modification. That is, a file transfer error that corrupts a few bits of the image data (which is enough to completely ruin the decoding, if that image was compressed) is highly unlikely to also corrupt the digest in such a way that the corrupted digest matches the corrupted image data.

However, as noted above, this digest does not protect against deliberate modification. An adversary who wants to muck with the image data would simply have to recompute the digest from the modified data and replace the original digest with the modified one.
Logged

Bradley Proctor

  • Full Member
  • ***
  • Offline Offline
  • Posts: 150
    • http://proctorphotos.com/
Can a raw file be doctored?
« Reply #12 on: July 29, 2008, 12:36:51 PM »

Quote
It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
[a href=\"index.php?act=findpost&pid=211325\"][{POST_SNAPBACK}][/a]

Couldn't you just generate a new MD5 on the modified data to replace the old one?  Seems to me that somewhere, other than the file, the MD5 would need to be stored for comparison to verify its authenticity.  Am I missing something here?
Logged

madmanchan

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 2110
Can a raw file be doctored?
« Reply #13 on: July 29, 2008, 12:43:17 PM »

Yes exactly. The MD5 hash is stored as a tag in the DNG file (as metadata, in other words). So, as noted above, an adversary can tweak the raw data, recompute the MD5 fingerprint, and update the raw digest tag in the DNG.

Again, the DNG raw digest is designed to help protect against accidental corruption ONLY. It has NO security / authentication powers at all, nor was it intended to.
Logged

John.Murray

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 886
    • Images by Murray
Can a raw file be doctored?
« Reply #14 on: July 29, 2008, 01:15:55 PM »

Quote
Yes exactly. The MD5 hash is stored as a tag in the DNG file (as metadata, in other words). So, as noted above, an adversary can tweak the raw data, recompute the MD5 fingerprint, and update the raw digest tag in the DNG.

Again, the DNG raw digest is designed to help protect against accidental corruption ONLY. It has NO security / authentication powers at all, nor was it intended to.
[a href=\"index.php?act=findpost&pid=211462\"][{POST_SNAPBACK}][/a]

Actually it does - recomputing a new MD5 hash from the altered RAW data will result in a new 16byte value (128bit) in the DNG's RawImageDigest field.  It is this value that is usefull to determine whether the content had been changed.  This value is easilly inspected using Adobes own dng_validate tool:

.
.
.
ProfileCopyright: "Copyright 2008 Adobe Systems, Inc."
ForwardMatrix1:
      0.8259   0.0184   0.1200
      0.3835   0.6715  -0.0550
      0.1129  -0.2582   0.9705
ForwardMatrix2:
      0.8001   0.0303   0.1339
      0.3876   0.7158  -0.1034
      0.0623  -0.1346   0.8975
PreviewApplicationName: "Adobe Photoshop Lightroom"
PreviewApplicationVersion: "2.0"
PreviewSettingsDigest: <383fb6eff82dfb94bec97caa5d29046e>
PreviewColorSpace: sRGB
PreviewDateTime: "2008-07-29T10:27:44-07:00"
RawImageDigest: <2e3eb30e25439958c7819d045a13d6e0>
NextIFD = 0

SubIFD 1: Offset = 88936, Entries = 28
.
.
.
« Last Edit: July 29, 2008, 01:40:57 PM by Joh.Murray »
Logged

Panopeeper

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 1805
Can a raw file be doctored?
« Reply #15 on: July 29, 2008, 02:22:07 PM »

Quote
Actually it does - recomputing a new MD5 hash from the altered RAW data will result in a new 16byte value (128bit) in the DNG's RawImageDigest field.  It is this value that is usefull to determine whether the content had been changed
What exactly is that supposed to prove?

It proves, that two versions are not identical. However, I don't need any checksum to verify that, I can compare the contents directly.
Logged
Gabor

John.Murray

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 886
    • Images by Murray
Can a raw file be doctored?
« Reply #16 on: July 29, 2008, 02:57:06 PM »

Post processing a DNG files will also "change" it's content.  The point of of the RawImageDigest field is to ensure the original RAW data within the file remains unaltered.

Panopeeper

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 1805
Can a raw file be doctored?
« Reply #17 on: July 29, 2008, 03:21:49 PM »

Quote
The point of of the RawImageDigest field is to ensure the original RAW data within the file remains unaltered.
It does not ensure that the raw data remain unaltered. It makes an alteration recognizable (with high probability), if the digest has not been recalculated after the alteration. This is good against accidantal change of the data or destruction through transfer, etc.

However, if a program changes the raw data and recalculates the digest, then everything look ok (as it is supposed to).
Logged
Gabor

John.Murray

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 886
    • Images by Murray
Can a raw file be doctored?
« Reply #18 on: July 29, 2008, 03:42:27 PM »

But after recalculating the value will have changed - comparing this using dng_validate.exe  will immediately identify whether the DNG's RAW data has in fact been altered.

Of course this pre-supposes whether you would have access (EDIT: or documented) to the original DNG (or even the original RAW file - DNG also has a OriginalRawFileDigest field as well).
« Last Edit: July 29, 2008, 04:22:55 PM by Joh.Murray »
Logged

Panopeeper

  • Sr. Member
  • ****
  • Offline Offline
  • Posts: 1805
Can a raw file be doctored?
« Reply #19 on: July 29, 2008, 04:44:45 PM »

Quote
But after recalculating the value will have changed - comparing this using dng_validate.exe  will immediately identify whether the DNG's RAW data has in fact been altered
LOL, how do you know which one is the original?
Logged
Gabor
Pages: [1] 2   Go Up