search

GuidoBartoli / sherloq

An open-source digital image forensic toolset
GNU General Public License v3.0
2.56k stars 237 forks source link
digital-image-forensics forensic-image-analysis gui image-forensics image-processing toolkit

readme

Sherloq
An open source image forensic toolset

Introduction

"Forensic Image Analysis is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters. Major subdisciplines of Forensic Image Analysis with law enforcement applications include: Photogrammetry, Photographic Comparison, Content Analysis, and Image Authentication." (Scientific Working Group on Imaging Technologies)

Sherloq is a personal research project about implementing a fully integrated environment for digital image forensics. It is not meant as an automatic tool that decide if an image is forged or not (that tool probably will never exist...), but as a companion in experimenting with various algorithms found in the latest research papers and workshops.

While many commercial solutions have high retail prices and often reserved to law enforcement and government agencies only, this toolset aims to be a both an extensible framework and a starting point for anyone interested in making experiments in this particular application of digital signal processing.

I strongly believe that security-by-obscurity is the wrong way to offer any kind of forensic service (i.e. "Using this proprietary software I guarantee you that this photo is pristine... and you have to trust me!"). Following the open-source philosophy, everyone should be able to try various techniques on their own, gain knowledge and share it to the community... even better if they contribute with code improvements! :)

History

The first version was written in 2015 using C++11 to build a command line utility with many options, but soon it turned to be too cumbersome and not much interactive. That version could be compiled with CMake after installing OpenCV, Boost and AlgLib libraries. This first proof of concept offered about 80% of planned features (see below for the full list).

While also including novel algorithms, the 2017 version mainly added a Qt-based multi-window GUI to provide a better user experience. Multiple analyses could be shown on screen and a fast zoom/scroll viewer was implemented for easier image navigation. That project could be compiled with Qt Creator with Qt 5 and OpenCV 3 and covered about 70% of planned features.

Fast-forward to 2020 when I decided to port everything in Python (PySide2 + Matplotlib + OpenCV) for easier development and deployment. While this iteration is just begun and I have yet to port all the previous code on the new platform, I think this will be the final "form" of the project (as long as someone does not volunteer up to develop a nice web application!).

I'm happy to share my code and get in contact with anyone interested to improve or test it, but please keep in mind that this repository is not intended for distributing a final product, my aim is just to publicly track development of an unpretentious educational tool, so expect bugs, unpolished code and missing features! ;)

Features

This list contains the functions that the toolkit will (hopefully) provide once beta stage is reached (NOTE: functions displayed in italics inside the program are not yet implemented!).

Interface

Tools

General

Metadata

Inspection

Detail

Colors

Noise

JPEG

Tampering

Various

Screenshots

General
General: Original Image, Hex Editor, File Digest, Similar Search

Metadata
Metadata: EXIF Full Dump, Header Structure

Inspection
Inspection: Enhancing Magnifier, Channel Histogram, Reference Comparison

Detail
Detail: Luminance Gradient, Echo Edge Filter, Wavelet Threshold, Frequency Split

Colors
Colors: RGB/HSV Plots, Space Conversion, PCA Projection, Pixel Statistics

Noise
Noise: Signal Separation, Min/Max Deviation, Bit Plane Values

JPEG
JPEG: Quality Estimation, Error Level Analysis

Tampering
Tampering: Contrast Enhancement, Copy/Move Forgery, Composite Splicing, Median Filtering

Installation

[1/4] Donwload source code

Clone the current repository into a local folder and change current directory to it.

[2/4] Virtual environment

For more information about Python Virtual Environments, you can read here or here. Choose one of the following method to create a new virtual environment with Python 3.11 for Sherloq.

Built-in Virtual Environment

Change current directory to Sherloq root, then initialize virtual environment folder:

$ python -m venv .venv

Then activate it:

Linux

$ source .venv/bin/activate

Windows

C:\> .venv\Scripts\activate.bat

VirtualEnvWrapper

Linux

$ sudo apt install python3-distutils python3-dev python3-testresources subversion
$ wget https://bootstrap.pypa.io/get-pip.py
$ sudo python3 get-pip.py
$ rm get-pip.py
$ sudo pip install virtualenv virtualenvwrapper
$ echo -e "\n# Python Virtual Environments" >> ~/.bashrc
$ echo "export WORKON_HOME=$HOME/.virtualenvs" >> ~/.bashrc
$ echo "export VIRTUALENVWRAPPER_PYTHON=/usr/bin/python3" >> ~/.bashrc
$ echo "source /usr/local/bin/virtualenvwrapper.sh" >> ~/.bashrc
$ source ~/.bashrc
$ mkvirtualenv sq -p python3

Windows

  1. Download Python 3.11 setup package from official site
  2. Install ensuring that "Add Python to PATH" and "PIP installation" are enabled
  3. Open Command Prompt and enter the following commands: 
    > pip install virtualenv virtualenvwrapper-win
> mkvirtualenv sq

    Conda environment

  4. Install latest Miniconda following instructions from the official site
  5. Create a new virtual environment: conda create --name sq python=3.11 -y
  6. Activate the sq environment: conda activate sq

[3/4] Install dependencies

pip install -r requirements.txt

[4/4] Launch program

python sherloq.py

Updates

When a new version is released, update the local working copy using Git, SVN or manually downloading from this repository and (if necessary) update the packages in the virtual environment following this guide.

Bibliography