Hey Guys,
I stumbled across this forum on google, but looking at the discussions posted so far have a good feel about the things I can learn from experienced people such as yourselves.
I was planning to write a paper in relation to the mechanism used by different companies to store jpg images on a digital camera and study its impact on any forensic analysis.
Was wondering if I could get some help and guidance in this relation as the concept of, what all should be covered in this paper is still blurry in my head.
Thoughts???
PU
Hi pummatt,
You will probably find that the file structure of image files stored on digital cameras is the same as computers. Most digital cameras use a type of removable compact flash memory, or smart card. These work exactly the same as a computer hard disk drive. They have a similar file system i.e. FAT12/16/32 with long filenames.
Andy
Hey Andy
Totally agree with that you have said so far, however from a forensic prospective how would one go about creating a relation between the picture recovered from the hard disk to the camera that was used to click it thus linking the person who owners the camera ???
How does one go about proving the same in the court of law… ?
Pummatt
You can get Exif data to display on most images using ordinary graphics software like ACDSEE.
For a really full explanation of EXIF (including hex structures and how to identify them), try here - http//
Andy
Hi Andy
If applications like ACDSEE could help you view this information would it also not help you change details?? It seems ok if I was to convict an amateur but in case of a pro I don’t know how good it will be.
Secondly not all cameras fore you to set a date and time I mean its not mandatory so I as a user don’t set the date and time on my camera how would you as an analyst prove anything against me???
Would you be in a position to provide me some more useful links in relation to this topic as I would really like to know more…… (Hopefully some white papers)
Cheers!!
If you have the images from a computer which you think are from a digital camera you can add a programme called Exif Reader as a file viewer to encase and then right click and send the file to it from within Encase. Exif reader can then in most instances give you chapter and verse about the image including f stop etc along with the make, model and serial number of the camera which took it (if your really lucky or if only a little bit lucky you will get some but not all of the details). All you need then is for a digital camera to have been seized so you can compare the details.