Digital image forensics jargon (explained)

11 June, 2019


Digital image forensics jargon (explained)

Digital image forensics means different things in different contexts. To avoid confusion, we’ve compiled a bunch of associated terms and their meanings.

Image forensics glossary

  • Image forensics (academic)
  • Image forensics (law enforcement)
  • Data carving
  • Targeted collection
  • Exif tools
  • Watermarking
  • Steganography
  • Tampering detection

Image forensics (academic)

The academic definition of image forensics focuses on an image’s authenticity and origin. This is usually applied to cases of forgery.

Image forensics (law enforcement)

The law enforcement definition of image forensics is much broader. It too focuses on image authenticity and origin, but also includes image content.

Check out Amped Software CEO and Founder, Martino Jerian’s discussion of this

Data carving

Data carving focuses on the preservation of image files in their original forms. For example, when law enforcement seizes a suspect’s computer, they clone the drive. This creates an immutable copy, which prevents updating timestamps or overwriting deleted files.

Targeted collection

Targeted collection automates the identification of illegal images on a suspect’s device. For example, when a suspect is in custody, law enforcement has a limited period to charge a suspect. A device storing one million images may include hundreds of thousands of legal images. If an investigator performs the task manually, it may take weeks or months to discover an illegal image.

But software platforms like Griffeye, Cyan Forensics and Magnet Forensics identify suspect files within minutes. This means law enforcement can accelerate investigations while saving time and resources.

Exif tools

Exif tools extract metadata from different file types, including images. By extracting exif, investigators can discover data that’s not available in pixels. This includes timestamps, GPS and device identifiers like camera serial numbers. Exif data may also include information about software processes such as Photoshop. Exiftool is well-known for this.

We tailor the CameraForensics’s ExifExtractor to specific law enforcement use cases


Watermarking impregnates images with extra information. There are two types of watermarking: perceptible and imperceptible. Perceptible watermarks appear on copyrighted images. This occurs when the copyright owner tries to either:

  • Prevent unauthorised sharing


  • Highlight attribution

Imperceptible watermarks are often inserted for image authenticity or information hiding.


Steganography is the process of impregnating images with secret messages. Because plain text files are small, it’s easy to zip up extensive messages in a single image.

Tampering detection

Tampering detection proves whether an image is original or altered. One such technique is error level analysis (ELA). In a JPEG image, for example, compression levels should be similar. If they aren’t, tampering is evident.

To identify tampering at scale, you need a large image database. By checking images against the properties of originals, it’s easier to discover abnormalities.

Need help with your image forensics investigations?

Whether you’re looking for the subject, the scene or the device in an investigation, CameraForensics can help. Download our Tactical Licence to discover how.

Subscribe to the Newsletter