Source-anchored, trace-anchored, and general match score-based likelihood ratios for camera device identification

Abstract

Forensic camera device identification addresses the scenario, where an investigator has two pieces of evidence: a digital image from an unknown camera involved in a crime, such as child pornography, and a person of interest's (POI's) camera. The investigator wants to determine whether the image was taken by the POI's camera. Small manufacturing imperfections in the photodiode cause slight variations among pixels in the camera sensor array. These spatial variations, called photo-response non-uniformity (PRNU), provide an identifying characteristic, or fingerprint, of the camera. Most work in camera device identification leverages the PRNU of the questioned image and the POI's camera to make a yes-or-no decision. As in other areas of forensics, there is a need to introduce statistical and probabilistic methods that quantify the strength of evidence in favor of the decision. Score-based likelihood ratios (SLRs) have been proposed in the forensics community to do just that. Several types of SLRs have been studied individually for camera device identification. We introduce a framework for calculating and comparing the performance of three types of SLRs - source-anchored, trace-anchored, and general match. We employ PRNU estimates as camera fingerprints and use correlation distance as a similarity score. Three types of SLRs are calculated for 48 camera devices from four image databases: ALASKA; BOSSbase; Dresden; and StegoAppDB. Experiments show that the trace-anchored SLRs perform the best of these three SLR types on the dataset and the general match SLRs perform the worst.

Keywords: digital cameras; digital evidence; digital images; forensic camera identification; score-based likelihood ratios and SLR.

FIGURE 1

Summary of the PRNU estimation algorithm presented in [6, 7]

FIGURE 2

Basic interpretation of SLR values

FIGURE 3

Calculating matching scores for specific known device C _k. Each camera fingerprint $F_{\mathrm{k}}^j$ was estimated from all training images except those in fold j. because the images in fold j were not used to estimate fingerprint $F_{\mathrm{k}}^j$, matching scores are calculated between fingerprint $F_{\mathrm{k}}^j$ and the images and corresponding noise residuals in fold j

FIGURE 4

Calculating trace‐anchored non‐matching scores for questioned image I _u and specific known device C _k

FIGURE 5

Calculating source‐anchored non‐matching scores for specific known device C _k

FIGURE 6

Calculating general match non‐matching for specific known device C _k

FIGURE 7

Tippet plots of general match, source‐anchored, and trace‐anchored SLRs under two scenarios: Match (H _p is true) and non‐match (H _d is true)

FIGURE 8

Each tile shows the percentage of known matching log₁₀(SLR) values that fall into a particular interval. values greater than 0 correctly support H _p relative to H _d and values less than or equal to 0 are misleading evidence in favor of H _d. Values closer to 0 show weaker support and values farther for 0 show stronger support

FIGURE 9

Each tile shows the percentage of known non‐matching log₁₀(SLR) values that fall into a particular interval. values less than or equal to 0 correctly support H _d relative to H _p and values greater than 0 are misleading evidence in favor of H _p. Values closer to 0 show weaker support and values farther for 0 show stronger support