Can a raw file be doctored?

[cn15]

I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.

[peteh]

I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
[{POST_SNAPBACK}][/a]

Yes! I believe Canon or I know for sure , at least I read this on the web that NIKON makes a forensic type camera that ,maybe does NOT alter the image.
Do a search for "Forensic camera" FUJI makes one for that type of work.
check her for more info.....
[a href=\"http://www.forensicmag.com/articles.asp?pid=122]http://www.forensicmag.com/articles.asp?pid=122[/url]

[peteh]

Yes! I believe Canon or I know for sure , at least I read this on the web that NIKON makes a forensic type camera that ,maybe does NOT alter the image.
Do a search for "Forensic camera" FUJI makes one for that type of work.
check her for more info.....
http://www.forensicmag.com/articles.asp?pid=122
[{POST_SNAPBACK}][/a]

Also be ready to PAY for such a camera!...another link
[a href=\"http://dpnow.com/4066.html]http://dpnow.com/4066.html[/url]

[Eric Myrvaagnes]

But as soon as a picture file is downloaded from any digital camera (even a "forensic" one) to a computer, the file consist of a sequence of binary bits, which can be quite easily altered. To make the alterations appear convincing one would have to understand quite a bit about the format of the raw file, but that should be a piece of cake for any experienced and industrious programmer or hacker.

The only way I can imagine a digital image could be fairly certain not to have been doctored in any way would be to have the original photograph taken in the presence of reliable witnesses, then have the camera sealed and the "chain of custody" recorded until the camera is opened in the courtroom.

So altering any raw file is certainly possible, and I expect it would be easier than many of the "hacks" that go on regularly, IMHO.

[Panopeeper]

I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files

This is a very naive question, I had a hard time to take it seriously.

If you mention file, then you are talking about digitalized data available in computers. Accordingly, the proper question is not *if there is any way*, but *if such programs are readily available the public*.

There are literally tens of thousands of people, who could create such programs if they deemed that rewarding enough.

[madmanchan]

The short answer is yes, absolutely, raw files can be doctored. In some cases it is trivial to do, in other cases difficult.

[rdonson]

I have always wondered if there is any way one can edit a file and then save it as a DNG or NEF or CR raw files.  I know of a medical legal case where an "expert" in photoshop is called to testify whether a picture has been "doctored".  I presumed this was a jpeg file.
[a href=\"index.php?act=findpost&pid=211252\"][{POST_SNAPBACK}][/a]

You've actually asked two questions.

1) if its a data file on a computer it can be modified.  Some expertise required if you wish to make sure no one knows that its been modified.

2) can someone detect if a file (jpeg) has been "photoshopped"?  Yep, there's a professor who specializes in this and he has worked with Adobe.  You can catch a piece on him and his work on Nova Science Now

[John.Murray]

The new proposed DNG specification by Adobe actually address' that issue (as well as corruption) by generating a hash or CRC of the raw data and including that within the file.  *Any* change to the original will cause the CRC check to fail

http://blogs.adobe.com/lightroomjournal/20...sta_dng_co.html

[DarkPenguin]

Sure.  But they rarely get ill.

[tagor]

The new proposed DNG specification by Adobe actually address' that issue (as well as corruption) by generating a hash or CRC of the raw data and including that within the file.  *Any* change to the original will cause the CRC check to fail

It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo

[John.Murray]

It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
[a href=\"index.php?act=findpost&pid=211325\"][{POST_SNAPBACK}][/a]

Sorry, my post was badly worded - both the hash and CRC serve the same purpose - the CRC *is* easily overcome, better suited for quickly verifying small blocks of data such as disk sectors, or packets on the wire.

[madmanchan]

The raw digest in the DNG 1.2 spec is designed to protect against accidental corruption/modification. That is, a file transfer error that corrupts a few bits of the image data (which is enough to completely ruin the decoding, if that image was compressed) is highly unlikely to also corrupt the digest in such a way that the corrupted digest matches the corrupted image data.

However, as noted above, this digest does not protect against deliberate modification. An adversary who wants to muck with the image data would simply have to recompute the digest from the modified data and replace the original digest with the modified one.

[Brad Proctor]

It's not a CRC, it's an MD5 hash. A CRC is totally useless for detecting deliberate changes.

-- Tilo
[a href=\"index.php?act=findpost&pid=211325\"][{POST_SNAPBACK}][/a]

Couldn't you just generate a new MD5 on the modified data to replace the old one?  Seems to me that somewhere, other than the file, the MD5 would need to be stored for comparison to verify its authenticity.  Am I missing something here?

[madmanchan]

Yes exactly. The MD5 hash is stored as a tag in the DNG file (as metadata, in other words). So, as noted above, an adversary can tweak the raw data, recompute the MD5 fingerprint, and update the raw digest tag in the DNG.

Again, the DNG raw digest is designed to help protect against accidental corruption ONLY. It has NO security / authentication powers at all, nor was it intended to.

[John.Murray]

Yes exactly. The MD5 hash is stored as a tag in the DNG file (as metadata, in other words). So, as noted above, an adversary can tweak the raw data, recompute the MD5 fingerprint, and update the raw digest tag in the DNG.

Again, the DNG raw digest is designed to help protect against accidental corruption ONLY. It has NO security / authentication powers at all, nor was it intended to.
[a href=\"index.php?act=findpost&pid=211462\"][{POST_SNAPBACK}][/a]

Actually it does - recomputing a new MD5 hash from the altered RAW data will result in a new 16byte value (128bit) in the DNG's RawImageDigest field.  It is this value that is usefull to determine whether the content had been changed.  This value is easilly inspected using Adobes own dng_validate tool:

.
.
.
ProfileCopyright: "Copyright 2008 Adobe Systems, Inc."
ForwardMatrix1:
      0.8259   0.0184   0.1200
      0.3835   0.6715  -0.0550
      0.1129  -0.2582   0.9705
ForwardMatrix2:
      0.8001   0.0303   0.1339
      0.3876   0.7158  -0.1034
      0.0623  -0.1346   0.8975
PreviewApplicationName: "Adobe Photoshop Lightroom"
PreviewApplicationVersion: "2.0"
PreviewSettingsDigest: <383fb6eff82dfb94bec97caa5d29046e>
PreviewColorSpace: sRGB
PreviewDateTime: "2008-07-29T10:27:44-07:00"
RawImageDigest: <2e3eb30e25439958c7819d045a13d6e0>
NextIFD = 0

SubIFD 1: Offset = 88936, Entries = 28
.
.
.

[Panopeeper]

Actually it does - recomputing a new MD5 hash from the altered RAW data will result in a new 16byte value (128bit) in the DNG's RawImageDigest field.  It is this value that is usefull to determine whether the content had been changed

What exactly is that supposed to prove?

It proves, that two versions are not identical. However, I don't need any checksum to verify that, I can compare the contents directly.

[John.Murray]

Post processing a DNG files will also "change" it's content.  The point of of the RawImageDigest field is to ensure the original RAW data within the file remains unaltered.

[Panopeeper]

The point of of the RawImageDigest field is to ensure the original RAW data within the file remains unaltered.

It does not ensure that the raw data remain unaltered. It makes an alteration recognizable (with high probability), if the digest has not been recalculated after the alteration. This is good against accidantal change of the data or destruction through transfer, etc.

However, if a program changes the raw data and recalculates the digest, then everything look ok (as it is supposed to).

[John.Murray]

But after recalculating the value will have changed - comparing this using dng_validate.exe  will immediately identify whether the DNG's RAW data has in fact been altered.

Of course this pre-supposes whether you would have access (EDIT: or documented) to the original DNG (or even the original RAW file - DNG also has a OriginalRawFileDigest field as well).

[Panopeeper]

But after recalculating the value will have changed - comparing this using dng_validate.exe  will immediately identify whether the DNG's RAW data has in fact been altered

LOL, how do you know which one is the original?