Citation
A forensic analysis of digital image characteristics associated to Flickr and Google Plus

Material Information

Title:
A forensic analysis of digital image characteristics associated to Flickr and Google Plus
Creator:
Lawson, Melissa ( author )
Place of Publication:
Denver, Colo.
Publisher:
University of Colorado Denver
Publication Date:
Language:
English
Physical Description:
1 electronic file (61 pages) : ;

Thesis/Dissertation Information

Degree:
Master's ( Master of science)
Degree Grantor:
University of Colorado Denver
Degree Divisions:
Department of Music and Entertainment Industry Studies, CU Denver
Degree Disciplines:
Recording arts

Subjects

Subjects / Keywords:
Flickr (Electronic resource) ( lcsh )
Google ( lcsh )
Digital media ( lcsh )
Digital video ( lcsh )
Genre:
bibliography ( marcgt )
theses ( marcgt )
non-fiction ( marcgt )

Notes

Review:
This study explores the patterns and characteristics given to images after they have been uploaded and downloaded to and from Flickr and Google Plus. The examination not only tests the impact that a mobile phone and desktop have on images during the transference, but also explores different options to download protected images depending on the internet browser and social platform being used. It is discovered that certain methods of downloading protected images reveal varying results, some methods being better than others at retaining authentic information about the file. Largely, metadata in images downloaded from Flickr remain completely intact so long as account users do not protect their images. If images are protected, there are ways of saving them, however their metadata is completely stripped in the process. On the other hand, the capability of downloading protected images in their exact original pixel width and height is possible on Google Plus depending on the download method and internet browser being used. Furthermore, Google Plus preserves unique information embedded in the extension of image files. Social Media is universal and ever present in our daily lives which is how it has become an incredibly powerful tool to help build a case and why it is routinely used to gather evidence in investigations. By understanding the base behavior of these social media platforms, we can yield results to inform best practices for forensic investigations.
Bibliography:
Includes bibliographical references.
System Details:
System requirements: Adobe Reader.
Statement of Responsibility:
Melissa Lawson.

Record Information

Source Institution:
University of Colorado Denver
Holding Location:
Auraria Library
Rights Management:
All applicable rights reserved by the source institution and holding location.
Resource Identifier:
on10264 ( NOTIS )
1026418170 ( OCLC )
on1026418170
Classification:
LD1193.A70 L39 2017 ( lcc )

Downloads

This item has the following downloads:


Full Text
A FORENSIC ANALYSIS OF DIGITAL IMAGE CHARACTERISTICS ASSOCIATED TO
FLICKR AND GOOGLE PLUS by
MELISSA LAWSON
B.S., Metropolitan State College of Denver, 2000
A thesis submitted to the Faculty of the Graduate School of the University of Colorado in partial fulfillment of the requirement for the degree of Master of Science Recording Arts Program
2017


11
This thesis for the Master of Science degree by Melissa Lawson Has been approved for the Recording Arts Program by
Dr. Catalin Grigoras, Chair Professor Jeff M. Smith Dr. Marcus Rogers
November 30, 2017


Lawson, Melissa (M.S., Recording Arts Program)
A Forensic Analysis of Digital Image Characteristics Associated to Flickr and Google Plus
m
Thesis directed by Assistant Professor, Dr. Catalin Grigoras
ABSTRACT
This study explores the patterns and characteristics given to images after they have been uploaded and downloaded to and from Flickr and Google Plus. The examination not only tests the impact that a mobile phone and desktop have on images during the transference, but also explores different options to download protected images depending on the internet browser and social platform being used. It is discovered that certain methods of downloading protected images reveal varying results, some methods being better than others at retaining authentic information about the file. Largely, metadata in images downloaded from Flickr remain completely intact so long as account users do not protect their images. If images are protected, there are ways of saving them, however their metadata is completely stripped in the process. On the other hand, the capability of downloading protected images in their exact original pixel width and height is possible on Google Plus depending on the download method and internet browser being used. Furthermore, Google Plus preserves unique information embedded in the extension of image files. Social Media is universal and ever present in our daily lives which is how it has become an incredibly powerful tool to help build a case and why it is routinely used to gather evidence in investigations. By understanding the base behavior of these social media platforms, we can yield results to inform best practices for forensic investigations.
Approved:________________
Approved:________________


IV
DEDICATION
I dedicate my thesis paper to my four-year old son. Mastery is self-improvement and personal growth -never stop learning and applying new skills. Be determined. Be self-disciplined. Be courageous. Be compassionate. Be great. I love you too much.


V
ACKNOWLEDGEMENTS
This paper could not have been written to its fullest without the help of Dr. Grigoras and Professor Jeff Smith who not only played a role in the collection of test images and guidance for this study, but also gave me continuous support, patience, the motivation to never give up and provided an immense amount of knowledge throughout the course of the MSRA Digital Media Forensics program. Thank you for teaching me in, slow motion when I needed it and for coaching me to approach problems in a consistent and systematic way to find the best conclusions for things that are seldom what they seem. Welcome to real life.
My sincere thanks also go to Dr. Marcus Rogers for not only instructing our Computer Forensics course and sharing your tricks of the trade, but for the inspiring discussion at AAFS that led me to obtain a FAA drone pilot license. As one of my committee members, I truly value your insightful feedback.
Last but not least, thank you to my MSRA 2017 classmates for sticking together through thick books and thin deadlines, and whom I truly call lifetime friends now. I look forward to seeing you on the field!


VI
TABLE OF CONTENTS
I. INTRODUCTION..........................................8
RELATED WORKS........................................9
II. TECHNICAL OVERVIEW...................................II
JPEG COMPRESSION....................................II
INFORMATION BEHIND DIGITAL IMAGES; TERMS, CONCEPTS AND
DEFINITIONS.........................................12
HASH VALUES.........................................13
JPEGMIM.............................................14
WEBP................................................14
HEXADECIMAL, BINARY FILE AND HEX EDITORS ...........14
FLICKR..............................................15
GOOGLE PLUS.........................................17
III. PREPARATION.........................................18
IV METHOD................................................19
UPLOADING AND DOWNLOADING ..........................19
SOCIAL NETWORK SETTINGS.............................20
OBTAINING PROTECTED IMAGES..........................20
FLICKR SETTINGS.....................................21
GOOGLE PIUS SETTINGS................................23
V FLICKR RESULTS.........................................27
SUMMARY OF IMAGES PERMITTING DOWNLOADS..............30
SUMMARY OF IMAGES PROTECTED FROM PUBLIC DOWNLOADS..30


VI. GOOGLE PLUS RESULTS
34
N IL CONCLUSION AND FUTURE RESEARCH..........................44
REFERENCES...................................................47
APPENDIX
Flickr: EXIF Data Analysis..............................50
TABLE A-1..........................................50
TABLE A-2..........................................53
TABLE A-3..........................................56
TABLE A-4..........................................57
Google Plus: EXFF Data Analysis.........................59
TABLE B-l..........................................59
TABLE B-2..........................................60
TABLE B-3
60


8
CHAPTER I INTRODUCTION
Engaging in social media websites is a common activity today for adults and kids around the globe. Usage is highly diverse ranging from favorite platforms such as Facebook, Twitter, Instagram and YouTube, and funnel ing down to sources that foster gaming, dating, network exchange, virtual worlds or tight-niche blogs. Hundreds of interactive networks are designed to offer communication and entertainment, while in their unique way, being a catchall location for anything that can be shared digitally. Undoubtedly, social Media has become a lively vessel that connects our personal and business lives to networking opportunities, meaningful engagement and pastimes for those willing to enter its uncharted territory. Nevertheless, forces as global as the social media galaxy inevitably begin to form two sides: the light side of the force and the dark side. While the good side entices many enthusiasts, it synchronously builds a world-wide pond for undesirables to fish and create problems. Online threats, stalking, cyberbullying, hacking and fraud, buying illegal things, and posting crimes are reasons why Digital Media experts, Intelligence Analysts and investigators rapidly face a barrage of crime from a new frontier [24],
Digital images and videosplay a large role in the bottleneck of investigations. The ability to share images and live feed instantaneously through electronic devices by the masses, stirs up the perfect storm for investigators in search of evidence. When it comes to social media and the inability to prove every step taken to create electronically stored information -the question of authenticity rises. Authentication is key to getting social media evidence admitted in the courtroom [1],


When the integrity and preservation of digital images is not maintained, copyright matters also arise. For example, photographers who share their work on Flickr. Metadata is
9
important in protecting copyright images online. One of many reasons why it is so important to understand the origins of digital media found on social media.
The data that lies behind digital images can provide a wealth of information in the analysis of an image and so can signs of compression. There are different types of information to pay attention to when analyzing an image. One is Metadata; a set of data that describes and gives information about another data [2], Metadata in an image file, especially EXIF (Exchangeable Image File Format) [13] and XMP (Extensible Metadata Platform), can provide a lot of information about the user, like when a user creates a document, or changes it, or accesses it.
Metadata can be altered as images undergo processing and sharing. This includes uploading and downloading images to social sites. Modifications can provide clues in an investigation involving a potential suspect and their social network account, but can also limit what can be detected and complicate the pursuit. This research centers around alterations made images with Google Plus and Flickr and provides various methods and experimental results to distinguish changes or patterns relative to each social site, as well as electronic devices and internet browsers used. The paper is organized as follows: Related Works, Overview, Proposed Methodology, Results and Conclusion.
Related Works
Recent works have studied images on social networks. In Megan Pippins research, Digital Image Recompression Analysis: Facebook (2016), it was discovered that when an image is pulled from Facebook, the type of device doing the uploading and downloading of the image impacts the patterns in metadata structure, quantization tables and IPEG quality. For


10
example, a mobile phone that downloads an image repeatedly revealed the following predictable behavior: baseline Discrete Cosine Transform (DCT) encoding, a specific set of quantization tables, and a metadata structure of 65 elements; images uploaded from mobile phone and downloaded to desktop showed progressive encoding and a metadata structure of 67 elements; images uploaded and downloaded to desktop computer were progressive encoded, variable quantization tables with average of 87 JPEG quality and metadata structure of 81 elements [3], Regarding the outcome of mobile phone pictures and desktop pictures, it is also noted that each have specific width dimension cutoffs. Mobile phone being 1440 pixels and desktop 2048 pixels. Lastly, Facebook has a specific renaming process on images. An image that is given a filename on its way into the social site, is renames as it exits. After download, the image is named after a long string of numbers ending in either _n or _o. The _n is placed on images smaller than 1024 pixels, the _o on files larger than 1024 [3], These are all good examples of how a social internet site effects images and also the sort of observations to take note of during this particular research.
Also, worth mentioning is Castiglione et al. (2011) analysis that tested the impact on images on three different social sites: Facebook, Badoo and Google Plus. The analysis confirms that JPEG quantization tables, pixel resolution and metadata are indeed altered in predictable ways and demonstrates that images are stripped of original metadata in the process of compression. Furthermore, it was discovered that Google Plus manages metadata differently in that it only resizes an image if the resolution is larger than 2048, and on that occasion, its metadata is removed [4], The research herein helps to expand on this previous research, and in addition, provides a variety of experimentations that yield results to inform best practices for forensic investigations on Google Plus and Flickr images.


11
CHAPTER H
TECHNICAL OVERVIEW
JPEG Compression
It is necessary to understand the process of JPEG compression and its Discrete Cosine Transform (DCT) as it relates to this research. Many people mistake JPEG as a file type, but more specifically it is a type of lossy compression method. Lossy means that information in an image is taken away in order to decrease data size and save space. Lossy is irreversible, once performed, information is lost forever. What we do in JPEG is we split each image into 8x8-pixel groups, and each of those pixel groups is separately encoded with its own DCT algorithm. DCT expresses a finite sequence of data points in terms of a sum of cosine functions at different frequencies [5], Each of the 8 x 8-pixel groups within the DTC can be exactly replicated by 64 (8x8 cosine waves.)Figure 1 shows the base cosine waves that produce any image one might like to perform in 8 x 8 pixels.
ii iiiiiiiin
*v-.Vimmm
cott-viWKom
=SSBHKflM
Figure 1. DCT base cosine waves in 8 x8 pixel groups (x64)


12
High and low frequencies is about the spatial distribution of intensity. High frequencies offer more detail to an image, while low frequencies offer less. Putting this into perspective, a beach of sand would be the low frequency, and each individual piece of sand that makes up the beach, are high frequencies. If the beach was missing, it would be very obvious to the human eye, while a dot of sand is much more difficult to spot. Consequently, the human eye is less sensitive to high frequencies in the pixel group, while low frequencies are more noticeable [17], The numbers represented in Figure 2 [6], are the standard luminance quantization table for a JPEG. Basically, each 8x8 block of DCT encoded data is quantized based on the values in this table. When an image is compressed, higher frequencies are forfeited so the change goes unnoticed all the while, saving space. This is the outer layer description of how lossy JPEG compression works.
Q =
16 11 10 16 24 40 51 61
12 12 14 19 26 58 60 55
14 13 16 24 40 57 69 56
14 17 22 29 51 87 80 62
18 22 37 56 68 109 103 77
24 35 55 64 81 104 113 92
49 64 78 87 103 121 120 101
72 92 95 98 112 100 103 99
Figure 2. Standard Qauntization Table for JPEG Image Information Behind Digital Images; Terms, Concepts and Definitions
digital media authentication. The term digital authentication as it pertains to this research, is about putting measures into place to determine if digital images are what they purport to be and whether or not they have been altered. Forensic image analysis helps assist in the determination of authenticity and includes the examination, evaluation and comparison of


13
image data. As defined in C. Grigoras et al. (2013) digital image enhancement and authentication research:
In forensic imagery, the primary image consists of the data first recorded onto digital media from which the digital signal or file can be transferred in the native format or exported to another one. The digitally recorded information is stored as a finite set of binary values and exact duplicates or clones can be further made. (p. 305)
Color Filter Array (CFA) and Compression Level Analysis (CLA) are digital image authentication techniques to show demonstrative comparisons between what may or may not be authentic images. Color Filter Array is a mosaic of tiny color filters (e.g., red, green, blue) placed over the camera sensor to filter and capture color information [26], CFA introduces specific correlations and algorithms between subsets of pixels and is considered a digital signature of a camera model [26], When an image is copied, resaved or downloaded, the original CFA is altered. CFA analysis is an effective and precise way to trace compression and modifications to images.
hash values. In this research the term hash will be used and refers to the use of hash values. Hash values are displayed in a set of letters and numbers to verily that an image is identical to the source media. It is equivalent to a digital fingerprint.
A hash algorithm is a function that converts a data string into a numeric string output of fixed length. The output string is generally much smaller than the original data. Hash algorithms are designed to be collision-resistant, meaning that there is a very low probability that the same string would be created for different


14
data. Two of the most common hash algorithms are the MD5 (Message-Digest algorithm 5) and the SHA-1 [14],
JPEGmini. The term JPEGmini is referred to during discussions about Flickr. JPEGmini are optimized JPEG files that work to reduce the size of an image: JPEGmini is a photo optimization technology that reduces the file size of JPEG photos by up to 5X, while preserving the resolution and quality of the original photos [15],
WebP. WebP is tested during the evaluation of Google Plus. It is an image format output by this social platform and is a format exclusively developed by Google. Specifically, WebP is a modern image format that provides superior lossless and lossy compression for images on the web. Using WebP, webmasters and web developers can create smaller, richer images that make the web faster [14],
hexadecimal, binary file and hex editors. Computers work with long strings of binary data represented by a series of zeros and ones, a system that is too strenuous for humans to assimilate. Less complicated, and more compact, the Hexadecimal system was designed to assist in the understanding and the representation of value in a more human friendly way. Hexadecimal is a numeral system that uses 16 symbols, 0-9 and A K [18], Hex editors are tools used to view file data as a hexadecimal, and are useful for inspecting a binary file for raw content. It can also be used to spot suspicious edits to files or to recover corrupted or deleted files during digital investigations [21], The structure of a file normally consists of a filename, a file header and footer, and file content. A header is the first few bytes that mark the beginning of the file, while footers contain the ending point of a file. These locations contain signatures or information used to identify the content of the file [23], This information is translated by means of ASCII


15
interpretation of hex values, which stands for American Standard Code for Information Interchange [22],
Flickr
Many readers are already aware of the assortment of social networks made available to users. Back in the day, Flickr used to be the go-to spot to share and organize photos online before other popular sites took over. Still, Flickr remains a viable source to turn to for passionate photo lovers and photographers, with an average of 6.8 million digital photographs uploaded a day [7], Flickrs aesthetic blog speaks volumes about the community it attracts. Undeniably, the science and technique that goes into creating high-quality photographs is important to this robust crowd. Flickr recognizes this and has a long-standing commitment to keeping uploaded images-byte-for-byte intact [8], however, the vast number of large images uploaded to Flickr presents costly storage challenges. In order to achieve more space and save cost, Flickr rolled out what they call dynamic generation of thumbnail sizes and perceptual compression to images that were uploaded to the site after 2014 [8], The repercussion of these tactics is shown effectively in a test conducted by PetaPixel, where you can see that thumbnail sizes were reduced up to 60% [9],


16
2012-largeweb.ipg Inf 2015-largeweb.jpg Info
- 2012-largeweb.jpg Modified: Today. 7:49 AM 2015-largeweb.jpg 470 KB jwo Modified: Today. 7:49 AM

General: Kind: JPEG image Size: 1.205.644 bytos (1.2 MB on disk) Where: Macintosh HO Users michaeizhang Created: Today. 7:49 AM Modified: Today. 7:49 AM 0 Stationery pad G Locked General: Kind: JPEG imago Size: 470.099 bytos (471 KB on disk) Where: Macintosh HO Usors michaeizhang Desktop Created: Today. 7:49 AM Modified: Today. 7:49 AM Stationery pad C Locked
Figure 3. Flickr image comparison test conducted by PetaPixel: Left version(2012) has 60% better resolution than the image on the right (2015) [9],


17
Flickr offers a variety of size option links from which to download images, including the option to download the actual original, which is the catalyst to storage shortage. Here, Flickr uses Lepton, a streaming image compression format that reduces JPEG images by 22% [10], Suitably, it also provides lossless bit-exact storage. Lossless compression is a class of data compression algorithms that allows the original data to be perfectly reconstructed from the compressed data [11], In that way, the process works much like zipping and extracting a large file.
While Flickr has continued to stay true to their vision under the ownership of Yahoo, it will be interesting to see what happens after the recent acquisition by Verizon in June 2017. Under Verizons directive, new innovations and features could be on the way.
Google Plus
Google Plus is a social network owned by Google that was introduced in 2011. It initially adopted features from other popular social networks, mixing in its own unique functionality like Circles and Hangouts and acts as a social layer across many of Googles properties. Their concern tends to focus in on the optimization of user accounts, and not so much on the social interaction between others. So, while Google Plus is not the most prevalent of social networks out there, building a presence within Americas most popular search engine may be important to some. Much of how the users engage on Google Plus is the same as Twitter and Facebook, however Google Plus is far more customizable and allows a greater level of focused privacy. Not much was found in regards to what types of users engage most on this network, but just perusing through, it seems to be another popular spot for photographers to congregate and share their
images.


18
CHAPTER HI PREPARATION
Flickr and Google Plus accounts were both created to examine changes of images, if any, after being uploaded and downloaded to and from each platform. A Yahoo account was created for Flickr and Gmail for Google Plus. A total of five JPEG test images that were captured by a LG-D850 mobile phone, and then transferred and stored into a Samsung-SM-J320, were used as reference standards to pinpoint what characteristics of an image may have changed. The test evaluated JPEG quantization tables, the resizing of images, and metadata. Exiftool, HxD ExactFile and JPEG Snoop are freeware forensic tools that capture these characteristics of an image and were utilized in this study. Exiftool reads metadata in an images data and indicates information such as image size, GPS and the name of a file [19], HxD is a hex editor used to recover data and also provides an images hex analysis as well as the ASCII interpretation of hex values. ExactFile is used to display the hash value of image files and was used to verily the integrity of images after they were uploaded and downloaded to and from the social sites. JPEG Snoop decodes an image to include the image size and some of the EXIF data [20], Quantization Tables were acquired from JPEG Snoop to evaluate image compression for the purposes of this research.
Images were uploaded and downloaded to both social sites using a Windows 10 Laptop and the Samsung-SM-J320 mobile phone (where the LG D850 mobile phone images were stored.) Electronic devices and the impact they have on transferring images to and from the social platforms were compared. In addition to comparing those differences, varying internet browsers were also explored. The internet browsers tested were Internet Explorer, Chrome, and
Mozilla Fi refox.


19
Lastly, it was tested if multiple people extract the same results when downloading images from these social platforms. To test this, a copy of the links to both social site accounts were emailed to Dr. Grigoras and Professor Smith, who were then able to click on the link and visit the accounts directly to download images. The internet browsers they used wereMozilla Firefox with the DownloadThemAlF plug-in and Google Chrome Version 62.0.3202.94 (Official Build) (64-bit.) After completing their downloads, their version of the image was emailed back to me for evaluation.
CHAPTER IV METHOD
In order to understand the cause and effect that Google Plus and Flickr have on images, it is important to look at the metadata of an original image against the same image after it has been uploaded and downloaded to these platforms. Therefore, the analysis started by collecting information and data of both original images and downloaded images. A comparison was then done by equating the metadata including observing distinct characters located in the hex, noting how platforms name images and resize them, and crosschecking hash values. Platform settings create limitations in the ability to see and download protected images from social sites, therefore, a trial and error of download methods were tested and measured and are discussed in more detail below. An overall evaluation is discussed during the conclusion of this thesis paper.
Uploading and downloading images
In the process of uploading and downloading images from Google Plus and/or Flickr from an electrical device, data may be altered. For the purpose of this research, images were transferred and evaluated four different ways: 1. Upload and download via mobile phone 2.


20
Upload and download via desktop 3. Upload from mobile phone and download to desktop 4. Upload from desktop and download to mobile phone.
Social Network Settings
The ease of customizing privacy settings and tiered controls varies by service. It can also increase the difficulty of downloading an image for the purpose of obtaining meaningful data. However as long as the image is viewable, there are still ways to download them, although a lot of data (if not all) will be stripped. On occasion, some details may remain that could be pertinent to a case. Actual examples of this occurred during the study, when the original size of the image was not changed and the IMEI number and brand of the mobile used to transfer images was exposed. This study experiments with the different ways to grab images from Flickr and Google Plus, evaluates the changes, and attempts downloading images using different internet browsers that may potentially be more successful at acquiring data than others.
Obtaining Protected Images
There are only two sure-fire ways to protect your images on Flickr and Google Plus, 1. Make them private 2. Do not upload them. The bottom line is: if a photo can be seen in a web browser, it can be downloaded, copied or saved.
To get around a restricted image on Flickr, Google Plus and any image on the web, one can simply right click (in some browsers) and select inspect image. This opens a box, and in that box, is an icon on the top left that looks like a square with a pointer in it. When you click on it and hover the mouse over the image (the image will turn blue), the HTML code responsible for displaying that page appears as highlighted -delete that string of commands. That brings down the protection. Right click the image. The image is now able to be saved to computer as a JPEG.


21
This cannot be done on a mobile phone, and when performed on a desktop or laptop, strips most of an images metadata.

Melissa DH Lawson > Public
Test: Upload from desktop; download to cell phone
+1 P
Shared publicly
Elements Console Sources Network Performance hlOOen;
div class XkWAb-pVNTue XkWAb-RCfa3e" style- top: 64px; opacity: 0; right: 14px; width: 150px; height: ISSpx; ...

div style-"direction: ltr; 0px, 0px);">_

transform: translate3d(S0px,
... -wiz div div content div div div div div div | Styles Event Listeners DOM Breakpoints Properties
Rlter ihov .els + *i
' I P?
element.style { f
width: 602px; ;
height: 710px;
.XkWAb-CHX6zb {
opacity: 0; position: absolute; i-index: 1002;

background-color:
-webkit-tap-highlight-color: Qrgba(0,0,0,0);
rk-b-AUZH8XAcv36A:1
background-col..
display filter
rgb<0, rgb(25 block
Figure 4. Screen capture: disarming image on Google Plus to save as JPEG Flickr Settings
By default, all images on Flickr are public. When an image is public, anyone may view and download it. A user may choose to restrict access to their photos by making their accounts private, or alternatively, a user may apply certain restrictions that inhibit a persons ability to download. If this is the case, the option to download will say owner has disabled downloading of their photos. Photos can also be downloaded in various sizes beginning at 75 x 75 all the way up to the original size.
In an attempt to achieve what technique is the best practice to download protected images on Flickr, yielding the best results, the following was tested:
1. Downloading an image while signed into the account.
2. Downloading an image while logged out of the account; public download permitted.
3. Downloading an image while logged out of the account; public download disabled.
4. Dr. Grigoras downloading images from Flickrs optional size links 500 x 292 or larger.


22
Because Flickr asserts that original images are kept intact bit-per-bit, it was predicted that images allowed to be downloaded from this platform would not be altered while on the contrary, performing special methods to download protected images, would. Table 1 below compiles the tests conducted and provides a basic summary:
Table 1. Flickr: Proposed Method Summary
Method
Download
Capability
Quantization
ExifData
Summary Notes
U/D via mobile phone logged in
W

Results = original
W
W
U/D via mobile phone; logged out; public download enabled
Results = original
U/D via mobile phone; logged out; public download disabled
U/D via desktop while logged in


Results = original
U/D via desktop; logged out; download enabled
U/D via desktop; logged out; download disabled
Upload from mobile phone; download to desktop; logged in
Uploadfrom mobile phone; download to desktop; logged out; public download enabled
Upload from mobile phone; download to desktop; logged out; public download disabled
Uploadfrom desktop; download to mobile phone; logged in___________________
Upload from desktop; download to mobile phone; logged out; download enabled
Upload from desktop; download to mobile phone; logged out; public download disabled
Download by another user from their personal computer and browser; different sizes public download enabled



Results = original
Quantization
tables
altered
altered
Results = downloading possible via inspecting image
Results = original

Results = original
Quantization
tables
altered
altered
Results = downloading possible via inspecting image

Results = original
Results = original

Results = original


23
Download images 500 x 292 or larger; downloaded by two different users l Quantization tables altered altered Results = different than original, however both users rendered same results

Download by another user from their personal computer and browser; original version public download enabled Results = original
Google Plus Settings
Google Plus sharing features can also be controlled. Account holders can share their posts with everyone or with only those in designated circles. Circles are like categories for a persons connections. While some posts can be selected to share to the public, other posts may be left private for only a selected group to see. This sets limitations as to what is possible in the downloading of images. In order to conduct this research, settings had to be adjusted to allow for public viewing.
There are two ways to download images from Google Plus. One, is by right clicking the image and selecting save as. This saves an image as a WebP format. The second way to download images on Google Plus works similarly to inspecting the image, however you right click outside of the image and select view source page instead. In the page that opens you can search for the keyword JPG. Locate the URL that contains the image and copy / paste the URL into a browser URL bar. That will bring up the image. Right click on the image, and save
as a JPG.


24
,[null/'", "",1507774968738, "zl2yjtaxlu3vyvglc22uwfmponmxwnf22#1507774968738165",null,"107200714377388860125","zl2yjtaxlu3vyvglc22uwfmponmxwnf22", 1 nul1,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,false]
,nu11,null,null,null,null,null,null,false,null,["Tony Funderburk","107200714377388860125",false,false,"https://lh6.googleusercontent.com/-rqLXKI4; ;G6N9Wbk/photo.jpg","./+TonyFunderburk","male", null,null,true]
,["en",false]
,[[[0,"And no, I didn't know you live in that area. How about that?! There's not much of that area that looks like it did when I was first there ; Interesting things."]
.in
null,null,null,1,null,[null, null, ^ \]
,"zl2yjtaxlu3vyvglc22uwfmponmxwnf22",\ V updates:esshare",null,null,"",null,null,"110489355980503749652",null,"https://lh5.googleusercontent.con 18/photo.jpg",null,"Test: Upload from l\ Vp; Download to Desktop -by public
jser","+MelissaDHLawson/posts/7kuUayuvo\ \0.0,"./+MelissaDHLawson",null,null,null,"",false,0,false,true,null,false,true,null,false,15075993989! ill,null,false,false,null,null,false,nulA \,null,null,false,null,null,null,null,null,null,null,null,null,null,null,
| null,null,null,null,null,null,null,null, n\ \ull,null,null,null,null,null,null,null, null, false]
,null,null,true,null,true,null,null,0,null,\ V"social.google.com",false,false,null,null,true,false,null,"",7,false,null,0,[[344,339,437,338,33(
,"https://plus.google.com/photos/11048935598\ M9652/albums/6475090111837474865/6475090111877912434?
suthkey\u003dCNOs67i4xIHDMw", null, null, null,-<^/ull, "https: //plus. google. com/photos/110489355980503749652/albums/6475090111837474865/6475090111t
"httDS : //dIus eooele. com/ohotos/110489355980503749652/a 1 bums/6475090111837474865/6475090111877912434" "fWPfSWKSTfl 3.googleusercontent.com/-
F4sqmlRGKk8/Wdwk3ncgl3I/AAAAAAAAZPk/ygD0ap05ViEyVkzRDib6w_YRVw_yISIQgC3oC/w2340-h2340/20160315_105057_HDR%257E2.jp "20160315_105057_HDR~2. jpg"
jser",null,["//lh3.googleusercontent.com/-F4sqmlRGKk8/WdwkDncgl3I/AAAAAAAAZPk/ygD0ap05ViEyVkzRDib6w_YRVw_yISIQgC3oC/w506-h750/20160315_105057_HDR9 ;1,"https://lh3.googleusercontent.com/-F4sqmlRGKk8/Wdwk3ncgl3I/AAAAAAAAZPk/ygD0ap05ViEyVkzRDib6w_YRVw_yISIQgC3oC/v^800-h800/20160315_105057_HDR%25:
.null,null,null,null,null, "plus.google.com",null,null,null,null,null,null,null,null,2340,2340,null,null,null,null,"110489355980503749652",null,nu! 35","6475090111877912434",null,1,null,null,null,null,"photos/110489355980503749652/albums/6475090111837474865/6475090111877912434",null,null,null, lull,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,r ill,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,ni LI,null, null,null,null, null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,nu! ;[339,338,336,335,0]
,"https://lh3.googleusercontent.com/-F4sqmlRGKk8/Wdwk3ncgl3I/AAAAAAAAZPk/ygD0ap05ViEyVkzRDib6w_YRVw_yISIQgC3oC/w2340-h2340/20160315_105057_HDR%25> :4sqmlRGKk8/Wdwk3ncgl3I/AAAAAAAAZPk/ygD0ap05ViEyVkzRDib6w_YRVw_yISIQgCDoC/w2340-h2340/20160315_105057_HDR%257E2.jpg","https://lh3.googleuserconter :4sqmlRGKk8/Wdwk3ncgl3I/AAAAAAAAZPk/ygD0ap05ViEyVkzRDib6w_YRVw_yISIQgC3oC/w2340-h2340/20160315_105057_HDR%257E2.jpg" ]
H
.null,null,null,null,null,null,null,null,null,"0.6942094","2340","2340"]
Figure 5. Screen capture of view source page
The type of internet browser used during the seizing of images on Google Plus also became of interest in the observation that methods of downloading images using various internet browsers were producing diverse results in the EXIF data. To explore this area further, and to explore the effects that electronic devices may also have, the following was tested on images:
1. Upload and download via desktop; Internet Explorer logged in.
2. Upload and download via desktop; Microsoft Edge; logged out.
3. Upload and download via desktop; Microsoft Edge; logged in.
4. Upload from desktop; download to desktop; Mozilla FireFox; logged out.
5. Upload from desktop; download to desktop; Moxilla FireFox with DownloadThemAll plugin.
6. Upload and download via mobile phone.


25
7. Upload from desktop and download to mobile phone.
8. Upload from mobile phone; download to desktop; Microsoft Edge; logged out.
9. Upload from mobile phone; download to desktop; Internet Explorer; logged out.
10. Upload from mobile phone; download to desktop; Microsoft Edge; logged in.
11. Upload from mobile phone; download to desktop; Internet Explorer; logged in.
12. Upload from desktop; download to desktop Dr. Grigoras using Mozilla Firefox.
13. Upload from desktop; download to desktop; Chrome / WebP to JPG.
The table below is a compilation of the techniques applied to download images and a brief summary of those results:
Table 2. Google Plus Method Summary
Method
Download
Capability
Quantization
ExifData
Summary Notes
Upload and Download via desktop; Internet Explorer logged in
Upload and download via desktop; Microsoft Edge logged out
Upload and download via desktop; Microsoft Edge logged in
U

Upload from desktop; Download to desktop; Mozilla FireFox; logged out
Upload from desktop; Download to desktop; Moxilla FireFox with DownloadThemAll plugin

Upload and Download via mobile phone

Results = quantization tables and metadata altered
Results = quantization tables and metadata
altered_________________
Results = quantization tables and metadata altered
Results = quantization tables and metadata
altered_________________
Results = metadata altered, however image quality and size remained the same and the brand of the device that uploaded image was revealed Results = quantization tables and metadata altered


26
Upload from desktop and download to mobile phone
Upload from mobile phone; download to desktop; Microsoft Edge; logged out
W
W


Results = quantization tables and metadata altered
Results = quantization tables and metadata altered
Upload from mobile phone; download to desktop; Internet Explorer; logged out
W
W
w
Results = quantization tables and metadata altered
Upload from mobile phone; download to desktop; Microsoft Edge; logged in
Upload from mobile phone; download to desktop; Internet Explorer logged in
Upload from Desktop; Download to Desktop -by PROFESSOR using Mozilla Firefox
Upload from desktop; Download to Desktop; Chrome WebP to JPG
W
W
Results = quantization tables and metadata altered
Results = quantization tables and metadata altered
Results = metadata altered, however image equality and size remained the same and the brand of the device that uploaded image was revealed
Results = metadata altered, however image equality and size remained the same and the brand of the device that uploaded image was revealed


27
CHAPTER V FLICKR RESULTS
As predicted, Flickr preserved images as long as two things happened: 1. The account holder allowed downloads of their original images and/or 2. You are the account holder and logged in. This was the case for both accomplishing the task on a mobile phone or desktop by anyone.
Table 3 demonstrates (in partial) an example of preserved metadata in the EXIFtool results after downloading an image with permissions. More importantly, hash values are useful in verifying the integrity of a digital file, and Figure 6 shows how even hash values match after being downloaded from this platform under these settings. The only notable change in the metadata is renaming of the images. It appears that an image downloaded to a mobile phone is renamed to the date it is being saved, followed by another segment of numbers + .jpg. Images downloaded to desktop are saved as a string of numbers, followed by _o.jpg. While modifying any content within an image will change the hash value, renaming a file does not.
Table 3. Partial EXIF Data for Two Different Images; One Downloaded to Mobile Phone, One Downloaded to Desktop. Names Were Changed.
UPLD / DNLD Mobile Phone UPLD / DNLD Desktop
ExifToolVersion = 9.90 ExifToolVersion = 9.90
FileName = 36070463433_2075a560c7_o.jpg FileName =
36880336625_cea97a3838_o.jpg
Directory = .
FileSize = 1238212
Directory = .
FileSize = 1671607
FileModifyDate = 1503958279.45154 FileAccessDate = 1503958283.05747 FileCreateDate = 1503958283.05747 FilePermissions =33206 FileType = JPEG MIMEType = image/jpeg JPEG APP1 (18133 bytes): ExifByteOrder = MM + [IFD0 directory with 9 entries]
| 0) GPSInfo (SubDirectory) >
| + [GPS directory with 8 entries]
FileModifyDate = 1503964097.71911 FileAccessDate = 1503964101.56196 FileCreateDate = 1503964101.56196 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP1 (1330 bytes):
ExifByteOrder = MM + [IFD0 directory with 10 entries]
| 0) ModifyDate = 2015:05:07 10:30:54


28
| | 0) GPSLatitudeRef = N | | 1) GPSLatitude =39 44 8.2269(39/1 44/1 82269/10000)
| | 2) GPSLongitudeRef = W | | 3) GPSLongitude = 104 59 20.0646 (104/1 59/1 200646/10000)
| | 4) GPSAltitudeRef = 0 | | 5) GPSAltitude = 1623 (1623000/1000) | | 6) GPSTimeStamp = 17 56 13 (17/1 56/1 13/1)
| 1) GPSInfo (SubDirectory) >
| + [GPS directory with 8 entries]
| | 0) GPSDateStamp = 2015:05:07 | | Warning = Tag ID 0x0005 out of sequence in GPS | | 1) GPSAltitudeRef = 0 | | Warning = Tag ID 0x0003 out of sequence in GPS | | 2) GPSLongitudeRef = W
ExactFiie Report Image Download from Flickr
jfc}) Copy Copy All
checksums generated by ExactFiie 1.0.0.15
http://www.exactfile.com
10/24/2017 12:02:19 AN
c:\users\Melissa\Desktop\Thesis Paper\ORlGl?*AL photo analysis\20150116_182 4537855 bytes
MD5: 8bba53e2asaS9ee0cll2b66l46faef9f
5KA256: 34ecb4999d4ie249eb027e5d5bdb05207b4aec8b5299l26e6d56f4ead8e7da9

ExactFiie Report [5 copy [V) cpyAI1 Original Image
checksums generated by ExactFiie 1.0.0.15
http://www.exactfile.con
10/23/2017 11:47:23 PM
C:\users\Melissa\oesktop\Thesis Paper\Flickr\Flickr Photo AnalysisXlipload 4537855 bytes
FDS: 8bba53e2aSa59ee0dl2b66146faef9f
SHA256: 34ecb4999d410249eb027e5d5bdb05207b4aec8b5299126e6d56f4e0ad8e7da9
Figure 6. Flickr version (top) and original image (bottom) hash values match
When optimal scenarios for preserving images is not the case, and hash values did not agree, further analysis was necessary. Downloading protected images was not possible, and the


29
following circumstances and platform settings created dissimilarities:
Flickr PROTECTED IMAGES

upload from mobile phone, download to desktop download optional sizes from Flickr's size links Uploading and Downloading from desktop

Figure 7. Using These Methods to Download Images from Flickr Strips Data
In proposed methods it is explained that to save restricted images to a desktop, certain steps are necessary to get past the protection. After these steps, the image is able to be saved as a jpeg. However, the process stripped the metadata from the original and the quality of the image was decreased. Tables A-l through A-4 in Appendix A show the results. Tables A-l and A-2 demonstrate the difference in metadata and quality factor of an image before (left column) and after (right column) it has been uploaded and downloaded to and from Flickr. Tables A-3 and A-4 (name and file size changes are highlighted in the tables) illustrate that downloading an image from Flickrs optional size links vs obtaining protected images via the view source page (and deleting the HTML) is indistinguishable, implying neither method is better than the other and infers the attempt of preserving any sort of authentic metadata from protected images on Flickr, is not possible.


30
So what observations should one consider when analyzing images from Flickr? Underneath is a simplified summary of the results and what observations stood out -some of which relate and are similar to the discoveries exposed in Pippin, M. (2016) research as it pertains to image resizing, image renaming and desktop vs mobile phone downloads (p. 28-31.) Following the summary, a diagram (Figure 8) has been provided that further summarizes Flickr image storage and processing in more detail.
Summary of Images Permitting Downloads
1. Are renamed to a string of numbers followed by _o.jpg when downloaded to desktop
2. Images downloaded to mobile phone are renamed to the date in the which the image was saved, followed by more segmented groups of numbers + .jpg
3. All original metadata is intact whether downloaded to mobile phone or desktop Summary of Images Protected From Public Downloads
4. It is not possible to download images to mobile phone if they are protected.
5. When an image is uploaded from mobile phone, the image results in 1024 pixels in width and retains the original image aspect ratio.
6. When an image is uploaded from desktop, the image results in 2048 pixels in width and retains the original image aspect ratio.
7. If an image was 1024-pixel width, EXIF data revealed: optimized by JPEGmini 3.13.3.15 0xad6b4f35
8. If an image was 2048-pixel width, EXIF data revealed: Optimized by JPEGmini
3.13.3.15 0x3cf38bdf


31
9. The size of the image also appears to influence the name change: images in 2048-pixel width were renamed as a string of numbers ending in _k.jpg, 1024-pixel width were renamed as a string of numbers ending in _b.jpg.
10. The renaming of images (string of numbers and all) match whether or not the image was downloaded viaFlickrs size option link OR if the image was saved via inspecting the original image to get past the protection. For example, image
20140930 115613 Bnrst04.jpg was renamed to 36070463433_f58a95a391_k.jpg when saving an image via Flickrs 1152 x 2048 size link or by way of inspecting the image (which by default saved the image to size 1152 x 2048.)
SUMMARY
Images with download permissions OR account holder logged in; both mobile phone and desktop
RESULTS
DESKTOP
MOBILE PHONE
DESKTOP AND MOBILE PHONE
Name Change* 36070463433_2075a560c7_o.jpg
Name Change* 2017-08-28_05-19-45.jpg
No alterations in Metadata, Quantization
T ables (hash value = match)_________


32
SUMMARY
Upload / download via desktop, download not permitted___________________________________
RESULTS
Cannot save unless protection (HTML) is deleted
Download default size: 1152 x 2048
Optimized by JPEGmini 3.13.3.15 0x3cf38bdf
Name Change* 36070463433_f58a95a391_k.jpg
Altered* Metadata, Quantization T ables (hash values = no match)
Original 4160x2340/Download 1152x
2048= 1.77 Aspect Ratio____________
SUMMARY Upload from mobile phone, download to desktop,
download not permitted_________________
RESULTS
Cannot save unless protection (HTML) is deleted
Download default size: 775 x 1024
Optimized by JPEGmini 3.13.3.15 0xad6b4f35
Name Change* 36880336625_llff6133fe_b.jpg
Altered* Metadata, Quantization Tables (hash values = no match)
Original 1719 x 2270 / Download 775 x
1024 = 1,32 Aspect Ratio_____________


33
SUMMARY
Download 20140930 115613_Burst04.jpgv ia Flickr size link 1152 x 2048 VS. delete HTML to save protected image onto desktop__________________
RESULTS
DOWNLOAD IMAGE VIA FLICKR DOWNLOAD SIZE LINK
VS
SAVE PROTECTED IMAGE TO DESKTOP VIA INSPECT IMAGE
Optimized by JP EGmini 3.13.3.15
0x3cf38bdf
Name Change*
36070463433_f58a95a391_k.jpg
VS
Saved to default size: 1152 x 2048
Optimized by JPEGmini 3.13.3.15
0x3cf38bdf
Name Change*
36070463433_f58a95a391_k.jpg (name change corresponds with image

SUMMARY Download 2015050 7_093353_HDR~2~2.jpg via Flickr size link 775 x 1024 VS. delete HTML to save protected image onto
RESULTS
DOWNLOAD IMAGE VIA FLICKR DOWNLOAD SIZE LINK
VS
SAVE PROTECTED IMAGE TO DESKTOP VIA INSPECT IMAGE
Optimized by JP EGmini 3.13.3.15 0xad6b4f35
Name Change*
36880336625_llff6133fe_b.jpg
VS
Saved to default size 775 x 1024
Optimized by JP EGmini 3.13.3.15
0xad6b4f35
Name Change*
36880336625_1 lfiffi 133fe_b.jpg (name change corresponds with image downloaded from Flickr 'size' link)
Figure 8. Summary of Flickr Analysis Results


34
CHAPTER VI GOOGLE PLUS RESULTS
Unlike Flickr, the option to download original images and/or images in optional sizes is not available on Google Plus. As it is, how a user obtains images from Google Plus widely depends on what internet browser is being used, which incidentally yields varying results in the quality and metadata of images. Like Flickr, some approaches for downloading images off Google Plus strip metadata and reduce the pixel size and therefore the quality and authenticity of the image is lost. These approaches all seemed to have a commonality of obtaining an image by right clicking it and selecting save as on Internet Explorer, Microsoft Edge and Chrome (see Appendix B, Table B-l and Table B-2 for their EXIF data results.) It is important to note that saving an image from Google Plus on Chrome in this way, will save an image as a WebP format. This only occurs on Chrome as the format has yet to be supported by a solid majority of programs and browsers [25], WebP comes in lossy and lossless formats and offers a dramatic drop in file size with very little reduction in image quality [16], Perhaps the best file type for procuring images with the highest quality, is WebP. The file format can be viewed in both Exiftool (Table 4) and Hex reader tools (Figure 9). It looks like this:
Table 4. Example EXIF Data for WebP File Format of Test Image
ExifToolVersion = 9.90
FileName = 20160315 105 05 7_HDR-2.webp
Directory = .
FileSize = 78946
FileModifyDate = 1509245302.85195
FileAccessDate = 1509245227.10217
FileCreateDate = 1509245301.97813
FilePermissions = 33206
FileType = WEBP
MIMEType = image/webp
RIFF 'VP8X' chunk (10 bytes of data):____


35
VP8X (SubDirectory) >
+ [BinaryData directory
| Image Width = 2516583062
| ImageHeight = 169472
RIFF 'VP 8 chunk (78866 bytes of data):
VP8Bitstream (SubDirectory) >
+ [BinaryData directory | VP 8 Version = 0 | ImageWidth = 663 | HorizontalScale = 0 | ImageHeight = 663 | VerticalScale = 0
RIFF 'EXIF' chunk (34 bytes of data): EXIF (SubDirectory) >
+ [TIFF directory]
| ExifByteOrder = II | + [IFDO directory with 1 entries]
| | 0) Software = Google_______________
rf] File Edit Search View Analysis Extras Window ?
SJ] 20160315_105057_HDR-2.webp
Offset(h) 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF
00000000 52 49 46 46 5A 34 01 00 57 45 42 50 56 50 38 58 RIFFZ4 .WEBPgHSt
00000010 OA 00 00 00 08 00 00 00 96 02 00 96 02 00 56 50 .VP
00000020 38 20 12 34 01 00 FO 6E 04 9D 01 2A 97 02 97 02 8 4..fin... .
00000030 3E 51 24 8E 45 A3 A2 21 12 F9 A6 28 38 05 04 B3 >QSZE£c!.uj(8..*
00000040 B4 9E 27 77 3D D2 BE F7 BD B3 71 40 21 33 4E 81 "i'w=Oh-Hs q@!3N.
00000050 30 37 86 B6 47 OC 61 08 C2 6B OE 21 1C 4B F9 CE 07tfG.a.Ak. .Kuf
00000060 7A 2F 08 47 17 F3 5F E5 03 9D AF FB 4F 40 2A 37 z/.G.o a..~uO0*7
00000070 7F A5 E4 OC OD 55 D2 BB FB 31 36 7F A1 64 DF 98 .Â¥a..UOul6.idfi*
00000080 17 95 67 C7 FO DF CC 7F DO FB A3 F9 65 EA 7B FB . g£6Bi.Su£uee {u
00000090 67 A4 CF AO DF 28 FE 92 3C DE FF EB 75 00 7E Cl g*I B (t>' yeu.~£
000000A0 75 D6 7F 2A F5 37 F3 A8 F4 86 FF A3 90 09 23 FF uO.*576"oty£..
* O P gg -2-EL. -7 r\ g<- gg _c_n_ ak kja < *w.i a
Figure 9. Example of Hex Reader WebP File Format of test Image
The WebP file formats do not contain any of the embedded data in an original image, and in the figure above highlighted in blue, VP8 corresponds to a lossy version of a WebP file format. If the version was lossless, it would read VP8L. Retaining a lossless image from Google Plus


36
was not possible, although visually the downloaded outcome was not noticeable compared to the original.
While the above methods to download images from Google Plus strip metadata and
reduce the quality of images, the option to save images through the view page source on
Internet Explorer and Chrome preserves exact pixel dimensions of images. This was also the case
using Mozilla Firefox with the DownloadThemAll plug-in. While lossy compression alters
some original information embedded in an image, the ability to download images without
compressing and reducing their size makes this method of downloading images from Google
Plus a best practice in the seizure of evidence (Appendix B, Table B-3.) In addition to being able
to obtain actual pixel size through this method, further exploration gave rise to another very
important finding. Unique information, Samsung Trailer/Backup RestoreData with
associated numbers, appeared in the extension of one of the test images EXIF data (see Table 5).
_________Table 5. Unique Data located in EXIF Data for image 20160315 105057 HDR~2.jpg
ExifToolVersion =9.90
FileName = 20160315_105057_HDR-2.jpg
Directory = .
FileSize = 1244487 FileModifyDate = 1509252181.91304 FileAccessDate = 1509252176.48793 FileCreateDate = 1509252181.39927 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEGAPP0 (14 bytes):
+ [BinaryData directory | JFIFVersion =11 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEGAPP1 (106 bytes):
ExifByteOrder = II
_________+ [IFDO directory with 3 entries]________________________________________________


37
| 0) Orientation = 1
| 1) Software = Google
| 2) ExifOffset (SubDirectory) >
| + [ExifIFD directory with 3 entries]
| | 0) ExifVersion = 0220 | | 1) ExiflmageWidth = 2340 | | 2) ExiflmageHeight = 2340 JPEGDQT (65 bytes):
JPEGDQT (65 bytes):
JPEGSOFO (15 bytes):
ImageWidth = 2340 ImageHeight = 2340 EncodingProcess = 0 BitsPer Sample = 8 ColorComponents = 3 JPEG DHT (29 bytes):
JPEG DHT (179 bytes):
JPEG DHT (29 bytes):
JPEG DHT (179 bytes):
JPEG SOS
Samsung trailer (77 bytes at offset 0xl2fcfa): SamsungTrailer_0x0a41Name = BackupRestore_Data SamsungTrailer 0x0a41 =355022071107283 698
Because this signature was not showing up in any other test image, it was apparent that something about this particular digital image was unique and therefore was investigated more in the HxD hex editor tool. In the footer of the hex data, BackupRestoreData was also present as well as the same associated numbers that proved to be the IMEI number of the Samsung phone used to conduct the transfer of images in this study (Figure 10 and Figure 11)


38
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B OC 0D 0E OF
00046EBO A2 8A F8 FC F9 B5 86 76 3E DB 27 4B 42 E2 21 46 eSaiiuutv>0' KBa! F
00046EC0 70 CC 5D 81 3F 39 EB DE AD DB CE F0 5F 5A 00 41 pi] .?9ef>.Ula Z.A
00046ED0 59 48 8D 81 ID B3 45 15 F9 E6 03 5A C8 FA 8C 47 YH...E.us.ZEuGG
00046EE0 F0 66 75 B7 F3 32 5C CB 1A F0 A8 8A 07 El 8A A6 8fu o2\E.8'S.aS!
00046EF0 D2 36 48 CF 71 45 15 FB 86 IB F8 48 FC 97 13 FC 06HIqE. ut. aHu-. ti
00046F00 49 8D F3 7D AS A2 8A A3 23 FF D9 00 00 41 0A 12 I w.
Q0046F10 00 00 00 42 61 63 6B 75 70 52 65 73 74 6F 72 65 .. .BacIcupRestore
00046F:0 5F 44 61 74 61 33 35 35 31 32 30 37 31 31 30 37 Data35512071107
00046F30 32 38 33 5F 36 39 38 53 45 46 48 65 00 00 00 CL 283 693SEFHe
00046F40 00 00 00 00 00 41 0A 2D 00 00 00 2D 00 00 00 1 A.-..
00046F50 00 00 00 53 45 46 54| -SEFTjj
Figure 10. Unique Content Found in Footer of Hex Data BackupRestoreData
Figure 11. Screen Shot of IMEI number from Samsung Phone Used in the Research
Not a lot could be found about the signature BackupRestore Data and why it is rooted
in only certain images over others, however there are online discussions about it. In a dialog on
the XDA Developers website, it is indicated that a possible reason for this signature to occur is
due to the Samsung Gallery Application, that when turned on, groups photos automatically and


39
creates event folders for them. When turned on, the signature appears in the hex. When turned off, it goes away [27],
The fact that Google Plus was retaining data embedded in the footer of this file (unique evidence that identifies a specific mobile phone), was an important fiding and could be extremely useful for investigations involving images on Google Plus. To see if the platform saves any and all data embedded in any digital image, a test image that did not contain unique content in its original footer, was opened in the HxD hex editor tool and edited by entering ..M.e.l.i.s.s.a.H.e.l.l.o.O at the end of the file structure. The edited version was then saved as a new file. Next, the edited image was uploaded to and from Google Plus and the downloaded version was observed in Exiftool and HxD. Indeed, Google Plus still preserved the original size and altered data implanted in the footer. The only difference was that the edit is only visible in hex, not in the EXIF data (see Figure 12, 12 and 14.) This was the same circumstance for the image containing unique data in its original footer after editing it for testing. Last but not least, these tests were also explored on Flickr. Flickr did not preserve any of this information and all metadata was stripped.
00046E20 20 56 C5 BF C4 4D 42 C3 C3 49 7B 6C 91 C2 D6 97 VAcAMBAAItl'AO-
00046E30 3F 66 31 8E 52 45 CF 52 3D 68 A2 BE 39 24 DE A7 ?flZREIR=hcV45SI>§
00046E40 BA F4 8E 86 FF 00 86 IB 4F D4 BC 47 63 A8 9D 39 6Zty.t.OO^Gc.9
00046ES0 62 95 A3 69 19 15 F2 A4 EO 9E E3 D6 B6 > ^ 73 B6 b*£i..6HazaOI"sI
00046E60 76 3F 31 14 51 5F AF 70 DA 4B OC AC 7E 69 9E 36 v?l.Q ptJK.-i~iz6
00046E70 EA EA 46 97 5E 48 CA 20 07 CD C5 49 75 FE 91 75 eeF-^HE .LAIup'u
00046E80 OC 2F F7 37 C7 45 15 F5 C7 C9 75 3C F3 E2 74 BF . /-r7£E. o£Eu 00046E90 6D D7 52 07 IF BA 47 DA AA 3D 01 CO 15 99 EO FD m*R..0GD*=.A.ay
00046EA0 2E 09 3C 49 AS CC C3 32 C7 1A A4 6D DD 41 07 38 ..<1 iAC£.nmYA.8
00046EB0 A2 8A F8 FC F9 B5 86 76 3E DB 27 4B 42 E2 21 46 cSouuutv>6KBa!F
00046EC0 70 CC 5D 81 3F 39 EB DE AD DB CE FO 5F 5A 00 41 pi] ?9ef>.6ifl Z.A
00046ED0 59 48 8D 81 ID B3 45 15 FO E6 03 5A C8 FA 8C 47 YH. 3 E u*. ZEu(EG
00046EE0 FO 66 75 B7 F3 32 5C CB 1A FO AS 8A 07 El 8A A6 flfu -62XE.S S.aS!
00046EF0 D2 36 48 CF 71 45 15 FB 86 IB F8 48 FC 97 13 06HiqE.ut.laHii .ii
00046F00 49 8D F3 7D AS A2 8A A3 23 FF DO 1.6} cs£#yu
Figure 12. Original Hex Data of Image: 20150305_145611_HDR~2~3~2.jpg Does not
Contain Unique Data in the footer


40
00046950 EO 5E E3 D6 B6 73 B6 76 3F 31 14 51 5F AF 70 azaOf"sfv?l.Q p
000465A0 DA 4B OC AC 7E 65 5E 36 EA EA 46 97 5E 48 CA 20 UK.-.~iz6eeF~HE
000465B0 07 CD C5 49 75 FE 91 75 OC 2F F7 37 C7 45 15 F5 .iAIufc'u./-7£E.o
000465C0 C7 C9 75 3C F3 E2 74 BF 6D D7 52 07 IF BA 47 DA QEu<6atc,m*R. GU
000465D0 AA 3D 01 CO 15 95 EO FD 2E 09 3C 49 A3 CC C3 32 *=.A.ay.. <1 "IA2
000465E0 C7 1A A4 6D DD 41 07 38 A2 SA F8 FC F5 B5 86 76 C. MmYA. 8 c S szuuutv
000465F0 3E DB 27 4B 42 E2 21 46 70 CC 5D 81 3F 39 EB DE >U KBa Fpi) ?5el>
OOO46A0O AD DB CE FO 5F 5A 00 41 55 48 8D 81 ID B3 45 15 .uia Z.AYH...*E.
00046A10 F9 E6 03 5A C8 FA 8C 47 FO 66 75 B7 F3 32 5C CB u*. ZEuCEGflfu -62\E
00046A20 1A FO A8 8A 07 El 8A A6 D2 36 48 CF 71 45 15 FB .6 S.aS;06HiqE.u
00046A30 86 IB F8 48 FC 97 13 FC 45 8D F3 7D A3 A2 8A A3 t. izHii.iil .6} cS£
00046A40 23 FF D5 2E 2E 4D 2E 65 2E 6C 2E 65 2E 73 2E 7i* #yU..M.e.1.i.s s
00046A50 2E 61 2E 48 2E 65 2E 6C 2E 6C 2E \ .a.H.e.l.l.o.O
Figure 13. Edited Hex is Preserved in the Footer of the Edited Version After Being
Downloaded from Google Plus
| | 0) ExifVersion = 0220 | | 1) ExiflmageWidth = 865 | | 2) ExiflmageHeight = 1221 JPEG DQT (65 bytes):
JPEG DQT (65 bytes):
JPEGSOFO (15 bytes):
I mage Width = 865 ImageHeight = 1221 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (29 bytes):
JPEG DHT (179 bytes):
JPEG DHT (29 bytes):
JPEG DHT (179 bytes): A-----------------
JPEG SOS__________________\|
Figure 14. EXIF Data Results for Edited Version: 20150305_145611_HDR~2~3~2.jpg
In addition to the observations made in the application of different download methods on various internet browsers, here are some other Google Plus behaviors to be aware of:
1. Images that retained their original pixel dimensions after downloading them from Google Plus, are indeed an exact pixel replica of the original as shown in their quantization tables (Figure 75), CFA Analysis (Figure 16), and Compression Level Analysis (Figure 17).


41
Original Image Quantization Table
E 2 2 3 5 8 10 12
2 2 3 4 5 12 12 11
3 3 3 5 8 11 14 11
3 3 4 6 10 17 16 12
4 4 7 11 14 22 21 15
5 7 11 13 16 21 23 18
10 13 16 17 21 24 24 20
14 18 19 20 22 20 21 20
3 4 5 9 20 20 20 20
4 4 5 13 20 20 20 20
5 5 11 20 20 20 20 20
9 13 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
Downloaded Image Quantization Table
E 2 2 3 5 8 10 12
2 2 3 4 5 12 12 11
3 3 3 5 8 11 14 11
3 3 4 6 10 17 16 12
4 4 7 11 14 22 21 15
5 7 11 13 16 21 23 18
10 13 16 17 21 24 24 20
14 18 19 20 22 20 21 20
3 4 5 9 20 20 20 20
4 4 5 13 20 20 20 20
5 5 11 20 20 20 20 20
9 13 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
20 20 20 20 20 20 20 20
Figure 15. Quantization Table Comparison of Image Downloaded from Google Plus Using Best Practices


42
Figure 16. CFA Comparison Analysis Match Exactly Using Best Practices
Figure 17. CLA Comparison Shows No Sign of Compression Using Best Practices


43
2. Google Plus saved images as either Photo.jpg and/or Photo-Google+.jpg as a public user that does not own the account. The diagrams provided in this research paper list when images were saved as their original names, however this will never be the case during real investigations. The computer conducting the test was naming the images by their original name due to information being stored to its browser and not being cached.
3. All downloaded images had the same aspect ratio as the originals.
4. Images that were 1060 pixel-width, correlate with images downloaded to mobile phone. Images that were 663 pixel-width, correlate with images downloaded to desktop.
5. Images downloaded from Google Plus contain: Software = Google in the EXIF and hex data (Diagram of results in Figure 18)
SUMMARY Upload from desktop; Download by desktop; Moxilla FireFox with DownloadThemAll plugin
! RESULTS Retained same Quantization T ables as original image 2340 x 2340 = same as the original image Name Change* saves as Photo-Google+.jpg Software: Identifier 'Google' in EXIF Data

SUMMARY Upload from desktop; Download to Desktop; Using chrome and saving to JPG
p. ML :: E 1 RESULTS Retained same Quantization T ables as original image 2340 x 2340 = same as the original image Saves as original name (20160315_105057_HDR-2.jpg) Software: Identifier 'Google' in EXIF Data


44
SUMMARY Upload and Download from desktop Internet Explorer
/' | RESULTS Original 4160 x 2340 / Download 663 x 1178= 1.77 Aspect Ratio Saved as original name (2014093 0_ 115613_Burst04 .jpg) Altered* Quantization Tables Software: Identifier 'Google' in EXIF Data

SUMMARY Upload and Download to cell Phone
| RESULTS Original 4160x2340/Download 1060x 596 = 1.77 Aspect Ratio Saved as original name (20150116_182100_HDR.jpg) Altered* Quantization Tables Software: Identifier 'Google' in EXIF Data

SUMMARY Upload from cell phone; download to desktop
HU RESULTS Original 1719x2270/Download663 x875 = 1.32 Aspect Ratio Saved as original name (20150507_093353_HDR~2~2.jpg) Altered* Quantization Tables Software: Identifier 'Google' in EXIF Data

SUMMARY Upload from Desktop and download to Cell Phone
RESULTS Original 865 x 1221 / Download 1060 x 1496= 1.4 Aspect Ratio Saved as original name (20150305_145611_HDR-2-3-2.jpg) Altered* Quantization Tables Software: Identifier 'Google' in EXIF Data
Figure 18. Summary of Google Plus Analysis Results
CHAPTER VI
CONCLUSION AND FUTURE RESEARCH
To recap, digital image evidence from social media networks is useful in many types of criminal investigations and court proceedings. Investigative leads, for instance, could be solving


45
timelines of an event or learning details about the account holder. This work aimed to perform an experimental study on Flickr and Google Plus to understand the base behavior of these social media platforms and inform best practices for forensic investigations. It illustrated the potential ways for acquiring information about digital images and interpreting the metadata and, in the process, concludes two core findings: first being that Flickr preserves images 100% as long as the account user allows public downloads of their original images. If the account user does not permit this, it is not possible to obtain authentic information and data from images downloaded from Flickr other than the minor observations listed in this research.
The second vital finding is that Google Plus preserves exact pixel dimensions of original images and any unique data that may be embedded in the extension of image files providing best practices are followed:
1. Use Internet Explorer or Chrome to download images from Google Plus.
2. Right click alongside an open image in Google Plus, select view page source and find the URL containing the JPG image, copy and paste URL in browser, right click the image that opens and select save as. At this point, the image will be saved as a JPG and in its exact size as the original. Additionally, should an image contain unique data in the footer of its file structure, the information will appear in the hex data as well as in the EXIF data.
3. Saving an image using Mozilla Firefox with the DownloadThemAll plug-in will easily do all of this in less steps and acquire the same optimal results more quickly.
Being aware of these core findings and following these best practices will help spot
evidence more efficiently and assure that investigators and forensic analysts are obtaining images from these platforms in those most optimal way.


46
The process of downloading an image will usually result in stripping meaningful data. Should an investigation demand further interpretation of behaviors particular to Flickr and Google Plus in order to build a case, how images are resized and renamed are other key factors to consider. This study confirms that Flickr works similar to Facebook according to related research conducted by M. Pippins (2016.) Denoting that, the size of the image influences how an image is named: images in 2048-pixel width were renamed as a string of numbers ending in _k.jpg and 1024-pixel width were renamed as a string of numbers ending in _b.jpg. Finally, image settings that allowed public downloads were saved as a string of numbers followed by _o.jpg. To determine whether or not this extension is related to a certain size, future research using a bigger pool of test images would need to be analyzed. Google Plus, renames images either asPhoto.jpg or the obvious giveaway, Photo-Google+.html, and/or .webpk
One last suggestion is to look for the tagline Software Google in the image EXIF data. This is an obvious indicator that the images are associated with the Google Plus platform. Future Research
WebP is an emerging image format that merits future exploration especially as new browsers begin to adopt the format. Because it is potentially the best format to obtain high image quality, it may assist investigations involving online images. Specifically, is it possible to obtain lossless versions of WebP formatted images from online platforms and if so how?
Flickr, previously owned by Yahoo, was acquired by Versizon in June 2017. While Flickr has had along history of preserving the quality of images, Versizon may make changes that would impact findings in future research. Future testing on Flickr may be necessary.


47
REFERENCES
1. Josh Gilliland. (2013). The admissibility of social media evidence. Litigation, 39(1),
20-21. Retrieved from http://www.jstor.org/stable/24396778.
2. En.wikipedia.org. (2017). Metadata, [online] Available at:
https://en.wikipedia.org/wiki/Metadata [Accessed 21 Oct. 2017],
3. Pippin, M. (2016). Digital image recompression analysis : Facebook University of
Colorado Denver.
4. Castiglione, A., Cattaneo, G., & De Santis, A. (2011). A forensic analysis of images on
online social networks. Paper presented at the 679-684. doi: 10.1109/INCoS.2011.17.
5. En.wikipedia.org. (2017). Discrete cosine transform, [online] Available at:
https://en.wikipedia.org/wiki/Discrete_cosine_transform [Accessed21 Oct. 2017],
6. En.wikipedia.org. (2017). JPEG, [online] Available at:
https://en.wikipedia.org/wiki/JPEGfAccessed21 Oct. 2017],
7. Flickr. (n.d.). How many public photos are uploaded to Flickr every day, month,
year? [online] Available at:
https://www.flickr.com/photos/franckmichel/6855169886 [Accessed 21 Oct.
2017],
8. Mellina, C., Russell, A., Patel, M. and Travlos, X. (2017). code.flickr.com. [online]
Code.flickr.net. Availableat: https://code.flickr.net/ [Accessed21 Oct. 2017],
9. PetaPixel. (n.d.). Flickr Decreased Quality and Increased Compression, and Users
Aren't Happy. [online] Available at: https://petapixel.com/2015/06/08/flickr-decreased-quality-and-increased-compression-and-users-arent-happy/ [Accessed 21 Oct. 2017],
11. Dropbox Tech Blog. (2017). Lepton image compression: saving 22% losslesslyfrom
images at 15MB/s. [online] Availableat:
https://blogs.dropbox.com/tech/2016/07/lepton-image-compression-saving-22-losslessly-from-images-at-15mbs/ [Accessed 21 Oct. 2017],
12. En.wikipedia.org. (2017). Lossless compression, [online] Availableat:
https://en.wikipedia.org/wiki/Lossless_compression [Accessed 21 Oct. 2017],
13. En.wikipedia.org. (2017). Exif. [online] Availableat
https://en.wikipedia.org/wiki/ExiffAccessed29 Oct. 2017],


48
14. Google Developers. (n.d.). A new image format for the Web \ WebP \ Google
Developers, [online] Available at: https://developers.google.com/speed/webp/ [Accessed 29 Oct, 2017],
15. Digitalizationguidelines.gov. (n.d.). Hash algorithm Glossary Federal Agencies
Digitization Guidelines Initiative, [online] Available at:
http://www.digitizationguidelines.gov/term.php?term=hashalgorithm [Accessed 29 Oct, 2017],
16. Says, J.B., Says, D., Says, R.B., Says, M., & Says, T. (2017, January 25). Is there any
benefit to using WebP images on my website? [online] Available at: https://havecamerawilltravel.com/photographer/webp-website/ [Accessed November 11, 2017],
17. Shi, Y Q., & Sun, H. (2008). Image and video compression for multimedia engineering:
Fundamentals, algorithms, and standards (2nd ed.) Boca Raton: CRC Press.
18. En.wikipedia.org. (2017). Hexadecimal, [online] Available at:
https://en.wikipedia.org/wiki/Hexadecimal [Accessed 19 Nov. 2017],
19. En.wikipedia.org. (2017). Exiftool. [online] Available at:
https://en.wikipedia.org/wiki/ExifTool [Accessed 19 Nov. 2017],
20. JPEGsnoop (moved to GitHub). (n.d.). Available at:
https://sourceforge.nct/p/jpegsnoop/wiki/Home/ [Accessed 19. Nov. 2017],
21. Warlock. (2013). File carving, [online] Available at:
http://resources.infosecinstitute.com/file-carving/ [Accessed 20. Nov. 2017],
22. Vangie Beal. (n.d.). ASCII, [online] Available at:
https://www.webopedia.eom/TERM/A/ASCn.html [Accessed 20. Nov. 2017],
23. J. Holt, Thomas & Bossier, Adam & Seigfried-Spellar, Kathryn. (2015). Cybercrime and Digital Forensics: An Introduction.
24. CBSNews.com. (n.d). Social Media Related Crimes. [online] Available at:
https://www.cbsnews.com/pictures/social-media-related-crimes/ [Accessed 20. Nov. 2017],
25. Optimus (June 15, 2017). WebP support-itsmore thanyou think, [online] Availableat: https://optimus.keycdn.com/support/webp-support/ [Accessed 27. Nov. 2017],


49
26. Koenig, B. E., Lacey, D. S., Grigoras, C., Price, S. G., & Smith, J. M. (2013). Evaluation of the average DC offset values for nine small digital audio recorders. Journal of the Audio Engineering Society, 61(6), 439-448.
27. XDA Developers (May 11, 2017). Photos modified days after taken (exif metadata added), [online] Available at: https://forum.xda-developers.com/galaxy-s7/help/photos-modified-days-t3451600. [Accessed 28. Nov. 2017],


50
Appendix A
Flickr: EXIF Data Analysis
Table A-1.
EXIF Data and Quality Factor: Original Image vs Image Uploaded and Downloaded Via Desktop, Download Not Permitted_______________________________________
Original Image Image After Download
ExifToolVersion = 9.90 ExifToolVersion =9.90
FileName =20140930 115613 Burst04.jpg FileName =
Directory = . 36070463433_f58a95a39 l_k. j pg
FileSize = 1671607 Directory = .
FileModifyDate = 1503888971.87222 FileSize = 354532
FileAccessDate = 1503299726 FileModifyDate = 1505105943.89992
FileCreateDate = 1503299726 FileAccessDate = 1505105938.72692
FilePermissions = 33206 FileCreateDate = 1505105943.5694
FileType = JPEG FilePermissions = 33206
MIMEType = image/jpeg FileType = JPEG
JPEGAPP1 (18133 bytes): MIMEType = image/jpeg
ExifByteOrder = MM JPEGAPP0 (14 bytes):
+ [IFD0 directory with 9 entries] + [BinaryData directory
0) GPSInfo (SubDirectory) > JFIFVersion =11
+ [GPS directory with 8 entries] ResolutionUnit = 1
0) GPSLatitudeRef = N XResolution = 72
| | 1) GPSLatitude = 39 44 8.2269 (39/1 44/1 YResolution = 72
82269/10000) JPEG COM (43 bytes):
2) GPSLongitudeRef = W Comment = Optimized by JPEGmini
| | 3) GPSLongitude = 104 59 20.0646 (104/1 59/1 3.13.3.15 0x3cf38bdf
200646/10000) JPEGDQT (65 bytes):
4) GPSAltitudeRef = 0 JPEGDQT (65 bytes):
| | 5) GPS Altitude = 1623 (1623000/1000) JPEGSOFO (15 bytes):
| | 6) GPS Time Stamp = 17 56 13 (17/1 56/1 13/1) ImageWidth = 1152
| | 7) GPSDateStamp = 2014:09:30 ImageHeight = 2048
Warning = Tag ID 0x0112 out of sequence in EncodingProcess = 0
IFD0 BitsPer Sample = 8
1) Orientation = 6 ColorComponents = 3
Warning = Tag ID 0x0110 out of sequence in IFD0 2) Model = LG-D850 JPEG DHT (27 bytes): JPEG DHT (90 bytes): JPEG DHT (25 bytes):
3) ExifOffset (SubDirectory) > JPEG DHT (45 bytes):
+ [ExiflFD directory with 19 entries] JPEGDRI (2 bytes):
0) InteropOffset (SubDirectory) > + [InteropIFD directory with 2 entries] 0) Interoplndex = R98 JPEG SOS (END)


51
| | | 1) InteropVersion =0100 | | Warning = Tag ID 0x9004 out of sequence in FxifTFD
|| 1) CreateDate = 2014:09:30 11:56:13 | | 2) ColorSpace = 1
| | Warning = Tag ID 0x9003 out of sequence in KxifTFD
| | 3) DateTimeOriginal =2014:09:30 11:56:13 | | 4) FlashpixVersion =0100 | | Warning = Tag ID 0x9207 out of sequence in FxifTFD
| | 5) MeteringMode = 2 | | Warning = Tag ID 0x9204 out of sequence in FxifTFD
| | 6) ExposureCompensation = 0 (0/1)
| | 7) ExiflmageHeight = 2340 | | Warning = Tag ID 0x9000 out of sequence in ExifTFD
| | 8) ExifVersion = 0220 | | 9) ExiflmageWidth =4160 | | Warning = Tag ID 0x920a out of sequence in ExifTFD
| | 10) FocalLength = 3.97 (3970/1000)
| | 11) DigitalZoomRatio = 1 (100/100)
| | Warning = Tag ID 0x9209 out of sequence in FxifTFD | | 12) Flash = 0 | | 13) WhiteBalance = 0 | | Warning = Tag ID 0x829a out of sequence in FxifTFD
| | 14) ExposureTime = 0.001131221719 (1/884)
| | 15) ISO = 50
| | 16) ComponentsConfiguration =12 3 0 | | Warning = Tag ID 0x829d out of sequence in ExifTFD
| | 17) FNumber = 2.4 (240/100)
| | 18) MakerNoteUnknown (SubDirectory) >
| | | Warning = [minor] Unrecognized MakerNotes | Warning = Tag ID 0x0213 out of sequence in IFD0
| 4) YCbCrPositioning = 1 | Warning = Tag ID 0x01 lb out of sequence in IFD0
| 5) YResolution = 72 (72/1)
| 6) ResolutionUnit = 2 | Warning = Tag ID 0x01 la out of sequence in IFD0


52
| 7) XResolution = 72 (72/1)
| Warning = Tag ID 0x01 Of out of sequence in IFDO | 8) Make = LG Electronics + [IFD1 directory with 7 entries]
| 0) YResolution = 72 (72/1)
| 1) ResolutionUnit = 2 | Warning = Tag ID 0x01 la out of sequence in IFD1
| 2) XResolution = 72 (72/1)
| Warning = Tag ID 0x0112 out of sequence in IFD1
| 3) Orientation = 6
| Warning = Tag ID 0x0103 out of sequence in IFD1
| 4) Compression = 6 | 5) ThumbnailOffset = 1316 | 6) ThumbnailLength = 16811 JPEGDQT (130 bytes):
JPEGSOFO (15 bytes):
ImageWidth =4160 ImageHeight = 2340 EncodingProcess = 0 BitsPer Sample = 8 ColorComponents = 3 JPEGDHT (416 bytes):
JPEG SOS
Quality Factors of Original JPEG Vs. Quality Factors of JPEG Compression After Flickr
Original Luminance Post Download Luminance
2 2 1 2 3 6 7 9 4 3 1 4 6 9 12 15
22234888 3 3 3 5 6 14 14 13
222368 10 8 3 3 4 6 9 14 17 13
2 2 3 4 7 12 11 9 3 4 5 7 12 21 19 15
3 3 5 8 10 15 14 11 4 5 9 13 16 26 24 18
3 5 8 9 11 15 16 13 6 8 13 15 19 24 27 22
7 9 11 12 14 17 17 14 12 15 18 21 24 29 29 24
10 13 13 14 16 14 14 14 17 22 23 23 27 24 24 24
Original Chrominance Post Download Chrominance
2 3 3 7 14 14 14 14 4 4 6 11 24 24 24 24
3 3 4 9 14 14 14 14 4 5 6 15 24 24 24 24
3 4 8 14 14 14 14 14 6 6 13 24 24 24 24 24
7 9 14 14 14 14 14 14 11 15 24 24 24 24 24 24
14 14 14 14 14 14 14 14 24 24 24 24 24 24 24 24
14 14 14 14 14 14 14 14 24 24 24 24 24 24 24 24
14 14 14 14 14 14 14 14 24 24 24 24 24 24 24 24
14 14 14 14 14 14 14 14 24 24 24 24 24 24 24 24


53
Table A-2.
EXIF Data and Quality Factor: Original Image vs. Image Uploaded from Mobile Phone, Downloaded to Desktop, Public Download Not Permitted_________________
Original Image Image After Download
ExifToolVersion = 9.90 ExifToolVersion =9.90
FileName = 20150507 093353 HDR~2~2.jpg FileName = 36880336625 llff6133fe b.jpg
Directory = . Directory = .
FileSize = 1238212 FileSize =390291
FileModifyDate = 1503888970.69028 FileModifyDate = 1507741038.286
FileAccessDate = 1503299680 FileAccessDate = 1507741033.3443
FileCreateDate = 1503299680 FileCreateDate = 1507741038.00875
FilePermissions = 33206 FilePermissions = 33206
FileType = JPEG FileType = JPEG
MIMEType = image/jpeg MIMEType = image/jpeg
JPEGAPP1 (1330 bytes): JPEGAPP0 (14 bytes):
ExifByteOrder = MM + [BinaryData directory
+ [IFD0 directory with 10 entries] JFIFVersion =11
|0) ModifyDate = 2015:05:07 10:30:54 ResolutionUnit = 1
1) GPSInfo (SubDirectory) > XResolution = 72
+ [GPS directory with 8 entries] YResolution = 72
| | 0) GPSDateStamp = 2015:05:07 JPEG COM (43 bytes):
Warning = Tag ID 0x0005 out of sequence in Comment = Optimized by JPEGmini
GPS 3.13.3.15 0xad6b4f35
1) GPSAltitudeRef = 0 JPEGDQT (65 bytes):
Warning = Tag ID 0x0003 out of sequence in JPEGDQT (65 bytes):
GPS JPEGSOFO (15 bytes):
2) GPSLongitudeRef = W Image Width =775
| | 3) GPSLongitude = 104 53 45.7068 (104/1 53/ ImageHeight = 1024
1 4j/Uoo/lUUUU) Warning = Tag ID 0x0001 out of sequence in EncodingProcess = 0
GPS BitsPer Sample = 8
4) GPSLatitudeRef = N ColorComponents = 3
| | 5) GPS Time Stamp = 15 33 51 (15/1 33/1 51/1) JPEG DHT (28 bytes):
Warning = Tag ID 0x0006 out of sequence in JPEG DHT (92 bytes):
GPS JPEG DHT (26 bytes):
| | 6) GPS Altitude = 1691 (1691000/1000) JPEG DHT (60 bytes):
Warning = Tag ID 0x0002 out of sequence in JPEG SOS
GPS (END)
| | 7) GPSLatitude = 39 39 18.2983 (39/1 39/1
182983/10000)
Warning = Tag ID 0x0110 out of sequence in
IFD0
2) Model = LG-D850
3) YCbCrPositioning = 1
Warning = Tag ID 0x0128 out of sequence in


54
IFDO
| 4) ResolutionUnit = 2 | Warning = Tag ID 0x01 lb out of sequence in IFDO
| 5) YResolution = 72 (72/1)
| Warning = Tag ID 0x0112 out of sequence in IFDO
| 6) Orientation = 1 | 7) ExifOffset (SubDirectory) >
| + [ExiflFD directory with 19 entries]
| | 0) ColorSpace = 1
| | Warning = Tag ID 0x9004 out of sequence in ExiflFD
| | 1) CreateDate = 2015:05:07 09:33:53 | | Warning = Tag ID 0x829d out of sequence in ExiflFD
| | 2) FNumber = 2.4 (240/100)
| | 3) FocalLength =3.97 (3970/1000)
| | 4) WhiteBalance = 0
| | Warning = Tag ID 0xa002 out of sequence in ExiflFD
| | 5) ExiflmageWidth =4160 | | Warning = Tag ID 0x9207 out of sequence in ExiflFD
| | 6) MeteringMode = 2 | | Warning = Tag ID 0x9003 out of sequence in ExiflFD
| | 7) DateTimeOriginal =2015:05:07 09:33:53 | | 8) ComponentsConfiguration =12 3 0
| | 9) ExiflmageHeight = 2340
| | Warning = Tag ID 0x9209 out of sequence in ExiflFD | | 10) Flash = 0
| | Warning = Tag ID 0x9000 out of sequence in ExiflFD
| | 11) ExifVersion = 0220 | | 12) InteropOffset (SubDirectory) >
| | + [InteropIFD directory with 2 entries]
| | | 0) Interoplndex = R98 | | | 1) InteropVersion =0100 | | Warning = Tag ID 0x9204 out of sequence in ExiflFD
| | 13) ExposureCompensation = 0 (0/1)
| | Warning = Tag ID 0x8827 out of sequence in ExiflFD | | 14) ISO = 50
I | 15) FlashpixVersion = 0100______________


55
| | Warning = Tag ID 0x927c out of sequence in ExiflFD
| | 16) MakerNoteUnknown (SubDirectory) >
| | | Warning = [minor] Unrecognized MakerNotes | | 17) DigitalZoomRatio = 1 (100/100)
| | Warning = Tag ID 0x829a out of sequence in ExiflFD
| | 18) ExposureTime = 0.01666666667 (1/60)
| Warning = Tag ID 0x01 la out of sequence in IFD0
| 8) XResolution = 72 (72/1)
| Warning = Tag ID 0x01 Of out of sequence in IFD0
| 9) Make = LG Electronics + [IFD1 directory with 5 entries]
| 0) YResolution = 72 (72/1)
| Warning = Tag ID 0x0112 out of sequence in IFD1
| 1) Orientation = 6
| Warning = Tag ID 0x0103 out of sequence in IFD1
| 2) Compression = 6 | 3) ResolutionUnit = 2 | Warning = Tag ID 0x01 la out of sequence in IFD1
| 4) XResolution = 72 (72/1)
JPEGAPP0 (14 bytes):
+ [BinaryData directory | JFIFVersion =11 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEGDQT (65 bytes):
JPEGDQT (65 bytes):
JPEGSOFO (15 bytes):
ImageWidth = 1719 ImageHeight = 2270 EncodingProcess = 0 BitsPer Sample = 8 ColorComponents = 3 JPEGDHT (29 bytes):
JPEGDHT (179 bytes):
JPEGDHT (29bytes):
JPEGDHT (179 bytes):
JPEG SOS


56
Quality Factors of Original JPEG Vs. Quality Factors of JPEG Compression After Flickr
Original Luminance Post Download Luminance
3 2 2 3 5 8 10 12 3 1 1 3 5 8 11 13
2 2 3 4 5 12 12 11 3 3 3 2 5 13 13 11
3 3 3 5 8 11 14 11 3 3 3 5 8 12 15 12
3 3 4 6 10 17 16 12 3 3 5 6 11 19 17 13
4 4 7 11 14 22 21 15 4 5 8 12 14 23 22 16
5 7 11 13 16 21 23 18 5 8 11 14 17 22 24 19
10 13 16 17 21 24 24 20 10 14 16 19 22 26 26 21
14 18 19 20 22 20 21 20 15 19 20 21 24 21 22 21
Original Chrominance Post Download Chrominance
3 4 5 9 20 20 20 20 3 4 5 1C 21 21 21 21
4 4 5 13 2C 20 2C 20 4 5 5 14 21 21 21 21
5 5 11 20 20 20 20 20 5 5 12 21 21 21 21 21
9 13 20 20 20 20 20 20 10 14 21 21 21 21 21 21
20 20 20 20 20 20 20 20 21 21 21 21 21 21 21 21
20 20 20 20 20 20 20 20 21 21 21 21 21 21 21 21
20 20 20 20 20 20 20 20 21 21 21 21 21 21 21 21
20 20 20 20 20 20 20 20 21 21 21 21 21 21 21 21
Table A-3
EXIF Data for Image 20140930_115613_Burst04.jpg: Saving Image viaFlickrs Size Option Link 1152 x 2048 vs. Deleting HTML to Save Image to Desktop_______________________
Download from Flickr
ExifToolVersion = 9.90 ExifToolVersion =9.90
FileName = 36070463433 f58a95a391 k.jpg FileName =
Directory = . 36070463433_f58a95a391_k.jpg
FileSize = 354532 Directory = .
FileModifyDate = 1506045673.60251 FileSize = 354532
FileAccessDate = 1506137043.53627 FileModifyDate = 1505105943.89992
FileCreateDate = 1506137043.53627 FileAccessDate = 1505105938.72692
FilePermissions = 33206 FileCreateDate = 1505105943.5694
FileType = JPEG FilePermissions = 33206
MIMEType = image/jpeg FileType = JPEG
JPEGAPP0 (14 bytes): MIMEType = image/jpeg
+ [BinaryData directory JPEGAPP0 (14 bytes):
JFIFVersion =11 + [BinaryData directory
ResolutionUnit = 1 JFIFVersion =11
XResolution = 72 ResolutionUnit = 1
YResolution = 72 XResolution = 72
JPEG COM (43 bytes): YResolution = 72
Comment = Optimized by JPEGmini 3.13.3.15 JPEG COM (43 bytes):
0x3cf38bdf


57
JPEGDQT (65 bytes): Comment = Optimized by JPEGmini
JPEGDQT (65 bytes): 3.13.3.15 0x3cf38bdf
JPEGSOFO (15 bytes): JPEGDQT (65 bytes):
ImageWidth = 1152 JPEGDQT (65 bytes):
ImageHeight = 2048 JPEGSOFO (15 bytes):
EncodingProcess = 0 ImageWidth = 1152
BitsPer Sample = 8 ImageHeight = 2048
ColorComponents = 3 EncodingProcess = 0
JPEGDHT (27 bytes): BitsPer Sample = 8
JPEGDHT (90 bytes): ColorComponents = 3
JPEGDHT (25 bytes): JPEGDHT (27 bytes):
JPEGDHT (45 bytes): JPEGDHT (90 bytes):
JPEGDRI (2 bytes): JPEGDHT (25 bytes):
JPEG SOS JPEGDHT (45 bytes):
JPEGDRI (2 bytes):
JPEG SOS
Table A-4
EXIF Data: for Image 20150507_093353_HDR~2~2.jpg: Saving Image Via Flickrs Size Option Link 775 x 1024 vs. Deleting HTML to Save Image to Desktop_____________________
Download from Flickr Download via Deleting HTML
ExifToolVersion = 9.90 ExifToolVersion = 9.90
FileName = 36880336625 llff6133fe b.jpg FileName = 36880336625 llff6133fe b.jpg
Directory = . Directory = .
FileSize = 390291 FileSize = 390291
FileModifyDate = 1506045257.60762 FileModifyDate = 1507741038.286
FileAccessDate = 1506137043.72379 FileAccessDate = 1507741033.3443
FileCreateDate = 1506137043.72379 FileCreateDate = 1507741038.00875
FilePermissions = 33206 FilePermissions = 33206
FileType = JPEG FileType = JPEG
MIMEType = image/jpeg MIMEType = image/jpeg
JPEGAPP0 (14 bytes): JPEGAPP0 (14 bytes):
+ [BinaryData directory + [BinaryData directory
JFIFVersion =11 JFIFVersion =11
ResolutionUnit = 1 ResolutionUnit = 1
XResolution = 72 XResolution = 72
YResolution = 72 YResolution = 72
JPEG COM (43 bytes): JPEG COM (43 bytes):
Comment = Optimized by JPEGmini 3.13.3.15 Comment = Optimized by JPEGmini
0xad6b4f35 3.13.3.15 0xad6b4f35
JPEGDQT (65 bytes): JPEGDQT (65 bytes):
JPEGDQT (65 bytes): JPEGDQT (65 bytes):


58
JPEGSOFO (15 bytes): JPEGSOFO (15 bytes):
ImageWidth = 775 ImageWidth = 775
ImageHeight = 1024 ImageHeight = 1024
EncodingProcess = 0 EncodingProcess = 0
BitsPer Sample = 8 BitsPer Sample = 8
ColorComponents = 3 ColorComponents = 3
JPEGDHT (28 bytes): JPEGDHT (28 bytes):
JPEGDHT (92 bytes): JPEGDHT (92 bytes):
JPEGDHT (26 bytes): JPEGDHT (26 bytes):
JPEGDHT (60 bytes): JPEGDHT (60 bytes):
JPEG SOS JPEG SOS


Appendix B
Google Plus: EXIF Data Analysis
59
Table B-l
EXIF Data Results: Method of Downloading Right Click Image, Select Save As, Using Internet Explorer. EXIF Data Results______________________________________________
ExifToolVersion =9.90
FileName = 20160315_105057_HDR~2.jpg
Directory = .
FileSize = 122760
FileModifyDate = 1507606360.91573 FileAccessDate = 1509253906.66322 FileCreateDate = 1509253906.39457 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEGAPP0 (14 bytes):
+ [BinaryData directory | JFIFVersion =11 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEGAPP1 (40 bytes):
ExifByteOrder = II + [IFD0 directory with 1 entries]
| 0) Software = Google JPEGDQT (130 bytes):
JPEGSOFO (15 bytes):
ImageWidth = 663 ImageHeight = 663 EncodingProcess = 0 BitsPer Sample = 8 ColorComponents = 3 JPEGDHT (27 bytes):
JPEGDHT (89 bytes):
JPEGDHT (25 bytes):
JPEGDHT (56 bytes):
JPEG SOS


60
Table B-2
EXIF Data Results: Method of Downloading Right Click Image, Select Save As Using Microsoft Edge.__________________________________________________________________
ExifToolVersion = 9.90
FileName = 20160315_105057_HDR~2.jpg
Directory = .
FileSize = 122760
FileModifyDate = 1509254820.74757 FileAccessDate = 1509254820.73194 FileCreateDate = 1509254820.469 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEGAPP0 (14 bytes):
+ [BinaryData directory | JFIFVersion =11 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEGAPP1 (40 bytes):
ExifByteOrder = II + [IFD0 directory with 1 entries]
| 0) Software = Google JPEGDQT (130 bytes):
JPEGSOFO (15 bytes):
ImageWidth = 663 ImageHeight = 663 EncodingProcess = 0 BitsPer Sample = 8 ColorComponents = 3 JPEGDHT (27 bytes):
JPEGDHT (89 bytes):
JPEGDHT (25 bytes):
JPEGDHT (56 bytes):
JPEG SOS
Table B-3
EXIF Data Results: Method of Downloading View Page Source on Chrome and Internet Explorer OR Mozilla Firefox with Plug-in_______________________________________________
ExifToolVersion = 9.90


61
FileName = 20150507_093353_HDR_2_2.jpg Directory = .
FileSize = 1236988
FileModifyDate = 1510466131.77645 FileAccessDate = 1510466127.50872 FileCreateDate = 1510466131.34912 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APPO (14 bytes):
+ [BinaryData directory | JFIFVersion = 11 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEG APP1 (106 bytes):
ExifByteOrder = II + [IFD0 directory with 3 entries]
| 0) Orientation = 1
| 1) Software = Google
| 2) ExifOffset (SubDirectory) >
| + [ExifIFD directory with 3 entries]
| | 0) ExifVersion = 0220 | | 1) ExiflmageWidth = 1719 | | 2) ExiflmageFleight = 2270 JPEG DQ.T (65 bytes):
JPEG DQ.T (65 bytes):
JPEG SOFO (15 bytes):
ImageWidth = 1719 ImageFleight = 2270 EncodingProcess = 0 BitsPerSample =8 ColorComponents = 3 JPEG DHT (29 bytes):
JPEG DHT (179 bytes):
JPEG DHT (29 bytes):
JPEG DHT (179 bytes):
JPEG SOS


Full Text

PAGE 8

C H A P T E R I I N T R O D U C T I O N Engaging in social media websites is a common activity today for adults and kids around the globe. Usage is highly diverse ranging from favorite platforms such as Facebook, Twitter, Instagram and YouTube, and funneling down to sources that foster gaming, dating, network exchange, virtual worlds or tight niche blogs. Hu ndreds of interactive networks are designed to offer communication and entertainment, while in their unique way, being a catchall location for anything that can be shared digitally. Undoubtedly, social Media has become a lively vessel that connects our per sonal and business lives to networking opportunities, meaningful engagement and pastimes for those willing to enter its uncharted territory. Nevertheless, forces as global as the social media galaxy inevitably begin to form two sides: the light side of the force and the dark side. While the good side entices many enthusiasts, it synchronously builds a world wide pond for undesirables to fish and create problems. Online threats, stalking, cyberbullying, hacking and fraud, buying illegal things, and posting crime s are reasons why Digital Media experts Intelligence Analysts and investigators rapidly face a barrage of crime from a new frontier [24] Digital images and videos play a large role in the bottleneck of investigations. The ability to share images an d live feed instantaneously through electronic devices by the masses, stirs up the perfect storm for investigators in search of evidence. When it comes to social media and the inability to prove every step taken to create electronically stored information the question of authenticity rises. A uthentication is key to getting social media evidence admitted in the courtroom [1]

PAGE 9

W hen the integrity and preservation of digital images is not maintained copyright matters also arise. For example, photog raphers wh o share their work on Flickr. Metadata is important in protecting copyright images online One of many reasons why it is so important to understand the origins of digital media found on social media. The data that lies behind digital images can provide a wealth o f information in the analysis of an image and so can signs of compression. T here are different types of information to pay attention to when analyzing an image. One is Metadata; a set of data that describes and gives information abo ut another data [2] Metadat a in an image file, especially EXIF (Exchangeable Image File Format) [13] and XMP (Extensible Metadata Platform), can provide a lot of information about the user like when a user creates a document, or changes it, or accesses it. Metadata ca n be altered as images undergo processing and sharing This includes uploading and down loading images to social sites. Modifications can provide clues in an investigation involving a potential suspect and their social network account but can also limit wh at can be detected and complicate the pursuit. This research centers around alterations made images with Google Plus and Flickr and provides various methods and experimental results to distinguish changes or patterns relative to each social site as well a s electronic devices and internet browsers used The paper is organized as follows: Related Works, Overview, Proposed Methodology, Results and Conclusion. Recent works have studied images on social networks. In (2016) it was discovered that when an image is pulled from Facebook, the type of device doing the uploading and downloading of the image impacts the patterns in metadata structure, quantization tables and J PEG quality. For

PAGE 10

example, a mobile phone that downloads an image repeatedly revealed the following predictable behavior: baseline Discrete Cosine Transform (DCT) encodin g a specific set of quantization table s, and a metadata structure of 65 elements; imag es uploaded from mobile phone and downloaded to desktop showed progressive encoding and a metadata structure of 67 elements; ima ges uploaded and downloaded to desktop computer were progressive encoded, variable quantization tables with average of 87 JPEG q uality and metadata structure of 8 1 elements [3] Regarding the outcome of mobile phone pictures and desktop pictures, it is also noted that each have specific width dimension cutoffs. Mobile phone being 1440 pixels and desktop 2048 pixels. Lastly, Faceboo k has a specific renaming process on images. An image that is given a filename on its way into the social site, is renames as it exits After download, the image is named after a long string of numbers ending in either _n or _o. The _n is p l aced on images smaller than 1024 pixels, the _o on fi les larger than 1024 [3] These are all good examples of how a social internet site effects images and also the sort of observations to take note of during this particular research A ls o worth mentioning is Castiglione et al. (2011) analysis that tested the impact on images on three different social sites: Facebook, Badoo and Google P lus The analysis confirms that JPEG quantization table s pixe l resolution and metadata are i ndeed alte red in predictable ways and demonstrates that images a re stripped of original metadata in the process of com pression. Furthermore, it was discovered that Google Plus manages metadata differently in tha t it on ly resizes an image if the resolutio n meta data is removed [4]

PAGE 11

CHAPTER II TECHNICAL OVERVIEW

PAGE 14

.

PAGE 15

Many readers are already aware of the assortment of social networks made available to users. Back in the day, Flickr used to be the go to spot to share and organize photos online before other popular sites took over. Still, Flickr remains a viable source to turn to for passionate photo lovers and photographers, with an average of 6.8 million digital p hotographs uploaded a day [7]. blog speaks volumes about the community it attracts. Undeniably, the science and technique that goes into creating high quality photographs is important to this robust crowd. standing commitment to keeping uploaded ima ges byte for however, the vast number of large images uploaded to Flic kr presents costly storage challenges I n order to achieve more space and save cost, Flickr rolled out what they call that were upload ed to the site after 2014 [8] The repercussion of these tactics is shown effectively in a test conducted by PetaPixel, where you can see that thumbnail sizes were reduced up to 60% [9 ].

PAGE 16

Figure 3. Flickr image comparison test conducted by PetaPixel: Left version (2012) has 60% better resolution than the image on the right (2015) [9].

PAGE 17

Flickr offers a variety of size option links from which to download images including the opt ion to download the actual ori which is the catalyst to storage shortage. Here Flickr uses Lepton, a streaming image compression format that reduces JPEG images by 22% [10] Suitably, it also provides lossless bit exact storage. Lossless compressi on is a class of data compression algorithms that allows the original data to be perfectly reconstructe d from the compressed data [11]. In that way, the process works much li ke zippi ng and extracting a large file While Flickr has continued to stay true to their vision under the ownership of Yahoo, it will be interesting to see what happens after the recent acquisition by Verizon in June 2017 Und directive new innovat ions and features could be on the way Google P lus is a social netw ork owned by Google that was introduced in 2011. It initially adopted features from other popular social networks, mixing in its own unique functionality like and acts roperties Their concern tends to focus in on the optimization of user accounts, and not so much on the social interaction between others So while Google Plus is not the most prevalent of social networks out there, st popular search engine may be important to some. Much of how the users engage on Google Plus is the same as Twit ter and Facebook, however Google Plus is far more customizable and allows a greater level of focused privacy. Not much was found in regards to what types of users engage most on this network, but just per using through, it seem s to be another popular spot for ph otographers to congregate and share their images.

PAGE 18

CHAPTER III PREPARATION

PAGE 19

In order to understand the cause and effect that Google Plus and Flickr have on images, it is important to look at the metadata of an original image against the same image after it has been uploaded and downloaded to these platforms T herefore, t h e ana lysis started by collecting information and data of both original images and downloaded images A comparison was then done by equating the meta data including observing distinct characters located in the hex noting how platforms name images and resize them, and crosschecking hash value s P latform settings create limitations in the ability to see and do wnload protected images from social sites therefore, a trial and error of download method s were tested and measured and are discussed in more detail below An overall evaluation is discussed during the conclusion of this thesis paper Uploading and downloading images In the process of uploading and downloading images from Google Plus and/or Flickr from an electrical device, data may be altered For the purpose of this research images were transferred and evaluated four different ways: 1. U pl oad and download via mobile phone 2.

PAGE 20

Upload and download via desktop 3. Upload fro m mobile phone and download to desktop 4. Upload from desktop and download to mobile phone. Social Network Settings The ease of customizing privacy settings and tiered controls varies by service It can also increase the difficulty of downloading an image for the purpose o f obtaining meaningful data However as long as the image is viewable, there are still ways to download them although a lot of data (if not all) will be str ipped. On occasion some details may remain that could be pertinent to a case Actual examples of t his occurred during the study when the original size of the im age was not changed and the IMEI number and brand of the mobile used to transfer images was exposed This study experiments with the different ways to grab images from Flickr and Google Plus, evaluates the chang es and attempts downloading images using different internet browsers that may potentially be more successful at acquiring data than others. Obtaining Protected Image s There are only two sure fire ways to p rotect your images on Flickr and Go ogle Plus, 1. Make them private 2. Do not upload them. The bottom line is: if a photo can be seen in a web browser, it can be downloaded, copied or saved. To get ar ound a restricted image on Flickr, Google Plus and any image on the web, one can simply right click (in some browsers) and select inspect image and i n that box, is an icon on the top left that looks like a square with a pointer in it. When you click on it and hover the mouse over the image (the image will turn blue), the HTML code responsible for displaying that page appears as highlighted delete that string of comman ds. That brings down the protection Right click the image. The image is now able to be saved to computer as a JPEG

PAGE 21

This cannot be done on a mobile phone, and when performed on a desktop or laptop, strips most Figure 4. Screen capture : disarming image on Goog le Plus to save as JPEG Flickr Settings B y default, all images on Flickr are public. When a n image is public, anyone may view and download it. A user may choose to restrict access to their photos by making their accounts private, or alternatively, a user may apply certain restrictions that inhibit a ability to download. up to the original size. In an attempt to achieve what technique is the best practice to download protected images on Flickr, yielding the best results, the following was tested : 1. Download ing an image while signed in to the account. 2. Download ing an image while logged out of the account ; public download permitted. 3. Download ing an image while logged out of the account ; public download disabled. 4. Dr. Grigoras download ing optional size links 500 x 292 or larger.

PAGE 22

Because Flickr asserts that original images are kept intact bit per bit it was pre dicted that imag es allowed to be downloaded from this platform would not be altered while on the contrary, performing special methods to download protected images, would Table 1 below compiles the tests conducted and provides a basic summary : Table 1. Flickr: Proposed Method Summary

PAGE 23

Google Plus Settings the page that opens you can search for JPG opy / paste the URL into a browser U RL bar T hat will bring up the image. Right click on the image, and s ave as a JPG.

PAGE 24

Figure 5. Screen capture of view source page The type of internet browser used during the seizing of images on Google Plus also became of interest in the observation that methods of downloading images using various internet browsers were producing diverse results in the EXIF data. To explore this area further, and to explore the effects that electronic devices may also have, the following was tested on images : 1. Upload and download via desktop ; Internet Explorer logged in 2. Upload and down l oad via desktop ; Microsoft Edge ; logged out 3. Upload and dow nload via desktop ; Microsoft Edge ; logged in 4. Upload from desktop; download to desktop ; Moz illa FireFox ; logged out 5. Upload from desktop; download to desktop ; Moxilla FireFox with DownloadThemAll plugin 6. U pload and d ownload via mobile phone

PAGE 25

7. Upl oad from desktop and download to mobile phone 8. Upload from mobile phone; down load to desktop ; Microsoft Edge ; logged out 9. Upload from mobile phone; down load to desktop ; Internet Explorer; logged out 10. Upload from mobile phone ; down load to desktop ; Microsoft Edge ; logged in 11. Upload from mobile phone; down load to desktop ; Internet Explorer ; logged in 12. Upload from desktop ; download to desktop Dr. Grigoras using Mozilla Firefox 13. Upload from desktop ; download to desktop ; Ch rome / WebP to JPG The table below is a compilation of the techniques applied to download images and a brief summary of those results : Table 2. Google Plus Metho d Summary

PAGE 26

Upload from desktop ; Download to Desktop; Chrome / WebP to JPG

PAGE 27

CHAPTER V FLICKR RESULTS As predicted, Flickr preserve d images as long a s two things happen ed : 1. T he account holder allowed download s of their original images and/or 2. Y ou are the account holder and logged in. This was the case for both accomplishing the task on a mobile ph one or desktop by anyone. Table 3 demonstrates (in partial) an example of preserved meta data in the EXIFtool results after downloading an image with permissions. More impo rtantly, hash values are useful in verifying the integrity of a digital file and Figure 6 shows how even hash values match after being downloaded from this platform under these settings. The only notable change in the meta data is renaming of the images It appears that an image downloaded to a mobile phone is r enamed to the date it is being sav ed, followed by a nother segment of numbers + .jpg Images downloaded to desktop are saved as a string of numbers, followed by _o.jpg. While modifying any content within an image will change the hash val ue renaming a file does not. UPLD / DNLD Mobile P hone UPLD / DNLD Desktop ExifToolVersion = 9.90 FileName = 36070463433_2075a560c7_o.jpg Directory = FileSize = 1671607 FileModifyDate = 1503958279.45154 FileAccessDate = 1503958283.05747 FileCreateDate = 1503958283.05747 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP1 (18133 bytes): ExifByteOrder = MM + [IFD0 directory with 9 entries] | 0) GPSInfo (SubDirectory) -> | + [GPS directory with 8 entries] ExifToolVersion = 9.90 FileName = 36880336625_cea97a3838_o.jpg Directory = FileSize = 1238212 FileModifyDate = 1503964097.71911 FileAccessDate = 1503964101.56196 FileCreateDate = 1503964101.56196 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP1 (1330 bytes): ExifByteOrder = MM + [IFD0 directory with 10 entries] | 0) ModifyDate = 2015:05:07 10:30:54

PAGE 28

| | 0) GPSLatitudeRef = N | | 1) GPSLatitude = 39 44 8.2269 (39/1 44/1 82269/10000) | | 2) GPSLongitudeRef = W | | 3) GPSLongitude = 104 59 20.0646 (104/1 59/1 200646/10000) | | 4) GPSAltitudeRef = 0 | | 5) GPSAltitude = 1623 (1623000/1000) | | 6) GPSTimeStamp = 17 56 13 (17/1 56/1 13/1) | 1) GPSInfo (SubDirectory) -> | + [GPS directory with 8 entries] | | 0) GPSDateStamp = 2015:05:07 | | Warning = Tag ID 0x0005 out of sequence in GPS | | 1) GPSAltitudeRef = 0 | | Warning = Tag ID 0x0003 out of sequence in GPS | | 2) GPSLongitudeRef = W Figure 6. Flickr version (top) and original image (bottom) hash values match

PAGE 29

Flickr PROTECTED IMAGES upload from mobile phone, download to desktop download optional sizes from Flickr's size links Uploading and Downloading from desktop

PAGE 30

So what observations should one consider w hen analyzing images from Flickr ? Underneath is a simplified summ a ry of the results and what observations stood out s ome of which relate and are similar to the discoveries exposed in Pippin M. (2016) research as it pertains to image resizing, image renam ing and desktop vs mobile phone downloads (p. 28 31.) Following the summary, a d iagram ( Figure 8 ) has been provided that further summarizes Flickr image storage and processing in more detail Summary of Images Permitting Downloads 1. A re renamed to a string of numbers fol lowed by _o.jpg when downloaded to desktop 2. Images downloaded to mobile phone a re renamed to the date in the which the image was saved, followed by more segmented groups of numbers + .jpg 3. All original metadata is intact whether downloa ded to mobile phone or desktop Summary of Images Protected From Public Downloads 4. It is no t possible to download images to mobile phone if they are protect ed 5. When an image is uploaded from mobile phone, the image results in 1024 pixels in width and retain s the original image aspect ratio. 6. When an image is uploaded from desktop the image results in 2048 pix els in width and retains the original image aspect ratio. 7. If an image was 1024 pixel width EXIF data revealed: optimized by JPEGmini 3.13.3.15 0xad6b4f35 8. If an image was 2048 p ixel width EXIF data revealed: Optimized by JPEGmini 3.13.3.15 0x3cf38bdf

PAGE 31

9. The size of the image also appears to influence the name change: images in 2048 pixel width were renamed as a string of numbers ending in _k.jpg, 1024 pixel wi dth were renamed as a string of numbers ending in _b.jpg. 10. The renaming of images (string of numbers and all) match whether or not the image was dow nlo aded via s size option link OR if the imag e was saved via inspecting the ori ginal image to get past the protection For example, image 20140930_115613_Burst04.jpg was renamed to 36070463433_f58a95a391_k.jpg when saving an image via size link or by way of inspecting the image (which by default saved the image to size 1152 x 2048.) SUMMARY Images with download permissions OR account holder logged in; both mobile phone and desktop RE SULTS DESKTOP Name Change* 36070463433_2075a560c7_o.jpg MOBILE PHONE Name Change* 2017 08 28_05 19 45.jpg DESKTOP AND MOBILE PHONE No alterations in M etadata, Quantization Tables (hash value = match)

PAGE 32

SUMMARY Upload / download via desktop, download not permitted RE SULTS Cannot save unless protection (HTML) is deleted Download default size: 1152 x 2048 Optimized by JPEGmini 3.13.3.15 0x3cf38bdf Name Change* 36070463433_f58a95a391_k.jpg Altered* M etadata, Quantization Tables (hash values = no match) Original 4160 x 2340 / Download 1152 x 2048 = 1.77 Aspect Ratio SUMMARY Upload from mobile phone, download to desktop, download not permitted RESULTS Cannot save unless protection (HTML) is deleted Download default size: 775 x 1024 Optimized by JPEGmini 3.13.3.15 0xad6b4f35 Nam e Change* 36880336625_11ff6133fe_b.jpg Altered* Metadata, Quantization Tables (hash values = no match) Original 1719 x 2270 / Download 775 x 1024 = 1.32 Aspect Ratio

PAGE 33

SUMMARY Download 20140930_115613_Burst04.jpg via Flickr size link 1152 x 2048 VS. delete HTML to save protected image onto desktop RESULTS DOWNLOAD IMAGE VIA FLICKR Optimized by JPEGmini 3.13.3.15 0x3cf38bdf Name Change* 36070463433_f58a95a391_k.jpg VS VS SAVE PROTECTED IMAGE TO DESKTOP VIA INSPECT IMAGE Saved to default size: 1152 x 2048 Optimized by JPEGmini 3.13.3.15 0x3cf38bdf Name Change* 36070463433_f58a95a391_k.jpg ( name change corresponds with image SUMMARY Download 20150507_093353_HDR~2~2.jpg via Flickr size link 775 x 1024 VS. delete HTML to save protected image onto RESULTS DOWNLOAD IMAGE VIA FLICKR Optimized by JPEGmini 3.13.3.15 0xad6b4f35 Name Change* 36880336625_11ff6133fe_b.jpg VS VS SAVE PROTECTED IMAGE TO DESKTOP VIA INSPECT IMAGE Saved to default size 775 x 1024 Optimized by JPEGmini 3.13.3.15 0xad6b4f35 Name Change* 36880336625_11ff6133fe_b.jpg ( name change corresponds with image Figure 8 Summary of Flickr Analysis Results

PAGE 34

ExifToolVersion = 9.90 FileName = 20160315_105057_HDR 2.webp Directory = FileSize = 78946 FileModifyDate = 1509245302.85195 FileAccessDate = 1509245227.10217 FileCreateDate = 1509245301.97813 FilePermissions = 33206 FileType = WEBP MIMEType = image/webp RIFF 'VP8X' chunk (10 bytes of data):

PAGE 35

VP8X (SubDirectory) -> + [BinaryData directory | ImageWidth = 2516583062 | ImageHeight = 169472 RIFF 'VP8 chunk (78866 bytes of data): VP8Bitstream (SubDirectory) -> + [BinaryData directory | VP8Version = 0 | ImageWidth = 663 | HorizontalScale = 0 | ImageHeight = 663 | VerticalScale = 0 RIFF 'EXIF' chunk (34 bytes of data): EXIF (SubDirectory) -> + [TIFF directory] | ExifByteOrder = II | + [IFD0 directory with 1 entries] | | 0) Software = Google

PAGE 36

ExifToolVersion = 9.90 FileName = 20160315_105057_HDR 2.jpg Directory = FileSize = 1244487 FileModifyDate = 1509252181.91304 FileAccessDate = 1509252176.48793 FileCreateDate = 1509252181.39927 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEG APP1 (106 bytes): ExifByteOrder = II + [IFD0 directory with 3 entries]

PAGE 37

| 0) Orientation = 1 | 1) Software = Google | 2) ExifOffset (SubDirectory) -> | + [ExifIFD directory with 3 entries] | | 0) ExifVersion = 0220 | | 1) ExifImageWidth = 2340 | | 2) ExifImageHeight = 2340 JPEG DQT (65 bytes): JPEG DQT (65 bytes): JPEG SOF0 (15 bytes): ImageWidth = 2340 ImageHeight = 2340 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (29 bytes): JPEG DHT (179 bytes): JPEG DHT (29 bytes): JPEG DHT (179 bytes): JPEG SOS Samsung trailer (77 bytes at offset 0x12fcfa): SamsungTrailer_0x0a41Name = BackupRestore_Data SamsungTrailer_0x0a41 = 355022071107283_698

PAGE 40

In addition to the observations made in the application of different download methods on various internet browsers, here are some other Google Plus behaviors to be aware of : 1. Images that retained their original pixel dimensions after downloading them from Google Plus are indeed an exact pixel replica of the original as shown in their quantization tables ( Figure 1 5 ) CFA Analysis ( Figure 1 6 ) and Compression Level Analysis ( Figure 1 7 )

PAGE 41

Original Image Quantization Table Downloaded Image Quantization Table Figure 15. Quantization Table Comparison of Image Downloaded from Google Plus Using Best Practices

PAGE 42

Original Image CFA Analysis Downloaded Image CFA Analysis Figure 16. CFA Comparison Analysis Match Exactly Using Best Practices Original Image CLA Analysis Downloaded Image CLA Analysis Figure 17. CLA Comparison Shows No Sign of Compression Using Best Practices

PAGE 43

2. Google Plus save d image s as either Photo.jpg and/or Photo Google+.jpg as a public user that does not own the account The diagrams provided in this research paper list when images were saved as their original names, however this will never be the case during real inve stigations. The computer conducting the test was naming the images by their original name due to information being stored to its browser and not being cached. 3. All downloaded images ha d the same aspect ratio as the originals. 4. Images that were 1060 pixel w idth, correlate with images downloaded to mobile phone I mages t hat were 663 pixel width correlate with images download ed to desktop 5. Images downloaded from Google Plus con tain : Software = Google in the EXIF and hex data (Diagram of results in Figure 18 .) SUMMARY Upload from desktop; Download by desktop; Moxilla FireFox with DownloadThemAll plugin RESULTS Retained same Quantization Tables as original image 2340 x 2340 = same as the original image Name Change* saves as Photo Google+.jpg Software: Google in EXIF Data SUMMARY Upload from desktop; Download to Desktop; Using chrome and saving to JP G RESULTS Retained same Quantization Tables as original image 2340 x 2340 = same as the original image Saves as original name (20160315_105057_HDR 2.jpg) Software: Google in EXIF Data

PAGE 44

SUMMARY Upload and Download from desktop Internet Explorer RESULTS Original 4160 x 2340 / Download 663 x 1178 = 1.77 Aspect Ratio Saved as original name (20140930_115613_Burst04.jpg) Altered* Quanti zation Tables Software: Google in EXIF Data SUMMARY Upload and Download to cell Phone RESULTS Original 4160 x 2340 / Download 1060 x 596 = 1.77 Aspect Ratio Saved as original name (20150116_182100_HDR.jpg) Altered* Quanti zation Tables Software: Google in EXIF Data SUMMARY Upload from cell phone; download to desktop RESULTS Original 1719 x 2270 / Download 663 x 875 = 1.32 Aspect Ratio Saved as original name (20150507_093353_HDR~2~2.jpg) Altered* Quanti zation Tables Software: Google in EXIF Data SUMMARY Upload from Desktop and download to Cell Phone RESULTS Original 865 x 1221 / Download 1060 x 1496 = 1.4 Aspect Ratio Saved as original name (20150305_145611_HDR 2 3 2.jpg) Altered* Quanti zation Tables Software: Google in EXIF Data Figure 18 Summary of Google Plus Analysis Results CHAPTER VI CONCLUSION AND FUTURE RESEARCH To recap, digital image evidence from social media networks is useful in many types of criminal investigations and court proceedings. Investigative leads, for instance, could be solving

PAGE 45

timelines of an event or learning details about the account holder. Th is work aim ed to perform an experimental study on Flickr and Google Plus to understand the base behavior of these social media platforms and inform best practices for forensic investigations It illustrate d the potential ways for acquiring information abou t digital images and interpreting the metadata and, in the process, concludes two core findings : firs t being that Flickr preserves images 100% as long as the account user allows public downloads of their original images. If the account user does not permit this, it is not possible to obtain authentic information and data from images downloaded from Flickr other than the minor observations listed in this research The second vital finding is that Google Plus preserves exact pixel dimensions of original images and an y unique data that may be embedded in the extension of image file s providing best practices are followed: 1. Use Internet Explorer or Chrome to download images from Google Plus 2. the URL containing the JPG image, copy and paste URL in browser, right click the image At this point, the image will be saved as a JPG and in its exact size as the original. Additionally, should an image contain unique data in the footer of its file structure, the information will appear in the hex data as well as in the EXIF data 3. in will easily do all of this in less steps and acquire the same optimal results more quickly Being aware of these core findings and following these best practices will help spot evidence more efficiently and assure that investigators and forensic analysts are obtaining images from these platforms in those most optim al way.

PAGE 46

The process of downloading an image will usually result in stripping meaningful data S hould an investigation demand further interpretation of behaviors particular to Flickr and Google Plus in order to build a case how images are resized and renamed are other key factors to consider. This study confirms that Flickr works similar to Facebook a ccordin g to related research conducted by M. Pippins (2016 .) Denoting that the size of the image influence s how an image is named : images in 2048 pixel width were renamed as a string of numbers ending in _k.jpg and 1024 pixel width were renamed as a strin g of numbers ending in _b.jpg. Finally, image settings that allowed public downloads were saved as a string of numbers followed by _o.jpg. To determine whether or not this extension is related to a certain size, future research using a bigger pool of test images would need to be analyzed. Google Plus, rename s images either Photo.jpg o r the Photo Google+.html and/or .web p One last suggestion is to look for the data. This is an obvious indicator that the images are associated with the Google Plus platform. Future Research WebP is an emerging image format that merits future exploration especially as new browsers begin to adopt the format. Because it is potentially the best format to obtain high image quality, it may assist investigations involving online images. Specifically, is it possible to obtain lossless versions of WebP formatted images from online platforms and if so how?

PAGE 47

11. 12. 13.

PAGE 48

14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25.

PAGE 49

26. 27.

PAGE 50

Original Image Image After Download ExifToolVersion = 9.90 FileName = 20140930_115613_Burst04.jpg Directory = FileSize = 1671607 FileModifyDate = 1503888971.87222 FileAccessDate = 1503299726 FileCreateDate = 1503299726 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP1 (18133 bytes): ExifByteOrder = MM + [IFD0 directory with 9 entries] | 0) GPSInfo (SubDirectory) -> | + [GPS directory with 8 entries] | | 0) GPSLatitudeRef = N | | 1) GPSLatitude = 39 44 8.2269 (39/1 44/1 82269/10000) | | 2) GPSLongitudeRef = W | | 3) GPSLongitude = 104 59 20.0646 (104/1 59/1 200646/10000) | | 4) GPSAltitudeRef = 0 | | 5) GPSAltitude = 1623 (1623000/1000) | | 6) GPSTimeStamp = 17 56 13 (17/1 56/1 13/1) | | 7) GPSDateStamp = 2014:09:30 | Warning = Tag ID 0x01 12 out of sequence in IFD0 | 1) Orientation = 6 | Warning = Tag ID 0x0110 out of sequence in IFD0 | 2) Model = LG D850 | 3) ExifOffset (SubDirectory) -> | + [ExifIFD directory with 19 entries] | | 0) InteropOffset (SubDirectory) -> | | + [InteropIFD directory with 2 entries] | | | 0) InteropIndex = R98 ExifToolVersion = 9.90 FileName = 36070463433_f58a95a391_k.jpg Directory = FileSize = 354532 FileModifyDate = 1505105943.89992 FileAccessDate = 1505105938.72692 FileCreateDate = 1505105943.5694 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 1 | XResolution = 72 | YResolution = 72 JPEG COM (43 bytes): Comment = Optimized by JPEGmini 3.13.3.15 0x3cf38bdf JPEG DQT (65 bytes): JPEG DQT (65 bytes): JPEG SOF0 (15 bytes): ImageWidth = 1152 ImageHeight = 2048 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (27 bytes): JPEG DHT (90 bytes): JPEG DHT (25 bytes): JPEG DHT (45 bytes): JPEG DRI (2 bytes): JPEG SOS ( END )

PAGE 51

| | | 1) InteropVersion = 0100 | | Warning = Tag ID 0x9004 out of sequence in ExifIFD | | 1) CreateDate = 2014:09:30 11:56:13 | | 2) ColorSpace = 1 | | Warning = Tag ID 0x9003 out of sequence in ExifIFD | | 3) DateTimeOriginal = 2014:09:30 11:56:13 | | 4) FlashpixVersion = 0100 | | Warning = Tag ID 0x9207 out of sequence in ExifIFD | | 5) MeteringMode = 2 | | Warning = Tag ID 0x9204 out of sequence in ExifIFD | | 6) ExposureCompensation = 0 (0/1) | | 7) ExifImageHeight = 2340 | | Warning = Tag ID 0x9000 out of sequence in ExifIFD | | 8) ExifVersion = 0220 | | 9) ExifImageWidth = 4160 | | Warning = Tag ID 0x920a out of sequence in ExifIFD | | 10) FocalLength = 3.97 (3970/1000) | | 11) DigitalZoomRatio = 1 (100/100) | | Warning = Tag ID 0x9209 out of sequence in ExifIFD | | 12) Flash = 0 | | 13) WhiteBalance = 0 | | Warning = Tag ID 0x829a out of sequence in ExifIFD | | 14) ExposureTime = 0.001131221719 (1/884) | | 15) ISO = 50 | | 16) ComponentsConfiguration = 1 2 3 0 | | Warning = Tag ID 0x829d out of sequence in ExifIFD | | 17) FNumber = 2.4 (240/100) | | 18) MakerNoteUnknown (SubDirectory) -> | | | Warning = [minor] Unrecognized MakerNotes | Warning = Tag ID 0x0213 out of sequence in IFD0 | 4) YCbCrPositioning = 1 | Warning = Tag ID 0x011b out of seque nce in IFD0 | 5) YResolution = 72 (72/1) | 6) ResolutionUnit = 2 | Warning = Tag ID 0x011a out of sequence in IFD0

PAGE 52

| 7) XResolution = 72 (72/1) | Warning = Tag ID 0x010f out of sequence in IFD0 | 8) Make = LG Electronics + [IFD1 directory with 7 entries] | 0) YResolution = 72 (72/1) | 1) ResolutionUnit = 2 | Warning = Tag ID 0x011a out of sequence in IFD1 | 2) XResolution = 72 (72/1) | Warning = Tag ID 0x0112 out of sequence in IFD1 | 3) Orientation = 6 | Warning = Tag ID 0x0103 out of sequence in IFD1 | 4) Compression = 6 | 5) ThumbnailOffset = 1316 | 6) ThumbnailLength = 16811 JPEG DQT (130 bytes): JPEG SOF0 (15 bytes): ImageWidth = 4160 ImageHeight = 2340 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (416 bytes): JPEG SOS Quality Factors of Original JPEG Vs. Quality Factors of JPEG Compression After Flickr Original Luminance 2 2 1 2 3 6 7 9 2 2 2 3 4 8 8 8 2 2 2 3 6 8 10 8 2 2 3 4 7 12 11 9 3 3 3 5 8 10 15 14 11 3 5 8 9 11 15 16 13 7 9 11 12 14 17 17 14 10 13 13 14 16 14 14 14 Original Chrominance 2 2 3 3 7 14 14 14 14 3 3 4 9 14 14 14 14 3 4 8 14 14 14 14 14 7 9 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 Post Download Luminance 4 3 1 4 6 9 12 15 3 3 3 5 6 14 14 13 2 3 3 4 6 9 14 17 13 3 3 4 5 7 12 21 19 15 4 4 5 9 13 16 26 24 18 6 6 8 13 15 19 24 27 22 1 12 15 18 21 24 29 29 24 17 22 23 23 27 24 24 24 Post Download Chrominance 2 4 4 6 11 24 24 24 24 4 5 6 15 24 24 24 24 6 6 13 24 24 24 24 24 11 15 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24

PAGE 53

EXIF Data and Quality Factor : O riginal Image vs. Image Upload ed from Mobile Phon e, Download ed to Desktop, Public Download Not Permitted Original Image Image After Download ExifToolVersion = 9.90 FileName = 20150507_093353_HDR~2~2.jpg Directory = FileSize = 1238212 FileModifyDate = 1503888970.69028 FileAccessDate = 1503299680 FileCreateDate = 1503299680 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP1 (1330 bytes): ExifByteOrder = MM + [IFD0 directory with 10 entries] | 0) ModifyDate = 2015:05:07 10:30:54 | 1) GPSInfo (SubDirectory) -> | + [GPS directory with 8 entries] | | 0) GPSDateStamp = 2015:05:07 | | Warning = Tag ID 0x0005 out of sequence in GPS | | 1) GPSAltitudeRef = 0 | | Warning = Tag ID 0x0003 out of sequence in GPS | | 2) GPSLongitudeRef = W | | 3) GPSLongitude = 104 53 45.7068 (104/1 53/ 1 457068/10000) | | Warning = Tag ID 0x0001 out of sequence in GPS | | 4) GPSLatitudeRef = N | | 5) GPSTimeStamp = 15 33 51 (15/1 33/1 51/1) | | Warning = Tag ID 0x0006 out of sequence in G PS | | 6) GPSAltitude = 1691 (1691000/1000) | | Warning = Tag ID 0x0002 out of sequence in GPS | | 7) GPSLatitude = 39 39 18.2983 (39/1 39/1 182983/10000) | Warning = Tag ID 0x0110 out of sequence in IFD0 | 2) Model = LG D850 | 3) YCbCrPositioning = 1 | Warning = Tag ID 0x0128 out of sequence in ExifToolVersion = 9.90 FileName = 36880336625_11ff6133fe_b.jpg Directory = FileSize = 390291 FileModifyDate = 1507741038.286 FileAccessDate = 1507741033.3443 FileCreateDate = 1507741038.00875 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 1 | XResolution = 72 | YResolution = 72 JPEG COM (43 bytes): Comment = Optimized by JPEGmini 3.13.3.15 0xad6b4f35 JPEG DQT (65 bytes): JPEG DQT (65 bytes): JPEG SOF0 (15 bytes): ImageWidth = 775 ImageHeight = 1024 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (28 bytes): JPEG DHT (92 bytes): JPEG DHT (26 bytes): JPEG DHT (60 bytes): JPEG SOS ( END )

PAGE 54

IFD0 | 4) ResolutionUnit = 2 | Warning = Tag ID 0x011b out of sequence in IFD0 | 5) YResolution = 72 (72/1) | Warning = Tag ID 0x0112 out of sequence in IFD0 | 6) Orientation = 1 | 7) ExifOffset (SubDirectory) -> | + [ExifIFD directory with 19 entries] | | 0) ColorSpace = 1 | | Warning = Tag ID 0x9004 out of sequence in ExifIFD | | 1) CreateDate = 2015:05:07 09:33:53 | | Warning = Tag ID 0x829d out of sequence in ExifIFD | | 2) FNumber = 2.4 (240/100) | | 3) FocalLength = 3.97 (3970/1000) | | 4) WhiteBalance = 0 | | Warning = Tag ID 0xa002 out of sequence in ExifIFD | | 5) ExifImageWidth = 4160 | | Warning = Tag ID 0x9207 out of sequence in ExifIFD | | 6) MeteringMode = 2 | | Warning = Tag ID 0x9003 out of sequence in ExifIFD | | 7) DateTimeOriginal = 2015:05:07 09:33:53 | | 8) ComponentsConfiguration = 1 2 3 0 | | 9) ExifImageHeight = 2340 | | Warning = Tag ID 0x9209 out of sequence in ExifIFD | | 10) Flash = 0 | | Warning = Tag ID 0x9000 out of sequence in ExifIFD | | 11) ExifVersion = 0220 | | 12) InteropOffset (SubDirectory) -> | | + [ InteropIFD directory with 2 entries] | | | 0) InteropIndex = R98 | | | 1) InteropVersion = 0100 | | Warning = Tag ID 0x9204 out of sequence in ExifIFD | | 13) ExposureCompensation = 0 (0/1) | | Warning = Tag ID 0x8827 out of sequence in ExifIFD | | 14) ISO = 50 | | 15) FlashpixVersion = 0100

PAGE 55

| | Warning = Tag ID 0x927c out of sequence in ExifIFD | | 16) MakerNoteUnknown (SubDirectory) -> | | | Warning = [minor] Unrecognized MakerNotes | | 17) DigitalZoomRatio = 1 (100/ 100) | | Warning = Tag ID 0x829a out of sequence in ExifIFD | | 18) ExposureTime = 0.01666666667 (1/60) | Warning = Tag ID 0x011a out of sequence in IFD0 | 8) XResolution = 72 (72/1) | Warning = Tag ID 0x010f out of sequence in IFD0 | 9) Make = LG Electronics + [IFD1 directory with 5 entries] | 0) YResolution = 72 (72/1) | Warning = Tag ID 0x0112 out of sequence in IFD1 | 1) Orientation = 6 | Warning = Tag ID 0x0103 out of sequence in IFD1 | 2) Compression = 6 | 3) ResolutionUnit = 2 | Warning = Tag ID 0x011a out of sequence in IFD1 | 4) XResolution = 72 (72/1) JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEG DQT (65 bytes): JPEG DQT (65 bytes): JPEG SOF0 (15 bytes): ImageWidth = 1719 ImageHeight = 2270 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (29 bytes): JPEG DHT (179 bytes): JPEG DHT (29 bytes): JPEG DHT (179 bytes): JPEG SOS

PAGE 56

Quality Factors of Original JPEG Vs. Quality Factors of JPEG Compression After Flickr Original Luminance 3 2 2 3 5 8 10 12 2 2 2 3 4 5 12 12 11 3 3 3 5 8 11 14 11 3 3 3 4 6 10 17 16 12 3 4 4 7 11 14 22 21 15 5 7 11 13 16 21 23 18 10 13 16 17 21 24 24 20 14 18 19 20 22 20 21 20 Original Chrominance 2 3 4 5 9 20 20 20 20 4 4 5 13 20 20 20 20 5 5 11 20 20 20 20 20 9 13 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Post Download Luminance 3 1 1 3 5 8 11 13 3 3 3 3 2 5 13 13 11 3 3 3 5 8 12 15 12 3 3 3 5 6 11 19 17 13 3 4 5 8 12 14 23 22 16 5 8 11 14 17 22 24 19 10 14 16 19 22 26 26 21 15 19 20 21 24 21 22 21 Post Download Chrominance 2 3 4 5 10 21 21 21 21 4 5 5 14 21 21 21 21 5 5 12 21 21 21 21 21 10 14 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 21 Download from Flickr Download via deleting HTML ExifToolVersion = 9.90 FileName = 36070463433_f58a95a391_k.jpg Directory = FileSize = 354532 FileModifyDate = 1506045673.60251 FileAccessDate = 1506137043.53627 FileCreateDate = 1506137043.53627 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 1 | XResolution = 72 | YResolution = 72 JPEG COM (43 bytes): Comment = Optimized by JPEGmini 3.13.3.15 0x3cf38bdf ExifToolVersion = 9.90 FileName = 36070463433_f58a95a391_k.jpg Directory = FileSize = 354532 FileModifyDate = 1505105943.89992 FileAccessDate = 1505105938.72692 FileCreateDate = 1505105943.5694 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 1 | XResolution = 72 | YResolution = 72 JPEG COM (43 bytes):

PAGE 57

JPEG DQT (65 bytes): JPEG DQT (65 bytes): JPEG SOF0 (15 bytes): ImageWidth = 1152 ImageHeight = 2048 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (27 bytes): JPEG DHT (90 bytes): JPEG DHT (25 bytes): JPEG DHT (45 bytes): JPEG DRI (2 bytes): JPEG SOS Comment = Optimized by JPEGmini 3.13.3.15 0x3cf38bdf JPEG DQT (65 bytes): JPEG DQT (65 bytes): JPEG SOF0 (15 bytes): ImageWidth = 1152 ImageHeight = 2048 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (27 bytes): JPEG DHT (90 bytes): JPEG DHT (25 bytes): JPEG DHT (45 bytes): JPEG DRI (2 bytes): JPEG SOS Download from Flickr Download via Deleting HTML ExifToolVersion = 9.90 FileName = 36880336625_11ff6133fe_b.jpg Directory = FileSize = 390291 FileModifyDate = 1506045257.60762 FileAccessDate = 1506137043.72379 FileCreateDate = 1506137043.72379 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 1 | XResolution = 72 | YResolution = 72 JPEG COM (43 bytes): Comment = Optimized by JPEGmini 3.13.3.15 0xad6b4f35 JPEG DQT (65 bytes): JPEG DQT (65 bytes): ExifToolVersion = 9.90 FileName = 36880336625_11ff6133fe_b.jpg Directory = FileSize = 390291 FileModifyDate = 1507741038.286 FileAccessDate = 1507741033.3443 FileCreateDate = 1507741038.00875 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 1 | XResolution = 72 | YResolution = 72 JPEG COM (43 bytes): Comment = Optimized by JPEGmini 3.13.3.15 0xad6b4f35 JPEG DQT (65 bytes): JPEG DQT (65 bytes):

PAGE 58

JPEG SOF0 (15 bytes): ImageWidth = 775 ImageHeight = 1024 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (28 bytes): JPEG DHT (92 bytes): JPEG DHT (26 bytes): JPEG DHT (60 bytes): JPEG SOS JPEG SOF0 (15 bytes): ImageWidth = 775 ImageHeight = 1024 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (28 bytes): JPEG DHT (92 bytes): JPEG DHT (26 bytes): JPEG DHT (60 bytes): JPEG SOS

PAGE 59

ExifToolVersion = 9.90 FileName = 20160315_105057_HDR~2.jpg Directory = FileSize = 122760 FileModifyDate = 1507606360.91573 FileAccessDate = 1509253906.66322 FileCreateDate = 1509253906.39457 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEG APP1 (40 bytes): ExifByteOrder = II + [IFD0 directory with 1 entries] | 0) Software = Google JPEG DQT (130 bytes): JPEG SOF0 (15 bytes): ImageWidth = 663 ImageHeight = 663 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (27 bytes): JPEG DHT (89 bytes): JPEG DHT (25 bytes): JPEG DHT (56 bytes): JPEG SOS

PAGE 60

ExifToolVersion = 9.90 FileName = 20160315_105057_HDR~2.jpg Directory = FileSize = 122760 FileModifyDate = 1509254820.74757 FileAccessDate = 1509254820.73194 FileCreateDate = 1509254820.469 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEG APP1 (40 bytes): ExifByteOrder = II + [IFD0 directory with 1 entries] | 0) Software = Google JPEG DQT (130 bytes): JPEG SOF0 (15 bytes): ImageWidth = 663 ImageHeight = 663 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (27 bytes): JPEG DHT (89 bytes): JPEG DHT (25 bytes): JPEG DHT (56 bytes): JPEG SOS ExifToolVersion = 9.90

PAGE 61

FileName = 20150507_093353_HDR_2_2.jpg Directory = FileSize = 1236988 FileModifyDate = 1510466131.77645 FileAccessDate = 1510466127.50872 FileCreateDate = 1510466131.34912 FilePermissions = 33206 FileType = JPEG MIMEType = image/jpeg JPEG APP0 (14 bytes): + [BinaryData directory | JFIFVersion = 1 1 | ResolutionUnit = 0 | XResolution = 1 | YResolution = 1 JPEG APP1 (106 bytes): ExifByteOrder = II + [IFD0 directory with 3 entries] | 0) Orientation = 1 | 1) Software = Google | 2) ExifOffset (SubDirectory) -> | + [ExifIFD directory with 3 entries] | | 0) ExifVersion = 0220 | | 1) ExifImageWidth = 1719 | | 2) ExifImageHeight = 2270 JPEG DQT (65 bytes): JPEG DQT (65 bytes): JPEG SOF0 (15 bytes): ImageWidth = 1719 ImageHeight = 2270 EncodingProcess = 0 BitsPerSample = 8 ColorComponents = 3 JPEG DHT (29 bytes): JPEG DHT (179 bytes): JPEG DHT (29 bytes): JPEG DHT (179 bytes): JPEG SOS