An Autopsy module, that checks if a photo was truly taken by a suspected camera or not.
Camera Fingerprint PRNU uses photo response non-uniformity of camera sensor (PRNU) to check if a photo was truly taken by a suspected camera or not. Module is not based on metadata such as EXIF, performs a physical analysis of the camera sensor, determines photo response non-uniformity (PRNU), uses the principle that each sensor pixel behaves differently with effects such as non-uniform photo response, making each sensor is unique, identifies each pixel anomaly and uses this information to create a description of the camera sensor - the camera fingerprint.
- Windows OS
- Autopsy - version 4.15.0
- Apache NetBeans IDE - version 9.0
- Python - version 3.6.0
Installation:
- Download file org-gbies-camerafingerprint.nbm from https://github.com/ernestbies/Camera-Fingerprint-PRNU/blob/master/build.
- Run Autopsy.
- Go to Tools -> Plugins -> Downloaded -> Add Plugins.
- Choose file org-gbies-camerafingerprint.nbm.
- Click Install.
- Follow the steps, restart Autopsy.
Uninstallation:
- Run Autopsy.
- Go to Tools -> Plugins -> Installed.
- Select Camera Fingerprint PRNU.
- Click Uninstall.
- Follow the steps, restart Autopsy.
- Take reference photos of white surfaces (walls or clouds) with the suspected camera so that the module can create the camera fingerprint.
- Add evidence photos to Data Source.
- Select a directory with reference photos and enter the camera fingerprint name.
- You can resize the fingerprint to increase accuracy.
- If the camera fingerprint has been created before, you can load it from a file (.cfp).
- Case Study: https://www.youtube.com/watch?v=lsoqVuuq9T0&t=5s
Project based on https://github.com/polimi-ispl/prnu-python
Created by Grzegorz Bieś [g.bies@poczta.fm], Ernest Bieś [ernestbies@gmail.com]