Best Practices for Image Content Analysis

16-I-001-1.2

Disclaimer Regarding Use of SWGDE Documents

SWGDE documents are developed by a consensus process that involves the best efforts of relevant subject matter experts, organizations, and input from other stakeholders to publish standards, requirements, best practices, guidelines, technical notes, positions, and considerations in the discipline of digital and multimedia forensics and related fields. No warranty or other representation as to SWGDE work product is made or intended.

SWGDE requests notification by email before or contemporaneous to the introduction of this document, or any portion thereof, as a marked exhibit offered for or moved into evidence in such proceeding. The notification should include: 1) The formal name of the proceeding, including docket number or similar identifier; 2) the name and location of the body conducting the hearing or proceeding; and 3) the name, mailing address (if available) and contact information of the party offering or moving the document into evidence. Subsequent to the use of this document in the proceeding please notify SWGDE as to the outcome of the matter. Notifications should be submitted via the SWGDE Notice of Use/Redistribution Form or sent to secretary@swgde.org.

From time to time, SWGDE documents may be revised, updated, deprecated, or sunsetted. Readers are advised to verify on the SWGDE website (https://www.swgde.org) they are utilizing the current version of this document. Prior versions of SWGDE documents are archived and available on the SWGDE website.

Redistribution Policy

SWGDE grants permission for redistribution and use of all publicly posted documents created by SWGDE, provided that the following conditions are met:

Redistribution of documents or parts of documents must retain this SWGDE cover page containing the Disclaimer Regarding Use.
Neither the name of SWGDE nor the names of contributors may be used to endorse or promote products derived from its documents.
Any reference or quote from a SWGDE document must include the version number (or creation date) of the document and also indicate if the document is in a draft status.

Requests for Modification

SWGDE encourages stakeholder participation in the preparation of documents. Suggestions for modifications are welcome and must be submitted via the SWGDE Request for Modification Form or forwarded to the Secretary in writing at secretary@swgde.org. The following information is required as a part of any suggested modification:

Submitter’s name
Affiliation (agency/organization)
Address
Telephone number and email address
SWGDE Document title and version number
Change from (note document section number)
Change to (provide suggested text where appropriate; comments not including suggested text will not be considered)
Basis for suggested modification

Intellectual Property

All images, tables, and figures in SWGDE documents are developed and owned by SWGDE, unless otherwise credited.

Unauthorized use of the SWGDE logo or document content, including images, tables, and figures, without written permission from SWGDE is a violation of our intellectual property rights.

Individuals may not misstate and/or over represent duties and responsibilities of SWGDE work. This includes claiming oneself as a contributing member without actively participating in SWGDE meetings; claiming oneself as an officer of SWGDE without serving as such; claiming sole authorship of a document; use the SWGDE logo on any material and/or curriculum vitae.

Any mention of specific products within SWGDE documents is for informational purposes only; it does not imply a recommendation or endorsement by SWGDE.

1. Purpose

The purpose of this document is to provide personnel with guidance regarding practices appropriate when performing photographic content analysis as a part of forensic image analysis. For the purposes of this document, photographic content analysis refers to forming an opinion about an image or the subjects/objects represented in the image.

2. Scope

For the purposes of this document, the word “image” refers to an imitation or representation of a subject or object derived from still photography or video.

This document provides basic information and best practices on the evidentiary value, methodology, results, and limitations when conducting photographic content analysis as a part of any forensic examination. The intended audience is image analysis examiners in a lab setting. Due to the variety of subjects/objects potentially represented in an image or video, this document includes but is not limited to all methods encountered in forensic photographic content analysis.

This document is not intended to be used as a step-by-step guide for conducting a proper forensic examination or reaching an opinion. This document should not be construed as legal advice.

3. Definitions

Content Analysis

The process of forming an opinion about an image. Targets for content analysis include, but are not limited to, the subjects/objects within an image; the conditions under which, or the process by which, the image was captured or created; the physical aspects of the scene (e.g., lighting or composition); and/or the origin of the image.

Physical Object

A thing or person to which action is directed

Class Characteristic

A feature of an object that is common to a group of objects

Distinguishing Characteristic

A feature of an object that contributes to differentiating that object from others of its class

4. Limitations

This document will not describe discipline-specific analytical techniques outside of image analysis or the limitations associated with them, only the process for performing image content analysis and the general manner used to formulate an opinion.

This document is not intended to be a training manual or a specific operating procedure. Examiners performing image content analysis should have sufficient training and experience in image science to allow the formation of an opinion. For further information, refer to SWGDE 15-M-001-1.2 [1].

This document is not all-inclusive and does not contain information related to specific products. This document should not be construed as legal advice.

5. Evidence Preparation

General guidelines concerning the preparation of evidence for content analysis are provided as follows:

Review the request for examination to determine the subject matter of the content analysis.
Based on the request for examination, determine if submitted imagery is available to complete requested analysis. Determine whether submitted imagery is of sufficient quality to complete the requested examination, or if the image quality will have an effect on the degree to which an examination can be completed.
If the specified quality criteria are not met, determine if it is possible to obtain additional images. If the specified quality criteria are not met, and additional images cannot be obtained, this may preclude the examiner from conducting an examination, or the results of the examination may be limited.
Identify the specific portion(s) of the image(s) that are the subject of the analysis.
Enhance images as necessary. Refer to SWGDE 15-M-002-1.0 [2].

6. Examination Method

There is no one specific methodology for content analysis. The methodology for analysis will primarily be derived to answer the requested examination. However, any methodology applied to content analysis should incorporate an analysis of the imagery, the cataloging of relevant features, an evaluation of the significance of the detected features, an evaluation of the limiting factors of the imagery, the formation of an opinion, and a verification of the analysis. The repeatability of the procedure and documentation of the workflow is of paramount importance.

Documentation should be performed contemporaneously.

Assess the contents of the image, to determine whether factors are present that can answer the examination request. The examination request may fall into one of the following categories:

Assess the contents of the image, to determine whether factors are present that can answer the examination request. The examination request may fall into one of the following categories:
- Analysis to determine the conditions under which, or the process by which, the image was captured or created. Examples include, but are not limited to, the limitations of the recording device, and the inclusion of artifacts based on the file format or compression. This can help to answer the question “How does the recording system affect what is visible in the scene?”
- Analysis to determine the physical aspects of the scene, including events captured. Examples include, but are not limited to, the lighting and composition of the scene, the presence of specific objects within the scene, a determination of the interaction between objects in the scene, and a description of events within a scene. This can help to answer the questions “Is a specific object visible in the scene?” or “What happened in the scene?”
- Analysis to determine the classification of an object within an image. Examples include, but are not limited to, the make, model, and year of a vehicle, the determination of a manufacturing logo, and the determination of the brand and model of a weapon. This can help to answer the question “What is the object visible in the scene?”
- Analysis to determine the location or setting of the image content. Examples may include either a general setting (e.g. Portland, Oregon) or a specific setting (e.g. Conference Room 23, the Northwest Corner). This can help answer the question “Where is the scene?”
Assess the image for features that hinder the ability to form an opinion. This may involve physical obstructions (e.g. a face mask on an individual), recording system limitations (e.g. subject to camera distance or resolution of the recording system), or digital artifacts (e.g. image information obscured by compression).
Assess the image for features that contribute to the ability to form an opinion and record observed features. Consider the weight or importance of identified features in order to determine the focus of the examination. Examples of features may include logos, shapes, reflections, or specific items.
Identify any resources that may assist in the formulation of the opinion. Examples of resources include, but are not limited to:
- Training and experience
- Internet-based research
- Other laboratories
- Subject Matter Experts
  - Academia
  - Manufacturing facilities (including site visits and resources)
- User manuals, periodicals, books, journals, court records

7. Results

Based on the observations and assessments, an opinion should be formed and documented.

Assess the significance of each of the identified features based on the research performed. This can include determining the weight a specific feature may have, and/or assigning it as a class or distinguishing characteristic.
Based on the observed features and any research performed, form an opinion to address the requested examination. Results must be properly qualified and address the limitations of the methodology and research. If an insufficient basis exists, the result of the examination may be inconclusive.
The results of the examination should undergo independent review by a comparably trained individual. If disputes during review arise, a means for resolution of issues should be in place.

8. Limitations of Methodology

Results will be limited by the quality of the imagery, the availability of discerning features, and the availability of reference material. Based on these factors, it is possible the requested examination cannot be fulfilled. Examiners should take care not to overstate results, and to verify reference materials through cross-referencing multiple sources when possible.

One potential source of uncertainty in any forensic analysis results from bias. It is the responsibility of the organization and the examiner to minimize the effects of bias when conducting examinations and performing reviews. Minimizing the effects of bias can be accomplished through awareness, training, documentation (of any potential sources for bias and the steps taken to minimize), and quality assurance measures including the limitation of task irrelevant information and blind verification.

9. Appendix A. Work Flow Examples

9.1 Example 1 – “Vehicle Make/Model/Year”

A local police department receives a report of a bank robbery and then responds to the bank to retrieve the evidence. After retrieval, a compact disc containing video is turned over to a forensic laboratory to determine the make, model, and year of the get-away vehicle.

Following the methodology described above, the laboratory proceeds:

The request is reviewed and it is:
1. determined that this type of analysis is performed,
2. determined that all necessary items to support the requested exam have been submitted,
3. determined that the laboratory has the necessary equipment, materials, and resources needed to conduct the requested analysis, and
4. assigned to an examiner.
The examiner acquires the necessary imagery.
1. The examiner calls the investigating agency and determines that copies of the original video have been received.
2. The examiner reviews the video and selects relevant images for further analysis.
The examiner makes copies of the selected imagery for use as working copies, and safely stores the received video.
Image processing techniques such as brightness and contrast adjustments, unsharp masking, and multi-pixel averaging may be performed. The use of these techniques is documented per the unit’s SOP.
The examiner identifies features to classify the questioned vehicle by make, model, and year. The examiner notes details specific to the vehicle including but not limited to: the shape of the vehicle, the shape of the windows, the shape of the grill, the license plate position, and the presence and position of trim. The examiner notes that due to a lack of detail, the license plate and the logo cannot be resolved.
The examiner accounts for compression artifacts and the effect they may have on the image.
The examiner identifies known vehicle resources, including resources available to the public on the internet.
Based on the highest weighted features, including the shape of the grill and the license plate position, the examiner determines that the questioned vehicle is most consistent with a specific make and model over a defined year range.
A comparably trained individual in the laboratory independently reviews the results of the examination.
The examiner writes the report. Per the laboratory’s SOPs, the report includes a review of the materials received, the request, the methods used, the results obtained, and the basis for the opinion(s).

9.2 Example 2 – “Where was this photograph taken?”

A local police department receives a report of possible child exploitation and downloads imagery from the internet. After retrieval, a compact disc containing images is turned over to a forensic laboratory to determine the physical location of the subject based on background information that may be present in the scene.