How Can I Identify or Locate the Originator of a Digital Image, Illustration or Photograph?

It’s a long shot at best, but depending upon how it was created the image may contain metadata that could help you make the connection to a source… is it a photo or a digital illustration (like you might create in Illustrator or MS Paint)?

Oracle Multimedia User’s Guide, 11g Release 1 (11.1) indicates that, “Image files can contain information about the content of the images, the image rasters, and image metadata. In general, data about data is referred to as metadata. In this case, metadata refers to additional information about the actual images, which is stored in the image files along with the images.

Several types of metadata can be stored in an image file, and each type can serve a different purpose. One type, technical metadata, is used to describe an image in a technical sense. For example, technical metadata can include attributes about an image, such as its height and width, in pixels, or the type of compression used to store it. Another type, content metadata, can further describe the content of an image, the name of the photographer, and the date and time when a photograph was taken.

Metadata is stored in image files using a variety of mechanisms. Digital cameras and scanners automatically insert metadata into the images they create. Digital photograph processing applications like Adobe Photoshop allow users to add or edit metadata to be stored with the image. Annotating digital images with additional metadata is a common practice in photographic and news gathering applications and for image archiving usages, as well as at the consumer level.“

A great deal of meta information is stored in a graphics file created on a computer, just like any other document. “BTK” Serial Killer, Dennis Rader, was eventually caught as a direct result of metadata, not unlike the kind found in images, appended to a document and a disk he used to taunt the police:

“Rader sent his message and a floppy disk to the police, who quickly checked the metadata of the Microsoft Word document. In the metadata, they found that the document had been made by a man who called himself “Dennis.” They also found a link to the Lutheran Church. When the police searched on the Internet for “Lutheran Church Wichita Dennis”, they found his family name and were able to identify a suspect- Dennis Rader, a Lutheran Deacon.“

Out of curiosity I just looked for metadata in an image file I just copied from Pursuit Magazine; when I opened it with Adobe Illustrator, not the software I created it with, I found enough information to directly identify me as the source of that image (holy smokes!). You can find similar data in videos that have been processed or edited on a computer also.

Digital cameras often attach meta information to the image, too; most often it is called EXIF data and it could conceivably carry quite a bit of information, but it entirely depends upon the camera and the features the user has enabled on that camera. EXIF data will most often include date and time stamp (if correctly set by the user and note that it need not be visible on the image itself), camera make, model, resolution, camera position, software version, exposure and f-stop information, whether the flash fired, etc., etc. In its most basic format there have certainly been instances where an image’s EXIF data included the camera make and serial number that matched a camera in a suspect’s possession. Police have used this information in helping to identify the photographer in child pornography cases.

Metadata may include information attached by the camera during the shot or it may be attached by a user while saving the image to his or her computer. This type of data is used to make images easier to find on your own computer or on photo sharing websites like Flickr and Picasa.

Some new digital cameras, especially the cameras in cell phones, will record geocode metadata, essentially GPS coordinates, of the location where the photo was taken. I could imagine a scenario in which the geocode information may mean something to your client and help identify the photographer. For example, it is possible that geocode information identifying Gulf Breeze, FL as the photo’s physical point of origin was captured in a questioned image and your client may only know one or two people in Gulf Breeze; that could potentially help narrow things down a bit.

How do you get to that image metadata?

The really technical stuff hinges on digital forensics, but in many cases your first try should be using the software that generated the document or image, if you can tell; under the “File” menu you can often find a selection titled “File Info” or “Properties.” We also use FREE software called “EXIFTool” used for reading, writing, and manipulating image, audio and video metadata. It is available at

http://owl.phy.queensu.ca/~phil/exiftool/

Another FREE program that will let you inspect, or change, the data stored along with a photo also worth trying is Microsoft’s “Pro Photo Tools 2″ available at

http://www.microsoft.com/prophoto/downloads/tools.aspx

This article was written by L. Scott Harrell and is posted courtesy IRBseach, LLC.

IRBsearch offers The Most information, The Best data sources, and The Fastest delivery for locating people, businesses, and their assets. With one click you can search billions of records in just a fraction of a second.

Tags: forensics, photography, private investigation