Digital Camera Photographic Provenance

Digital Camera Photographic Provenance

Matthew Sorell (University of Adelaide, Australia)
DOI: 10.4018/978-1-60566-836-9.ch005
OnDemand PDF Download:
No Current Special Offers


Whether investigating individual photographs or a large repository of images, it is often critical to establish some history of the generation, manipulation and/or distribution of the images, which is to say the provenance. The applications of image provenance are wide, including the detection of steganographic messages and image tampering, the clustering of images with like provenance, and the gathering of evidence which establishes (or refutes) a hypothetical source. This chapter considers published research and identifies research gaps which address the general challenges of digital image provenance with an explicit emphasis on evidence related to the camera or other digital source.
Chapter Preview


The term provenance is traditionally applied to works of art, referring to documentation which relates to the ownership and public visibility of a particular work, but also includes documentation of production, restoration, thefts, expert opinions on condition and valuations, and any other records which help to assess its integrity.

In the realm of criminal evidence, the term chain-of-evidence carries a similar meaning, although the context is usually limited to establishing the source of a particular piece of evidence and its chain-of-custody, an even more specific term which refers to the documentation and handling of a piece of evidence once it has been received by investigators.

The difficulty with using the chain-of-evidence term for digital media is that the term implies a single version from a particular source, which survives as a single object in custody. Where the chain is broken (a continuous record cannot be established), the chain-of-evidence breaks down. When it comes to digital media, however, it is entirely feasible that the file contents might be widely distributed, exist in multiple transcoded forms, include overt or covert tampering, be made available to investigators via multiple sources, and that elements of the content might well come from multiple sources.

Provenance is a term which does not carry this linguistic baggage, at least not to the same extent. It is therefore timely to propose an updated definition for provenance in the context of digital media. In this work, provenance is defined to mean:

The record of evidence of creation, processing, compression, transmission, transcoding, manipulation, referencing, plagiarism, storage, distribution and other electronic transactions of a digital file or, where appropriate, of multiple digital files whose record can be traced to common ancestors.

The applications of tracking the provenance of digital files are very wide indeed, including:

  • The identification of leaked information from confidential sources,

  • The detection of plagiarism in academic and other allegedly original works,

  • The detection of forgeries, through the manipulation of content to produce misleading evidence,

  • The detection of hidden tampering, such as steganographic messages and malicious software,

  • The control of distribution and copying of electronic files,

  • The establishment of a robust record of forensic discovery, seizure, custody, control, transfer, analysis and disposition of digital evidence,

  • The determination of a source (person, location, organisation or other reasonable definition) of a particular piece of digital information, or

  • The determination of parties who have been in possession of a piece of digital information and who might have accessed, stored, manipulated, transcoded, distributed or otherwise contributed to the provenance record of that information.

Of course, the challenge of establishing provenance is not easy. It is common for there to be no evidence in existence of a particular stage in the provenance of digital media, and even more common for such evidence not to be available to an investigator (even if it exists). In other words, the file itself often does not contain an inherent history. More commonly, any relevant history which is stored in separate digital files might well be only available on a particular computer which is not available to the investigator. Furthermore, even if such provenancial evidence is available through networked information systems, such as logs of mailing lists or other records, it is often intractable to discover such records or establish their relevance to the evidence under consideration. The search for such evidence becomes not a needle in a haystack, but a needle in a needle stack: the evidence might exist, but it looks the same as a large volume of quite unrelated information.

Key Terms in this Chapter

Artefact: A distortion in a digital still photograph caused by the process of image capture or processing, with applications in provenance tracing.

Provenance: The record of evidence of creation, processing, compression, transmission, transcoding, manipulation, referencing, plagiarism, storage, distribution and other electronic transactions of a digital file or, where appropriate, of multiple digital files whose record can be traced to common ancestors.

JPEG: A compressed format for digital still photographs, referencing the Joint Photographic Experts Group (JPEG) who originated the standard. Actually includes several formats within a common framework. JPEG’s Sequential Mode format is lossy (permanently discards information) and ubiquitously supported by digital still cameras and image processing software.

(Digital) SLR Camera: An SLR (single lens reflex) camera uses a single lens system to bring an image to a film or sensor as well as the photographer looking through the viewfinder. In general, this means that the lens is interchangeable and that the photographer sees a direct lens view, as distinct from using a separate lens system in the viewfinder, or with contemporary digital cameras, seeing a view of the image on a digital screen. A digital SLR camera uses a digital image sensor instead of film.

Exif: The Exchangeable Image File Format is a metadata standard developed by the Japanese Electronics and Information Technology Association (JEITA) which allows for the inclusion of many digital still camera parameters to be stored within a JPEG image file. Although no longer actively supported by JEITA as a standard, Exif is ubiquitously supported by digital still camera manufacturers.

Image Sensor: A matrix of light sensors used to capture a photographic electronically, taking the place of conventional film in a still or video camera. A scanner typically uses a single row of light sensors.

Digital Still Photograph: A still (as distinct from moving) photographic image which might have been created by a Digital Still Camera or by converting a printed or conventional film photograph, for example using a scanner.

Digital Still Camera: A photographic camera which creates still (as distinct from moving) photographic images through digital sensing and processing.

Complete Chapter List

Search this Book: