This chapter investigates an unexpected phenomenon observed in a recent digital photograph, in which the logo of a non-sponsoring sports company appears on the jersey of a famous football player in just one of a sequence of images. After eliminating deliberate image tampering as a cause, a hypothetical sequence of circumstances is proposed, concerning the lighting, dominant colours, infrared sensitivity, optical pre-processing, image enhancement and JPEG compression. The hypotheses are tested using a digital SLR camera. The investigation is of interest in a forensic context, firstly as a possible explanation in case such a photograph is observed, and secondly to be able to confirm or refute claims of such artifacts put forward claiming that a hypothetical image is not really what it claims to be.
TopMotivation
Recently, the author was approached by a South Australian police officer with an intriguing and unusual sequence of images. He had been photographing Brazilian footballer Romario during his short time with the Adelaide United FC, and noticed that in the midst of the sequence of images, there was a prominent but phantom Adidas logo on the player’s jersey, which was otherwise adorned only with Reebok logos. Adament that the image had come straight from his camera, an explanation for how such a logo could have appeared was sought. The relevant section of the image is shown in Figure 1, alongside images taken 26 seconds before and 8 seconds after the image of interest. The original image file is available from the author on request.
Figure 1. The relevant extracted area of the sequence of three images of the football player. In the central image, the Adidas logo is clearly visible. The Exif metadata timestamps indicate the photographs were taken at (a) 11:10:01, (b) 11:10:27 and (c) 11:10:34. (Photo J Venditto, used with permission)
Some further information is helpful. The photographs were taken on a warm, but not hot, cloudy summer day in December 2006 in Adelaide, Australia, with flash-assisted lighting according to the file’s metadata. There is clearly a white collar beneath the jersey collar in Figure 1(b), suggestive of a white undershirt (or at least, a t-shirt with a white collar) beneath the jersey. The photographs were taken using an Olympus Stylus 410D, confirmed by visual inspection and the Exif metadata in the image files at full (4 Megapixel) resolution and high quality (to meet an image file size of approximately 900KB).
The camera’s xD memory card was imaged and a total of 108 JPEG photograph files were recovered. Metadata and JPEG image file header structures and parameters were carefully inspected, showing that all photograph files were mutually consistent in their names, timestamps, file sizes and JPEG coefficients such as Quantization Tables. Although it is possible, in theory, to duplicate the characteristics of a JPEG file generated from particular firmware, the knowledge and tools required to do this are well beyond the normal image counterfeiter.
The relevant sequence of images were also closely inspected by a recognised expert in scientific photography, who confirmed that the logo artifact was so well integrated into the image as to suggest very strongly that the logo could not have been inserted after the fact. The phantom logo is present in the image thumbnail contained within the image file, which is also entirely consistent with the image file structure generated by the camera.
A close inspection highlights several features of the logo, as shown in Figure 2. The first is that it is not solid but appears in a checkerboard pattern. The second is that the edges are well contained within the lines of the tracksuit zip, and the third is that JPEG artifacts evident within the image do not suggest secondary compression. These three factors are strong indicators against image tampering.
Figure 2. A close-up view of the phantom logo. (Photo J Venditto, used with permission)
The original image in Figure 3 shows that the Adidas logo is close to the centre of the image. This location supports the notion that some enhancement, including the decision to use flash in-fill, has taken place within the camera, and that this processing might be a part of the explanation for the appearance of the logo.
Figure 3. The full image of interest (sanitised). (Photo J Venditto, used with permission)