Comparing JPEG Quantization Tables

| 1 TrackBack

With this blog post I release a small script that helps in comparing quantization tables of JPEG images.

Quantization tables are stored in DQT segments of JPEG files.

I wrote a little script called dqtmd5 in order to ease the comparison of quantization tables from multiple JPEG files. The script parses the header of a JPEG file and extracts the DQT segments. At this it mostly relies upon the Image::MetaData::JPEG module. Then the script parses the matching segments, extracts the quantization tables and joins them in a canonic way. Hence the method is resilient against different ways of storing quantization tables. Finally the script calculates a MD5 checksum of the extracted data:

$ ./dqtmd5.pl sample.jpg 
41e8fb65ebb533a82f392bed8988eb47 sample.jpg

In the same manner DQT hashes can be calculated from (unedited!) pictures that were taken by digital cameras. I provide some sample hashes for Canon. The make and model strings were extracted from the EXIF data of the sample images.

8ba82c6f0fe031d5b7234126b9521d34        Canon   Canon DIGITAL IXUS 75
bc610f3b20f21ed06ce1f72b0ba0aeb1        Canon   Canon DIGITAL IXUS 75
41e8fb65ebb533a82f392bed8988eb47        Canon   Canon EOS 10D
71377799fea3469984b1a3fb2f0943c6        Canon   Canon EOS 10D
d2c2c9f7b759bd6ffa62f57a28381ac4        Canon   Canon EOS 10D
55efbe121f05f17cde4ef656d8c9f4f3        Canon   Canon PowerShot A410
981c174a64918a338d4b8ea3c59068bb        Canon   Canon PowerShot A410

While some manufacturers, like Canon, decided to go with a small set different quantization tables, others vary them frequently depending on the light situation and program settings. Again here is an example, taken from the FUJI FineFix F455.

Now one can compare DQT check sums from pictures of an unknown origin and compare them easily with reference data set. This procedure can hint at the camera make and model or at the graphics program that was used to edit the image.

1 TrackBack

Week's Links from Alessandro "jekil" Tanasi blog on December 14, 2007 1:01 AM

The best security links of this week from Planet Security. ... Comparing JPEG Quantization Tables ... Read More

Archives

Imprint

This blog is a project of:
Andreas Schuster
Im Äuelchen 45
D-53177 Bonn
impressum@forensikblog.de

Copyright © 2005-2012 by
Andreas Schuster
All rights reserved.
Powered by Movable Type 5.12