Photography Asked by The Elemental of Creation on September 12, 2020
So, let’s say I have two identical iPhones, both of them are the same model and are running the same iOS. I then proceed to have someone pull a random picture off of one of the phones without telling me which one it came from. Said picture was taken by that phone at some point that was at least a few days ago. The photo is then completely removed from the device that is originated from, leaving no trace. Given that I have access to both devices andcan therefore take an infinite number of pictures on each to compare to, is there a way, like by reading the metadata, that I can tell which one of the phones the new picture came from given that I have a picture from each?
Edit: let’s assume that no one is trying to deliberately fake the metadata. The metadata is the same as what it was when the picture was taken. Lets also assume that as the moment the photo was taken, both devices where in VERY close proximity to each other.
Also, that scenario I described above is not hypothetical. I’m actually trying to do that, and I have two iPhone SEs to work with. But I’ve looked through the raw metadata and am having trouble finding fields that match from two photos that I know came from the same source that also don’t match a photo from a different source.
Edit again: I have determined that (at least most) Apple devices do not store a serial number or any other kind of definitive distinguishers to absolutely say that two photos came from the same exact device. However, I have heard people talking about how, because of the very slight differences in each chip, it can be determined from the actual photo that two pictures were taken by the same device. Does anyone know more about this?
As others have stated, there is no definitive way to prove that an image came from a particular device. All evidence has to be gathered, considered, and correlated to arrive at a probable answer. This includes metadata, timing information, GPS coordinates, lens and sensor characteristics, and compression settings.
Whether one can come up with reasonable guess is dependent on the particular images and devices involved. It is useful to go through the exercise with the images provided to demonstrate the process. To simplify discussion, I will refer to Image A, Image B, and Image U, each taken with the corresponding device.
The devices are not identical. Device A has iOS 9.3.5 installed. Device B has iOS 10.1.1 installed. Device U also has iOS 9.3.5 installed.
Assuming you had uploaded the images shortly after taking them, Image A and U were both taken with Devices that had an uptime of about 27 hours. Image B was taken with a device with an uptime of about 107 hours. Based on uptime, I might guess that Image U was taken about 16 seconds after Image A.
Based on time stamps, Image U was taken about 17 seconds after Image A. Image B was taken 19 days before either of them. Of course, this is meaningless by itself, and time stamps are often incorrect. However, combined with uptime information, Image U and Image A correlate closely with each other.
I examined the DQT of each image. The DQT determines the "quality" of JPEG compression. Interestingly, it was identical for Image A and B, but different for Image U. Not helpful.
If I had possession of the devices, I could try taking multiple light and dark flat-field images at multiple settings. Perhaps lens alignment, light patterns (vignetting), hot spots, "noise" patterns, or dust specks would give away one of the devices. Unfortunately, for many images, this is unlikely to be helpful because the subject matter will often mask these features.
If I had a large number of images to correlate with each other, I could try mapping them based on GPS data. Images that cluster together are more likely to be related to each other. Images taken far apart at the same time are highly unlikely to have been taken with the same device.
I would also examine image content, such as people or landmarks. This would help to cluster images together, as well as corroborate GPS data.
Now taking into consideration what I've learned, I have to decide how confident I am in my conclusion. Given that the scenario presented involves no trickery, I am fairly confident Device U = Device A.
Again, none of the above is definitive, and I cannot rule out a third Device C, or even that Device A = Device B. Though the latter is unlikely because that would mean iOS had been downgraded.
Correct answer by xiota on September 12, 2020
There apparently is not a standardized EXIF entry for hardware serial number. Two identical models of camera will produce more or less the same standardized EXIF data. But cameras will sometimes save a serial number or other unique hardware identification information in the "maker notes" section of the EXIF data. The "maker notes section" has manufacturer defined fields that are not specifically standardized the way the rest of the EXIF data not in the "maker notes" is standardized. You might be able to find it with an EXIF viewer that displays "maker notes" information along with the standardized EXIF fields. Using a HEX editor or writing a short program might also allow you to see the information if it is included by the manufacturer.
Note that most Adobe products (Lightroom, Photoshop, Camera Raw, DNG converter) strip much of the "maker notes" information from the EXIF information when they are used to convert or export an image file. Adobe products also ignore the "maker notes" information when displaying EXIF info from an image file that does contain it.
Somebody made a post way back in 2005 on the DPReview website about it in which most of the commenters shared their relative lack of knowledge about the "make notes" section of the EXIF information.
Answered by Octopus on September 12, 2020
More difficult than what you're after: every solid-state sensor chip has its own irregularities -- slight differences in pixel responsivities and so on. A forensic analyst, given a couple images known to be from each camera, can unequivocally say which camera produced any other image. AFAIK this works even when only JPG output is available, assuming the specific compression parameters are known.
Answered by Carl Witthoft on September 12, 2020
I don't have an apple device so I don't know what the EXIF data looks like, but assuming there is no identifying marker in the maker notes and you would have to analyze the photographic data, this is a problem that an alphabet agency would pay a forensic expert a 6 figure salary to figure out. It's also possible that Apple could be embedding some kind of watermark in the compression, and this data would only be available to law enforcement. In fact, I'd be surprised if there wasn't something like this.
Answered by Bodhi1 on September 12, 2020
Simple answer: No.
I own 3 iPhone 7 and I'm a metadata specialist.
Though you may find out via forensic approach described by Carl Witthoft.
Answered by Texxi on September 12, 2020
Maybe not what you are looking for, but if you have already taken a sample picture with each phone, you could get a hint by looking at the progressive number usually stored in the metadata.
I don't have iPhone samples but it could work with digital cameras, works best if the two units have a significantly different shutter count.
Answered by clabacchio on September 12, 2020
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP