BHARATI VIDYAPEETH’S COLLEGE OF

ENGINEERING FOR WOMEN,

KATRAJ – DHANKAWADI, PUNE – 43.

MINI PROJECT
ON
Analysis for digital forensic of images

SUBMITTED BY

4215 Deshmukh Anushka Sureshrao

Guide : Prof. DR.S.P. Kadam

 ACKNOWELEDGEMENT

Apart from the efforts of all the team members, the section of this cyber security report topic
depends largely on the encouragement and guidance of our teacher. We take this opportunity
to express our gratitude to the teacher who have been instrumental in the approval of this
seminar topic.

We would like to show our greatest appreciation to Prof. DR.S.P. Kadam. We cannot think
them enough for their tremendous support and help. They motivate and encouraged us every
time while selecting the proper project topic. Without their encouragement and guidance, we
would not have been able to select the proper topic.

I would also prefer to express my appreciation and thanks to all my friends who knowingly or
unknowingly have assisted and encourage me throughout my hard work.
 Abstract

Increasing amount of illicit image data transmitted via the internet has triggered the need to
develop effective image mining systems for digital forensics purposes. This report discusses
the requirements of digital image forensics which underpin the design of our forensic image
mining system. Forensic investigators can communicate with the system via a grammar which
allows object description for training, searching, querying and relevance feedback. In addition,
we propose to use a Bayesian networks approach to deal with information uncertainties which
are inherent in forensic work. These inference networks will be constructed to model
probability interactions between beliefs, adapt to different users’ retrieval patterns, and mimic
human judgement of semantic content of image patches. An analysis of the performance of the
first prototype of the system is also provided.
 Index

SR. NO. CONTENT PAGE NO.

1 Introduction 5
2 Title 6
3 Objective 6
4 Theory 7
4.1 Cyber Crime 7
4.2 Digital Forensic 7
5 Implementation 11
6 Analysis 13
7 Conclusion 15
8 Reference 16
 Introduction

Digital forensics is the application of computer analysis techniques to determine potential legal
evidence of computer crimes or misuse that are caused by unauthorised users or by
unauthorised activities generated by authorised users. Digital forensics covers a wide range of
applications such as law enforcement, fraud investigation, theft or destruction of intellectual
property. Techniques used for such investigations are varied and may include data mining and
analysis, timeline correlation, information hiding analysis, etc. Since multimedia format is
widely used and readily available via the Internet, there are increasing criminal activities in the
last few years, which involve the transmission and usage of inappropriate material such as child
pornography in this format. Hence, much forensic evidence comes in the form of images or
videos that contain objects and/or scenes that may be related to criminal behaviours. A typical
investigation in digital forensics can generate large image and video data sets. For example, a
disk can easily store several thousands of images and videos in normal files, browser cache
files and unallocated space (i.e., non-file system areas on the disk which may contain fragments
of files).This can make the task of searching for, and retrieving, images/videos very time
consuming. Digital Image Forensics (DIF) efficiently seeks for evidence by using appropriate
techniques based on image analysis, retrieval and mining. Owing to rising criminal activities
via the internet, the use of such techniques for investigative purposes have only recently
emerged, although they have been intensively researched over the last three decades for many
other important applications: medical diagnosis, mineral exploration, environmental
monitoring and planning, aerial surveillance, etc.
 Title

Analysis for digital forensic of images

Objective

This tool focuses on image forensics for the purpose of integrity verification of digital images.
 Theory

Cyber Crime

Cybercrime is criminal activity that either targets or uses a computer, a computer network or a
networked device. Most cybercrime is committed by cybercriminals or hackers who want to
make money. However, occasionally cybercrime aims to damage computers or networks for
reasons other than profit. These could be political or personal. Cybercrime can be carried out
by individuals or organizations. Some cybercriminals are organized, use advanced techniques
and are highly technically skilled. Others are novice hackers.

Cybercrime is defined as an unlawful action against any person using a computer, its systems,
and its online or offline applications. It occurs when information technology is used to commit
or cover an offense. However, the act is only considered Cybercrime if it is intentional and not
accidental.

Digital Forensic

Digital Forensics is defined as the process of preservation, identification, extraction, and

documentation of computer evidence which can be used by the court of law. It is a science of
finding evidence from digital media like a computer, mobile phone, server, or network. It
provides the forensic team with the best techniques and tools to solve complicated digital-
related cases.Digital Forensics helps the forensic team to analyzes, inspect, identifies, and
preserve the digital evidence residing on various types of electronic devices. The main goal of
digital forensics is to extract data from the electronic evidence, process it into actionable
intelligence and present the findings for prosecution. All processes utilize sound forensic
techniques to ensure the findings are admissible in court.
Process of Digital forensics

Digital forensics entails the following steps:

Identification

It is the first step in the forensic process. The identification process mainly includes things like
what evidence is present, where it is stored, and lastly, how it is stored (in which format).

Electronic storage media can be personal computers, Mobile phones, PDAs, etc.

Preservation

In this phase, data is isolated, secured, and preserved. It includes preventing people from using
the digital device so that digital evidence is not tampered with.

Analysis

In this step, investigation agents reconstruct fragments of data and draw conclusions based on
evidence found. However, it might take numerous iterations of examination to support a
specific crime theory.
Documentation

In this process, a record of all the visible data must be created. It helps in recreating the crime
scene and reviewing it. It Involves proper documentation of the crime scene along with
photographing, sketching, and crime-scene mapping.

Presentation

In this last step, the process of summarization and explanation of conclusions is done.

However, it should be written in a layperson’s terms using abstracted terminologies. All

abstracted terminologies should reference the specific details.

Digital Forensics Tools

1. FotoForensics

This public FotoForensics service is a research tool for advancing digital forensics, network
security, and online privacy.

2. ProDiscover Forensic

ProDiscover Forensic is a computer security app that allows you to locate all the data on a
computer disk. It can protect evidence and create quality reports for the use of legal procedures.
This tool allows you to extract EXIF(Exchangeable Image File Format) information from JPEG
files.

3. Sleuth Kit (+Autopsy)

Sleuth Kit (+Autopsy) is a Windows based utility tool that makes forensic analysis of computer
systems easier. This tool allows you to examine your hard drive and smartphone.

4. CAINE

CAINE is a Ubuntu-based app that offers a complete forensic environment that provides a
graphical interface. This tool can be integrated into existing software tools as a module. It
automatically extracts a timeline from RAM.
5. EnCase

Encase is an application that helps you to recover evidence from hard drives. It allows you to
conduct an in-depth analysis of files to collect proof like documents, pictures, etc.

6. FTK Imager

FTK Imager is a forensic toolkit i developed by AccessData that can be used to get evidence.
It can create copies of data without making changes to the original evidence. This tool allows
you to specify criteria, like file size, pixel size, and data type, to reduce the amount of irrelevant
data.
 Implementation

Fig.1 Original Image Fig.2 Encrypted Image

Steps of encryption algorithm:

 Sending the image to the function Encrypt which, in turn, sends the image to the function
affine, which calls the procedure Keys to generate the randomly prime number between
(1– 256), under the condition that the common denominator between this number and 256
should be the integer one and keeping it in the matrix.
 Storing seven random keys in a matrix.
 Dividing the image into a set of blocks.
 Encrypting each 7bits with the seven keys which stored in matrix.
 Repeating the step No. (4) in each 7 bits in the same block.
 Repeating the steps No.(4) and (5) in all blocks
 Resegmenting the image into whereas each block is a matrix of (4*4)
 Substituting each block in the image by converting the row to the column.
 Taking each 2 vertically adjacent bits from the bottom of the image (b1, b2)
 Doing XOR between (b1 and b2).
 Doing XOR between the (b and 256).
Steps of decryption algorithm:

 Taking each 2 vertically adjacent bits from the beginning of the image (b1, b2)
 Doing XOR between (b1 and b2).
 Doing XOR between the (b and 256).
 Resegmenting the image into blocks each block is a matrix (4*4)
 Doing the tract substitutes for each block in the image by converting the row to the column.
 Taking the keys stored in the header of the image
 Finding the inverse of each key from the keys stored in the inverse’s matrix .
 Dividing the image into a set of blocks.
 Decrypting each 7bits of the block accompanied with the inverse of the keys that stored in
the matrix.
 Repeating the same step No. (9) for every 7 bits in the same block.
 Repeating the steps No. (9) and (10) for all blocks.
 Analysis

Digest of original Image

Digest of Encrypted Image

hfhjh
 Conclusion

The image encryption and decryption algorithm is designed and implemented to provide
confidentiality and security in transmission of the image based data as well as in storage. The
scheme presented in this paper has a simple implementation module. The proposed encryption
algorithm can ensure multiple criteria such as lossless, maximum distortion, maximum
performance and maximum speed. The proposed encryption method in this study has been
tested on different format images and showed good results
 Reference

 https://encrypt.imageonline.co/index.php
 https://fotoforensics.com/
 https://www.guru99.com/computer-forensics-tools.html
 https://www.britannica.com/topic/cybercrime