11

So, let's say I have two identical iPhones, both of them are the same model and are running the same iOS. I then proceed to have someone pull a random picture off of one of the phones without telling me which one it came from. Said picture was taken by that phone at some point that was at least a few days ago. The photo is then completely removed from the device that is originated from, leaving no trace. Given that I have access to both devices andcan therefore take an infinite number of pictures on each to compare to, is there a way, like by reading the metadata, that I can tell which one of the phones the new picture came from given that I have a picture from each?

Edit: let's assume that no one is trying to deliberately fake the metadata. The metadata is the same as what it was when the picture was taken. Lets also assume that as the moment the photo was taken, both devices where in VERY close proximity to each other.

Also, that scenario I described above is not hypothetical. I'm actually trying to do that, and I have two iPhone SEs to work with. But I've looked through the raw metadata and am having trouble finding fields that match from two photos that I know came from the same source that also don't match a photo from a different source.

Edit again: I have determined that (at least most) Apple devices do not store a serial number or any other kind of definitive distinguishers to absolutely say that two photos came from the same exact device. However, I have heard people talking about how, because of the very slight differences in each chip, it can be determined from the actual photo that two pictures were taken by the same device. Does anyone know more about this?

Improve this question
3
  • 2
    Are you interested in scenarios where somebody is deliberately trying to fake the result, or only in "pristine" images from the devices?
    – Philip Kendall ♦
    Feb 13, 2017 at 21:18
  • If you could provide samples of the two images it would help us. Some use EXIF tools and some of us are programmers that might be able to do it in code.
    – MikeD
    Feb 14, 2017 at 20:03
  • Three pictures labeled by their device. Device ? Means that it came from one of the two, but I hypothetically don't know which one. In this case I do know which one I took it with, but that is because I just took these photos. drive.google.com/drive/folders/…
    – The Elemental of Destruction
    Feb 14, 2017 at 22:02

6 Answers 6

Reset to default
4

As others have stated, there is no definitive way to prove that an image came from a particular device. All evidence has to be gathered, considered, and correlated to arrive at a probable answer. This includes metadata, timing information, GPS coordinates, lens and sensor characteristics, and compression settings.

Whether one can come up with reasonable guess is dependent on the particular images and devices involved. It is useful to go through the exercise with the images provided to demonstrate the process. To simplify discussion, I will refer to Image A, Image B, and Image U, each taken with the corresponding device.

  • The devices are not identical. Device A has iOS 9.3.5 installed. Device B has iOS 10.1.1 installed. Device U also has iOS 9.3.5 installed.

  • Assuming you had uploaded the images shortly after taking them, Image A and U were both taken with Devices that had an uptime of about 27 hours. Image B was taken with a device with an uptime of about 107 hours. Based on uptime, I might guess that Image U was taken about 16 seconds after Image A.

  • Based on time stamps, Image U was taken about 17 seconds after Image A. Image B was taken 19 days before either of them. Of course, this is meaningless by itself, and time stamps are often incorrect. However, combined with uptime information, Image U and Image A correlate closely with each other.

  • I examined the DQT of each image. The DQT determines the "quality" of JPEG compression. Interestingly, it was identical for Image A and B, but different for Image U. Not helpful.

  • If I had possession of the devices, I could try taking multiple light and dark flat-field images at multiple settings. Perhaps lens alignment, light patterns (vignetting), hot spots, "noise" patterns, or dust specks would give away one of the devices. Unfortunately, for many images, this is unlikely to be helpful because the subject matter will often mask these features.

  • If I had a large number of images to correlate with each other, I could try mapping them based on GPS data. Images that cluster together are more likely to be related to each other. Images taken far apart at the same time are highly unlikely to have been taken with the same device.

  • I would also examine image content, such as people or landmarks. This would help to cluster images together, as well as corroborate GPS data.

Now taking into consideration what I've learned, I have to decide how confident I am in my conclusion. Given that the scenario presented involves no trickery, I am fairly confident Device U = Device A.

Again, none of the above is definitive, and I cannot rule out a third Device C, or even that Device A = Device B. Though the latter is unlikely because that would mean iOS had been downgraded.

Improve this answer
6
  • The goal was not to ACTUALLY do it on the test photos. The goal was to determine based upon a new photo taken at a random time on a device that may have been restarted. Basically, any metadata involving time would be made completely irrelevant in this situation. Also gps location would be irrelevant. And while iOS can determine that a single device did not take the photo, the goal was to be able to say definitively that a specific device DID. You did start to mention techniques to determine specific device to photo connections, but now how one would go about it.
    – The Elemental of Destruction
    Aug 8, 2018 at 7:08
  • 1
    As I state, none of this is definitive. All of this information has to be collected and correlated to determine confidence in a conclusion. In this case, 3/6 of the points I examined matched up. Two are impossible to perform, and one was inconclusive. By actually performing the exercise, I demonstrate concretely the steps that you would need to take, and that in this case, there is reasonable correlation between A and U. Otherwise, I would just be handwaving and saying it isn't possible, like everyone else.
    – xiota
    Aug 8, 2018 at 7:10
  • Also, gps location can simply be turned off, so that is an unreliable method. From what I can tell, anything that has to do with metadata is not going to be able to definitively prove anything due to the fact that metadata could be stripped (removed, not replaced with false information) and that the metadata may simply be wrong. Because the iPhone does not apply any kind of unique identifier to photos, metadata is out of the question. Analysis of the image itself appears to be the only way. It would be greatly appreciated if you could elaborate more on that.
    – The Elemental of Destruction
    Aug 8, 2018 at 7:17
  • 1
    You take whatever data you can and correlate them with each other. You cannot hang your hat on a single piece of potentially spurious information. If metadata is available, then it should be used. For instance, if clustering the photos on a map shows that images were taken hundreds of miles apart at the same time, it's unlikely that they were taken with the same device, although such information can be faked. But that goes against the assumptions in the question.
    – xiota
    Aug 8, 2018 at 7:18
  • 1
    As far as taking flat-field photos, I'm not sure what to say about it other than that you take a bunch of pictures of diffusely illuminated light and dark fields at different settings. You may find lens vignetting, dust, hot spots, or sensor "noise" patterns. Then you look for those same features in the photos. However, it is also not definitive because photographic subjects tend to obsure them. Also, lens correction works because most differences among the same models of sensors and lenses are outside our ability to detect.
    – xiota
    Aug 8, 2018 at 7:28
6

More difficult than what you're after: every solid-state sensor chip has its own irregularities -- slight differences in pixel responsivities and so on. A forensic analyst, given a couple images known to be from each camera, can unequivocally say which camera produced any other image. AFAIK this works even when only JPG output is available, assuming the specific compression parameters are known.

Improve this answer
5
  • 5
    Can you link to further info? I would love to understand how a forensic analyst can unequivocally say whether a given image was produced by a given camera or not.
    – youcantryreachingme
    Feb 15, 2017 at 2:03
  • 3
    I have doubts that this is possible with only one sample from each camera. Strong doubts.
    – Myridium
    Feb 16, 2017 at 13:20
  • I think probably an option would be comparing noise in dark areas. You would probably need a black photo for reference.
    – Rafael
    Apr 21, 2017 at 12:23
  • @Rafael noise by its nature will be different from shot to shot, so I don't see how that would be helpful.
    – Mark Ransom
    Sep 22, 2017 at 18:40
  • 1
    @MarkRansom Not all noise is created equal. =) In this case, the read noise and pattern noise are considered forms of noise in the signal, but are not precisely random. The pattern noise is a static bias in the image, due to the peculiarities of each individual sensor chip. The unique patterns in this noise act like a fingerprint for each sensor.
    – scottbb ♦
    Sep 22, 2017 at 19:20
1

There apparently is not a standardized EXIF entry for hardware serial number. Two identical models of camera will produce more or less the same standardized EXIF data. But cameras will sometimes save a serial number or other unique hardware identification information in the "maker notes" section of the EXIF data. The "maker notes section" has manufacturer defined fields that are not specifically standardized the way the rest of the EXIF data not in the "maker notes" is standardized. You might be able to find it with an EXIF viewer that displays "maker notes" information along with the standardized EXIF fields. Using a HEX editor or writing a short program might also allow you to see the information if it is included by the manufacturer.

Note that most Adobe products (Lightroom, Photoshop, Camera Raw, DNG converter) strip much of the "maker notes" information from the EXIF information when they are used to convert or export an image file. Adobe products also ignore the "maker notes" information when displaying EXIF info from an image file that does contain it.

Somebody made a post way back in 2005 on the DPReview website about it in which most of the commenters shared their relative lack of knowledge about the "make notes" section of the EXIF information.

Improve this answer
2
  • 5
    While this is technically true, most of the normal EXIF tools (including Lightroom and exiftool, the two I happen to have instant access to) do a pretty good job of extracting the serial number from the manufacturer specific EXIF data - -SerialNumber if you're using exiftool.
    – Philip Kendall ♦
    Feb 13, 2017 at 21:30
  • It sounds a little like a privacy violation for the manufacturer to be able to identify specific cameras from EXIF data (in some cases they could know who that camera was sold to/who brought it in for repairs) ... do we know which ones do embed this?
    – thomasrutter
    Oct 23, 2017 at 2:20
1

Maybe not what you are looking for, but if you have already taken a sample picture with each phone, you could get a hint by looking at the progressive number usually stored in the metadata.

I don't have iPhone samples but it could work with digital cameras, works best if the two units have a significantly different shutter count.

Improve this answer
0

I don't have an apple device so I don't know what the EXIF data looks like, but assuming there is no identifying marker in the maker notes and you would have to analyze the photographic data, this is a problem that an alphabet agency would pay a forensic expert a 6 figure salary to figure out. It's also possible that Apple could be embedding some kind of watermark in the compression, and this data would only be available to law enforcement. In fact, I'd be surprised if there wasn't something like this.

Improve this answer
1
  • It's also possible that Apple could be embedding some kind of watermark in the compression. That's called steganography. I'd be surprised if Apple were doing something like that. They have come out strongly in favor of users' privacy rights, and have not acceded to any demands for "backdoor encryption keys" for law enforcement in any other elements of their products. And the problem with hiding any signal in image compression is that it is incredibly hard to preserve that information (perhaps impossible) if the image is edited and re-compressed.
    – scottbb ♦
    Sep 22, 2017 at 19:28
0

Simple answer: No.

I own 3 iPhone 7 and I'm a metadata specialist.

Though you may find out via forensic approach described by Carl Witthoft.

Improve this answer
2
  • Can you provide in answer something more about this forensic approach?
    – Romeo Ninov
    Oct 29, 2017 at 4:42
  • I cannot describe it better than Carl Witthoft. I'm a mechanic, not a forensic scientist Sir.
    – Texxi
    Oct 30, 2017 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.