2021-S-0036 Standard Guide for Image Authentication 

DRAFT 1 

2021-S-0036 Standard Guide 

for Image Authenication

VITAL 

Digital Evidence/Multimedia Scientific Area Committee

Organization of Scientific Area Committees (OSAC) for Forensic Science
2021-S-0036 Standard Guide for Image Authentication 

DRAFT 2 

Draft OSAC Proposed Standard

2021-S-0036Standard Guide for 

Image Authentication

Prepared by 

VITAL Subcommittee

Version 1.0 - Open Comment

August 2021

Disclaimer: 

This OSAC Proposed Standard was written by the Video/Imaging and Technology Analysis 

Subcommittee of the Organization of Scientific Area Committees (OSAC) for Forensic Science 

following a process that includes an open comment period. This Proposed Standard will be 

submitted to a standards developing organization and is subject to change. 

There may be references in an OSAC Proposed Standard to other publications under 

development by OSAC. The information in the Proposed Standard, and underlying concepts and 

methodologies, may be used by the forensic-science community before the completion of such 

companion publications. 

Any identification of commercial equipment, instruments, or materials in the Proposed Standard

is not a recommendation or endorsement by the U.S. Government and does not imply that the 

equipment, instruments, or materials are necessarily the best available for the purpose.
DRAFT 3

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 1. Scope

11 1.1 This standard provides information on the evidentiary value, methodology, and 

12 limitations when conducting an image authentication examination as a part of forensic 

13 analysis. The intended audience is examiners in a laboratory setting.

14 1.2 For the purposes of this document, “imagery” refers to the subject matter being examined 

15 which may include a single image or a series of images from any source.

16 1.3 The scope of the document includes image content authentication and image source 

17 authentication but does not include the interpretation of image content. Neither image source nor 

18 content authentication answers specific questions about the subject(s), object(s), or event(s) 

19 within an image, such as “Is a specific object present?” “What happened?” or “Where is the 

20 scene depicted?” These are all examples of questions answered through image content 

21 interpretation. For further information, see SWGDE Best Practices for Image Content Analysis.
DRAFT 4

22 1.4 Image authentication must not be confused with the requirement to demonstrate the 

23 integrity of the evidence as a precondition to admissibility in court. Maintaining evidentiary 

24 integrity ensures that the information presented is complete and unaltered from the time of 

25 acquisition until its final disposition. For example, the use of a hash function can verify that a 

26 copy of a digital image file is identical to the file from which it was copied, but it cannot 

27 demonstrate the veracity of the scene depicted in the image.

28 1.5 Image authentication and image content analysis may be performed in conjunction. 

29 1.6 This document is not intended to be used as a step-by-step practice.

30 1.7 This document is a guide for performing image authentication and the general manner 

31 used to formulate an interpretation. It does not describe analytical techniques or the associated 

32 limitations.

33 1.8 This document is not intended to be a training manual or a specific operating procedure 

34 and does not provide the criteria for the assessment of examiner competency

35 1.9 The detection of staging is considered image content interpretation and is not within the 

36 scope of this document. 

37 1.10 This document is not all-inclusive and does not contain information related to specific 

38 products. 

39 1.11 This standard cannot replace knowledge, skills, or abilities acquired through education, 

40 training, and experience, and is to be used in conjunction with professional judgment by 

41 individuals with such discipline-specific knowledge, skills, and abilities. 

42 1.12 This standard does not purport to address all of the safety concerns, if any, associated 

43 with its use. It is the responsibility of the user of this standard to establish appropriate safety, 
DRAFT 6

44 health, and environmental practices and determine the applicability of regulatory limitations 

45 prior to use. 

46

47 2. Referenced Documents

48 2.1 ASTM Standards: 

49 2.1.1 E2825 Standard Guide for Forensic Digital Image Processing 

50 2.1.2 E2916 Standard Terminology for Digital and Multimedia Evidence Examination 

51 2.2 SWGIT Material: 

52 2.2.1 SWGIT, Section 14: Best Practices for Image Authentication, updated January 11, 2013 

53 2.3 SWGDE Material: 

54 2.3.1 SWGDE Best Practices for Image Content Analysis, updated February 21, 2017 

55 2.3.2 SWGDE Training Guidelines for Video Analysis, Image Analysis, and Photography, 

56 updated February 8, 2016 

57 2.3.3 SWGDE Best Practices for Image Authentication, July 11, 2018 

58 2.3.4 SWGDE Recommended Guidelines for Validation Testing, September 5, 2014 

59 3. Terminology

60 3.1 Definitions: 

61 3.1.1 alter, v –to change image features through image editing techniques

62 3.1.2 composite, v –to duplicate or combine elements from one or more images

63 3.1.3 Computer-generated imagery, n –the creation of digital content through non64 photographic means
DRAFT 6

65 3.1.4 image, n –in image and video analysis, an imitation or representation of a person or thing 

66 drawn, painted, or photographed

67 3.1.5 image authentication, n–the process of determining whether the image source, or image 

68 content of the imagery is true or false

69 3.1.6 image content, n–visual information within an image, such as, subjects/objects, 

70 artifacts (due to compression and/or capture), and physical aspects of the scene

71 3.1.7 image content authentication, n–The process of determining whether the image 

72 content of the imagery is true or false

73 3.1.8 image source, n-the origin of an image, which may include the capture device or the 

74 provenance of the image 

75 3.1.9 image source authentication, n–the process of determining whether the asserted 

76 provenance of the imagery is true or false 

77 3.1.10 image structure, n–non-visual information about the image, such as file type, file 

78 compression, metadata, or the file properties of the image

79 3.1.11 manipulate, v –to alter the image structure, visual appearance or specific features 

80 within an image with the intention to cause misrepresentation or erroneous interpretation

81 3.1.12 morph, v –to transform components of one image onto those of another, often involving 

82 a sequence of intermediate images demonstrating incremental changes

83 3.1.13 stage, v –to alter a scene prior to image acquisition

84 4. Summary of Practice

85 4.1 Submitted files shall be preserved. Any processing shall be applied to a working copy of 

86 the imagery. 
DRAFT 7

87 4.2 Steps taken and methods used shall be sufficiently documented to support the examiner’s

88 observations and to permit a comparably trained person to understand the examination performed. 

89 4.3 Practitioners of image authentication should have sufficient training and expertise in image 

90 science to support observations and address potential sources of uncertainty in the analysis. For 

91 further information, see SWGDE Training Guidelines for Video Analysis, Image Analysis, and 

92 Photography.

93 5. Significance and Use

94 5.1 Image authentication may establish the probative value of imagery by determining whether it 

95 has been computer-generated or manipulated and/or by determining the source of the 

96 imagery. Authentication of imagery is important because image manipulation may be involved in 

97 criminal activity. 

98 5.2 This guide describes methods that may determine if questioned imagery is a true

99 representation of the submitted image by some defined criteria, and/or to determine the original 

100 source or content of the imagery.

101 5.3 Image manipulations can be accomplished through multiple means. Some types of image 

102 manipulation require little skill, because software applications exist specifically for this purpose. 

103 However, detection requires that practitioners of authentication techniques be knowledgeable in 

104 manipulation techniques. Common techniques that may result in image manipulation include one or 

105 a combination of alteration, compositing, and computer-generated imagery. 

106 5.4 The detection of manipulations can be accomplished through multiple means. Forensic 

107 practitioners should examine the image content, image source and the image structure (including 

108 associated metadata).
DRAFT 8

109 5.5 Image content analysis refers to an examination of the visual characteristics which may 

110 include the consistency of the lighting (direction, quality, color, contrast, reflections), sharpness, 

111 depth-of-field, compression artifacts, image noise, relative size of objects or the presence of 

112 compositing artifacts.

113 5.6 Image structure analysis refers to examination of file metadata and format properties. For 

114 example, file metadata may identify image editing software and processing history, camera 

115 make, model, serial number and other identifying information. Format properties may be 

116 checked for consistency with files from the purported source. 

117 5.7 Regarding issues of authenticity, possible factors include: 

118 5.7.1 Manipulation could be masked through changes in contrast, contrast or multiple levels 

119 of image recompression, photocopy or screen grab of image and rescaling. 

120 5.7.2 The skill level and the time necessary to perform manual computer-generated 

121 manipulations. 

122 5.7.3 Based on advanced software algorithms, Generative Adversarial Networks(GAN) and 

123 Deepfake technology, it may be possible to manipulate an imagery in a manner that may not be 

124 detectable by subsequent analysis using currently available tools and techniques. Examination of 

125 a series of related images may assist in the authentication.

126 6. Evidence Assessment

127 6.1 Proper evidence handling procedures shall be employed. For additional information on 

128 proper evidence handling guidelines, refer to SWGDE Best Practices for Maintaining the Integrity 

129 of Imagery.
DRAFT 9

130 6.2 General guidelines concerning the assessment of evidence for image authentication are 

131 provided as follows:

132 6.2.1 Review the request for examination to determine the subject matter of the image 

133 authentication. The scope of authentication can be extremely broad so examination requests should 

134 contain sufficient information to clarify the scope of the request and the question to be answered 

135 while limiting extraneous information.

136 6.2.2 Information regarding any suspected manipulation may be considered and may even be 

137 necessary to adequately clarify the question; however, examiners should be cognizant of the 

138 potential for inadvertent bias.

139 6.2.3 Determine if all, or some subset, of the submitted imagery is requested to be 

140 authenticated.

141 6.2.4 Based on the request, determine if the imagery is fit for purpose. Quantity and/or quality 

142 of imagery may influence the degree to which an examination can be completed.

143 6.2.5 If the imagery is not fit for purpose, determine if it is possible to obtain additional imagery. 

144 If additional imagery cannot be obtained, this may preclude the examiner from proceeding with an 

145 examination or may limit the strength of the results.

146 7. Methodology

147 7.1 The applied methods will depend on the requested examination. There is no single 

148 methodology for image authentication, however any methodology should incorporate both image 

149 content and image structure analysis.

150 7.2 The submitted imagery shall be preserved. Any processing shall be applied only to a working 

151 copy of the imagery. [Preservation may be limited if this is analog evidence.]
DRAFT 10

152 7.3 Tools, techniques, and procedures should be validated to ensure repeatability, refer to 

153 SWGDE Recommended Guidelines for Validation Testing. Methodology, workflow, and observations should 

154 be documented contemporaneously.

155 7.4 Subjective assessments should be recorded with sufficient information to support the 

156 examiner’s observations, and the significance of the observation in the context of the overall 

157 analysis.

158 7.5 Assess the image structure to determine whether factors are present that can answer the 

159 examination request. Image structure examinations may include, but are not limited to:

160 7.5.1 An examination of the file format of the imagery.

161 7.5.2 An examination of the metadata of the imagery. Metadata may be useful in identifying the 

162 source and processing history of the file, but can be limited, absent, inaccurate, or altered without 

163 necessarily changing image content. Metadata may include, but is not limited to:

164

165

166

167

168

169

170

171

7.5.2.1 Camera make/model/serial number,

7.5.2.2 Date/time of creation or alteration,

7.5.2.3 Camera settings,

7.5.2.4 Resolution and image size,

7.5.2.5 Camera rotation/orientation,

7.5.2.6 GPS coordinates/elevation, 7.5.2.7

Processing/image history,

7.5.2.8 Filename,

172 7.5.2.9 Lens or flash information,
DRAFT 11

173

174

7.5.2.10 Framerate, and

7.5.2.11 Thumbnail information.

7.5.3 An examination of the data file packaging (container analysis). This analysis may include, 175

176 but is not limited to:

177

178

179

7.5.3.1 Hex level header, footer or other information about the file, and

7.5.3.2 EXIF information.

7.5.4 An examination of image noise. This analysis may include, but is not limited to:

180 7.5.4.1 Photo-Response Non-Uniformity (PRNU), this noise signature can be used to correlate 

181 images from the same source.

182 7.5.4.2 Stochastic noise evaluation can be used to show consistency between images from the 

183 same sensor manufacturer.

184 7.6 Assess the image content to determine whether factors are present that can answer the 

185 examination request.

186 7.6.1 Assessment of the image content may be performed visually and may be assisted by image 

187 processing or filtering techniques. For example, examination of discreet color channels, or adjusting 

188 tonal contrast may help to detect editing or compositing marks.

189

190

191

192

7.7 Image content examinations may include, but are not limited to a review of the following:

7.7.1 Photographic aspects: 

7.7.1.1 Focus

7.7.1.2 Depth of field

193 7.7.1.3 Sharpness / blur
DRAFT 12

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

7.7.1.4 Perspective

7.7.1.5 Grain / noise structure

7.7.1.6 Lens distortion

7.7.2 Artifacts:

7.7.2.1 Chromatic aberrations

7.7.2.2 Compression blocking or patterns 

7.7.2.3 Editing / compositing marks

7.7.3 Physical aspects of the scene:

7.7.3.1 Light quality, color, direction, contrast

7.7.3.2 Shadows

7.7.3.3 Relative scale

7.7.3.4 Composition

7.7.3.5 Physical, temporal, or geographic inconsistencies

7.7.4 Subject characteristics: 

7.7.4.1 Human/animal features (hair, scars, blemishes, creases, vein patterns

7.7.4.2 Contact between objects (human/human, such as skin to skin, human / object, object / 209

210 object)

211 7.7.4.3 Consistency in patterns and textures

212 8. Interpretation of results

213 8.1 Image content authentication results in the determination of the presence or absence of 

214 manipulation. Opinions may include the following: 
DRAFT 13

215 8.1.1 Support for no evidence of manipulation or alteration

216 8.1.1.1 An opinion that the imagery appears to be consistent with its original structure and

217 content is consistent with expectations. However, this is not definitive evidence that the image is 

218 unaltered. 

219 8.1.2 Inconclusive

220 8.1.2.1 An opinion there is insufficient evidence to reach a determination of authenticity 

221 and/or the imagery is not fit for purpose 

222 8.1.3 Support for evidence of alteration but not manipulation

223 8.1.3.1 An opinion the imagery is not in its original structure and/or content but does not 

224 appear to be altered in a manner that results in misrepresentation. However, this is not definitive

225 evidence that the image was not manipulated. 

226 8.1.4 Support for evidence of manipulation 

227 8.1.4.1 An opinion the imagery has been altered from its original structure and/or content 

228 which results in misrepresentation. 

229 8.2 Image source authentication results in the establishment of the provenance or origin of 

230 the image. Opinions may include the following: 

231 8.2.1 Support the imagery is authentic

232 8.2.1.1 An opinion the imagery is a true representation of the image source. 

233 8.2.2 No support the imagery is inauthentic

234 8.2.2.1 An opinion the imagery may be a true representation of the image source. 

235 8.2.3 Inconclusive
DRAFT 14

236 8.2.3.1 An opinion there is insufficient evidence to reach a determination whether the 

237 imagery is a true or false representation of the image source.

238 8.2.4 Support the imagery is inauthentic

239 8.2.4.1 An opinion the source or provenance is established to be different than the purported 

240 source or provenance. 

241 8.2.4.2 An opinion the imagery is a false representation of the image source.

242 8.3 The source or provenance of an image may be determined as a result of the examination 

243 as detailed in the methodology section. However, lack of information in support of camera 

244 source identification does not preclude the possibility the imagery was captured by the camera in 

245 question. 

246 8.4 The formation of an opinion should include the following steps:

247 8.4.1 Assess the significance of each observed characteristic.

248 8.4.2 Form an interpretation to address the requested analysis based on the observed features 

249 and any necessary research conducted. Interpretations must be properly qualified and address the 

250 limitations of the methodology and research. 

251 8.4.3 Report the results, as well as a clear indication of the strength of the results (when 

252 appropriate). 

253 8.4.3.1 Examiners should report the observed features, including those that do and do not 

254 support the specified results.

255 8.4.3.2 Results should not be reported in terms of numerical probability without a proper 

256 scientific foundation and/or related research.
DRAFT 15

257 8.4.4 The results of the examination should undergo independent review by a comparably 

258 trained individual to verify the methodology and results. If disputes arise during review, a means 

259 for resolution of issues should be in place. 

260 8.5 Forensic examiners should take care not to overstate results. 

261 8.6 Bias is one potential source of uncertainty in any forensic analysis. It is the responsibility 

262 of the organization and the examiner to minimize the effects of bias when conducting 

263 examinations and performing reviews. Minimizing the effects of bias can be accomplished 

264 through awareness, training, and quality assurance measures, including the limitation of task 

265 irrelevant information and blind verification. Potential sources of bias and the steps taken to 

266 minimize the effects of bias should be documented.

267

268 9. Keywords

269 9.1 criminal justice system; image processing; digital image processing; forensic image 

270 authentication, content authentication, source authentication, image authenticity, image 

271 manipulation, image alteration.

272

273 NOTE: Appendices for general reference only during the review process (not to be included in 

274 the published standard guide) 

275

276

277

278
DRAFT 16

279

280

ANNEX

X1. (Nonmandatory Information) 

281 X1. WORK FLOW EXAMPLE 1 – CONTENT AUTHENTICATION

282

283 X1.1 A local police department receives a report of possible child exploitation and downloads 

284 imagery from the internet. After retrieval, imagery is turned over to a forensic laboratory to 

285 determine if the child depicted in the imagery is real, and/or to determine if any manipulations 

286 have occurred to the images.

287 X1.2 Following the methodology described above, the laboratory proceeds:

288 X1.2.1 The request is reviewed, and it is:

289 X1.2.1.1 determined that the requested analysis is conducted by the laboratory;

290 X1.2.1.2 determined that all necessary items to support the requested analysis have been 

291 submitted;

292 X1.2.1.3 determined that the laboratory has the necessary equipment, materials, and 

293 resources needed to conduct the requested analysis; and

294 X1.2.1.4 assigned to an analyst.

295 X1.2.2 The analyst acquires the necessary imagery.

296 X1.2.2.1 The analyst determines if the images are of sufficient quality for the requested 

297 analysis. If the image quality is insufficient to proceed, then the analyst calls the investigating 

298 agency to determine if additional images can be submitted. 

299 X1.2.2.2 The analyst reviews the images and selects relevant images for further analysis.

300 X1.2.3 The analyst makes copies of the selected imagery for use as working copies and

301 safely stores the original imagery. 

302 X1.2.4 The analyst examines the imagery file structures which includes an examination of 

303 the file formats and associated metadata. The analyst determines there is no GPS information,

304 and the file creation dates, and file modification dates are the same. The analyst similarly 

305 determines the files contain basic camera setting information and thumbnail images are present. 

306 This information is documented in the case notes.

307 X1.2.5 The analyst determines no image processing software tags exist within the metadata. 

308 This information is documented in the case notes.
DRAFT 17

309 X1.2.6 The analyst examines the content of the imagery. The following inconsistencies were 

310 observed and documented: 

311 X1.2.6.1 Most of the images show no signs of lossy compression, but one portion of a single 

312 image shows 8x8 jpeg blocking. 

313 X1.2.6.2 The portion of the suspect image appears to have a light source inconsistent with 

314 the remainder of the image.

315 X1.2.6.3 The scale of the subject depicted in the suspect portion is inconsistent with objects 

316 in the remainder of the image.

317 X1.2.6.4 The depth-of-field in the suspect portion is inconsistent with objects in the 

318 remainder of the image.

319 X1.2.7 The analyst concludes that one image of the submitted series appears to have been 

320 manipulated. 

321 X1.2.8 A comparably trained individual in the laboratory independently reviews the results 

322 of the examination and arrives at the same conclusion. 

323 X1.2.9 The analyst issues a report. Per the laboratory’s Standard Operating Procedures 

324 (SOPs), the report includes a review of the materials received, the request, the methods used, the 

325 results obtained, the basis for the results, and the results. 

326
DRAFT 18

327 APPENDIX

328 (Nonmandatory Information) 

329 X1. X1. WORKFLOW EXAMPLE 2 – SOURCE AUTHENTICATION

330

331 X1.1 A local police department receives a report of possible child exploitation and 

332 downloads imagery from the internet. After retrieval, the police department develops a suspect 

333 and completes a search of the suspect’s house pursuant to a search warrant. During the search, 

334 two cellular telephones are recovered. The investigating agency contacts their laboratory to 

335 determine if the imagery was captured by the recovered cell phones. 

336 X1.2 Following the methodology described above, the laboratory proceeds: 

337 X1.2.1 The request is reviewed and it is:

338 X1.2.1.1 determined that the requested analysis is conducted by the laboratory;

339 X1.2.1.2 determined that all necessary items to support the requested exam have been 

340 submitted; 

341 X1.2.1.3 determined that the laboratory has the necessary equipment, materials, and 

342 resources needed to conduct the requested analysis; and

343 X1.2.1.4 assigned to an analyst.

344 X1.2.2 The analyst acquires the necessary materials.

345 X1.2.2.1 If laboratory policy requires, the analyst calls the investigating agency and verifies 

346 that all imagery and relevant phones have been received. 

347 X1.2.2.2 The analyst reviews the images and selects relevant images for further analysis.

348 X1.2.3 The analyst makes copies of the selected imagery for use as working copies and 

349 safely stores the original imagery. Prior to capturing exemplar images with the submitted 

350 phones, the analyst requests permission from the investigating agency, because this action will 

351 change the data on the phones. The analyst is informed the phones in question have already been 

352 thoroughly documented, and receives appropriate permissions. 
DRAFT 19

353 X1.2.4 The analyst examines the file structure of the questioned imagery which includes an 

354 examination of the file formats and associated metadata. The analyst determines there is no GPS 

355 information, and no make, model or serial number captured in the imagery metadata. This 

356 information is documented in the case notes. 

357 X1.2.5 The analyst determines no image processing software tags exist within the metadata. 

358 This information is documented in the case notes.

359 X1.2.6 The analyst examines the content of the imagery. The average luminance is 

360 determined to be above the threshold needed for Photo-Response Non-Uniformity (PRNU) 

361 examination. 

362 X1.2.7 The PRNU pattern is calculated for each of the relevant images.

363 X1.2.8 Exemplar images are captured with the submitted phone cameras.

364 X1.2.9 The PRNU patterns are calculated for each set of exemplar images.

365 X1.2.10 The PRNU patterns are compared between the examined images and the exemplar 

366 images. A correlation value is calculated for each comparison.

367 X1.2.11 Based on the correlation values calculated, the analyst reaches the conclusion that 

368 the examined images were captured by one of the submitted phones. 

369 X1.2.12 A comparably trained individual in the laboratory independently reviews the results 

370 of the examination. 

371 X1.2.13 The analyst issues a report. Per the laboratory’s SOPs, the report includes a review 

372 of the materials received, the request, the methods used, the results obtained, the basis for the 

373 results, and the results.