Darktable to Uncover NEF Fraud. Using 3,6,1 + 6

Perspective lines that you are talking about sound like you have clicked on one of the auto modes to detect strait lines in the image and allow DT to correct shear, or horizontal or vertical elements to correct the perspective of building or other elements in the photo…if there are there in one photo and not the other it may indicate a difference but this could also be created by one photo having lens corrections on and one not or maybe some other contributing factor…If you have your raw file and this imposter raw file there should be intact meta data and if they don’t match on several key tags then it has be doctored or if it is missing meta data that has been scrubbed that might be a sign…

There are lots examples of this type of analysis

Do you have two raw files…yours and one claiming to be the same file but you think has been doctored…

2 Likes

There was an earlier thread a while back and you might be able to leverage this approach if you have the two raw files… Dumping unmodified raw image data from raw files?

Instead of doing this yourself, I think you should talk to a lawyer, and have them contact an expert in the domain of image forensics.

If English is your first language, you are claiming here that the scene (not the photo of the scene, but the real-world physical location itself) has been recreated “fraudulently”, which makes no sense.

If someone “recreated” a scene, it would be trivial to find differences - the exact positions of objects and lighting would be impossible to re-create exactly. If you have a photo of the original, you simply compare them. I’m not sure why you need to do anything with darktable.

If this is a criminal matter, you would be wise to let law enforcement handle it. If you’re saying you’ve been accused of a criminal act, find a criminal defense attorney.

7 Likes

Is it something like this you are asking about?

You find my email here if you want to send me the raw file or files https://kameratrollet.se/kontakt/

1 Like

Made of clear plastic or glas?

2021-10-21_00-27-49

One other consideration. Suppose you use darktable to “prove” the raw file had been doctored, by using various modules. Could the defence attorney then use the fact that darktable isn’t designed as a photo forensic application to get this “evidence” thrown out?

Hello and Good Afternoon,

I am happy to see so many responses and I am learning how to use a forum… (not be so vague)
However, I am going to send up (2) photos which are fraud. (1) will be the actual Nef and the other will be the Jpg. Both from the same disk. Maybe someone can give me a direction. I only have (1) raw file for each photo just like a Nikon produces. I don’t know if the raw file will be too big to upload. but I will try! Not sure if I send the photos in a reply or start a new post.
Can you tell me which is the right approach here? Thanks Todd for your feedback

David just to clarify. Do you have what you would identify as the original raw and also do you possess the “copy”. Earlier you said visually you clearly have things added or removed?? If so there is no real dispute as to the fact that the images are not the same but which is real. So really you are needing to dive into things that digitally uniquely identify the image as being from your camera body/lens and not created elsewhere as a photographic copy as you might do with a slide…so I don’t think DT has any role to play in where you go next?? Just my thoughts

pixls.us is the easiest forum to post files of all that I frequent. Just drag your file from whatever file explorer you use to the edit box, and 'ere y’go!

Good point,
But this issue is not for court! This issue is to show other officials what has happened. For instance, I have already been advised as to what to do about this from the authorities because they have seen and do recognize the fraud and the disk has been authenticated. There is no dispute!

This approach is personal and designed to help me explain what is in the pictures. Once I am able to understand and talk the language I will be satisfied. People here on the forum are ignoring the fact that I am wanting to understand the process that the photo has gone through to achieve the results I got …from the Nega Doctor component for example. I have spoken with many experts and have used their software… such as Dyna Raw, Gimp, Illustrator and various HDR applications. I have purchases just about every relevant application (by my standards) except Adobe products because too much software over-takes my computers and I have landed on DT.

I have had SVG experts as well as AutoCad experts and all do agree that fraud has taken place. The dilemma for me is the process of explaining the process after the results. Personally, I think most people / digital artists do suffer the very same problem. Finally, I was tutored in the art of ‘Tilt-Shifting’. which is the method used to create this fraud and I was told that to be able to get a grip on the shadows etc, I should focus on 'Contrast, Negation and learn to use the Curve Tools. This is how I ended up using darktable… The ‘Get Structure’ component is very telling to me about the images but the Nega-Doctor seems to cut right through and I can literally seem where the fraudulent edits were applied.
I am looking for someone to tell me what is happening to the image when these components are applied. Hope this is helpful!

David you can blend two images in difference mode and see on a pixel level where things have changed…Visually you can see the differences as you clearly state so then what has happened is that your image has been subjected to some image editing. A professional forensic image specialist might be able to work it backwards but I don’t think you will be able to. You image has been altered the terms are commonly use image splicing or copy and move…explained simply here. https://www.ijtrs.com/uploaded_paper/Digital%20Image%20Forgery%20and%20techniques%20of%20image%20forgery%20%20%20detection%201.pdf This is what has likely happened. The fact that you can visualize it in DT really isn’t going to help much over any other tool to break down exactly what they did. Still not sure why you are in Negadoctor…basically you have just inverted the image unless you have made more changes??? Basically the source image has deletions and perhaps some additions either by manipulating part of that same source image or introducing elements from a second or more images…I don’t think you are going to get more out of it…You could create grey maps or color maps to see if you can also visualize the changes more clearly to outline or highlight them but again from what you keep saying it passes the BOT…ie Bloody Obvious Test…

Todd,

I would like to start a new post where I send up 4 photos… not sure where to go to do that!
Can you show me please.

I went there but see different language… You can contact me directly:
lambwebdesign@gmail.com

Done.

The 1621x1092 pixel PNG image posted above by @ELA seems to be a negative colour image of a room. The top row and bottom two rows are a constant shade of gray (106 on a scale of 0 to 100). I don’t know any camera that would make those gray lines. Hence, it isn’t an unedited photo of a film negative.

I can’t see evidence of JPEG compression artifacts. However, this image is small, and a downscaling may have removed such artifacts.

After negating the image and adjusting the red level, we see what appears to be a photo of a room, taken with a fairly wide-angle lens, pointing slightly downwards, lit mostly by an on-camera flash close to the lens but above and to the left. There is some ambient light. Shadows seem consistent. To the right, a board is labelled “GYPROC FIRE PROTECTION”.

The image is badly over-exposed (or possibly a photograph of the film negative was badly under-exposed). Because the light source is close to the camera lens, there is very little modelling. These two factors make it difficult to understand the objects in the room.

Start a topic the way you did for your first post and upload your photo’s. Clearly state your query. Its a touchy topic but I suppose you could ask for ways to try and detect retouching or compare two images otherwise not really sure this forum would be a place to continue much beyond that …
Darktable is a raw processor not a forensic tool…simply looking at the waveform scope should show gross differences of the type you have described…

Negadoctor is just inverting your image…you could just invert a tone curve…

original

After negadoctor What is black becomes white what is red becomes green

Perspective is to help with distortion…see this recent play raw image. The building has distortion. The algorithm tried to identify horizontal and vertical elements that it can use to correct

Before…

Verticals corrected and the image cropped to clean it up

Even if it’s not going to court, be aware that using these tools may not actually “prove” anything, especially since you have already decided that the image is fraudulent?

2 Likes

There’s clearly a language barrier issue here, but for the purposes of proving that something has been altered or forged, darktable is not the correct tool.

A decade or so ago, some Nikon cameras shipped with a feature that allowed an image to be authenticated cryptographically such that you could be sure it was unaltered since it was shot by the camera. This was intended to be used by photographers providing court evidence/etc.

The feature was discontinued because it simply did not work - it got pwnt over a decade ago - Nikon Image Authentication System: Compromised | ElcomSoft blog

It would be really cool if you could put a gpg key on your sd card and the camera would sign the files it produced with the key.

1 Like