Forensic Science Communications Seal
Table of Contents
Back Issues
Search
Editors
About FSC
Instructions for Authors

Forensic Science Communications October 2005 – Volume 7 – Number 4
Standards and Guidelines

Best Practices for Forensic Image Analysis

Scientific Working Group on Imaging Technology (SWGIT)

Version 1.5, March 14, 2005

Objective | Position | Introduction | General Tasks | Specific Areas of Analysis | Best Practices | Work-Flow Examples | References | Appendix A | Appendix B

Objective

The objective of this document is to provide personnel with guidance regarding practices appropriate when performing a variety of analytic tasks involving images, regardless of the knowledge domain that is the subject of analysis.

Position

Forensic image analysis is a forensic science. It has been practiced since the early days of photography, dating back to at least 1851 when Marcus A. Root conducted the first documented example of forensic image authentication. Through microscopic examination, Root revealed that the color daguerrotype “process” promoted by Reverend Levi Hill was actually the product of coloring by hand, not a breakthrough in photographic science (Davis et al. 1995). In addition to being an accepted scientific practice in the forensic community, image analysis is also recognized in other disciplines, including medicine, intelligence, geology, astronomy, and agriculture.

Introduction

Forensic image analysis is the application of image science and domain expertise to interpret the content of an image or the image itself in legal matters. Major subdisciplines of forensic image analysis with law enforcement applications include photogrammetry, photographic comparison, content analysis, and image authentication.

The process of forensic image analysis can involve several different tasks, regardless of the type of image analysis performed. These tasks, which are described below, fall into three categories: interpretation, examination, and technical preparation. The general principles and procedures used in these tasks are the same, regardless of the format or media in which the images are recorded. Therefore, in this document the word image refers to any image recorded on any media (e.g., conventional photographic, electronic, magnetic, or optical media).

Forensic Image Analysis—General Tasks

Interpretation

Interpretation, as used here, is the application of specific subject matter expertise to draw conclusions about subjects or objects depicted in images. Examples include a podiatrist’s drawing conclusions about foot shape from an image, a shoeprint expert’s drawing conclusions about the provenance of a shoe, or a military expert’s drawing conclusions about force distribution from remote sensing data.

Examination

Examination is the application of image science expertise to the extraction of information from images, the characterization of image features, and the interpretation of image structure. Examples include watermark detection, steganalysis, and image alteration evaluation, as well as the development of case-specific image exploration strategies. Image enhancement, image restoration, and other image processing activities intended to improve the visual appearance of features in an image are examination tasks.

Technical Preparation

Technical preparation is the performance of such tasks as the preparation of evidence or images for examination, interpretation, or output. There is a wide range of technical decisions made within the various responsibilities covered by technical preparation actions. Some responsibilities may involve minimal technical decision making, such as feeding paper into a preset sheet-fed scanner that has been previously calibrated. Other responsibilities may involve a great deal of technical decision making, such as determining appropriate color balance, sampling during acquisition, or output resolution.

Note: Interpretation, examination, and technical preparation are tasks, not job descriptions or roles. An individual may perform part of one task or a combination of multiple tasks within the organizational structure of any given activity. Each of these tasks requires its own training and qualification.

Forensic Image Analysis—Specific Areas of Analysis

Photogrammetry

“Photogrammetry is the art, science, and technology of obtaining reliable information about physical objects and the environment through the processes of recording, measuring, and interpreting photographic images and patterns of electromagnetic radiant energy and other phenomena” (American Society of Photogrammetry 1980). In forensic applications, photogrammetry (sometimes called mensuration) is most commonly used to extract dimensional information from images, such as the height of subjects depicted in surveillance images and accident scene reconstruction. Other forensic photogrammetric applications include visibility and spectral analyses. Figure 1 illustrates an example of a photogrammetric analysis conducted to determine the height of a subject depicted in a bank robbery surveillance photograph.

Figure 1 illustrates an example of a photogrammetric analysis conducted to determine the height of a subject depicted in a bank robbery surveillance photograph.

Figure 1: Photogrammetric Analysis Conducted to Determine the Height of a Subject Depicted in a Bank Robbery Surveillance Photograph

Photographic Comparisons

Photographic comparison (as opposed to a demonstrative exhibit) is an assessment of the correspondence between features in images and known objects for the purpose of rendering an expert opinion regarding identification or elimination. Examples of photographic comparisons include, but are not limited to:

  • A facial comparison between an unknown subject depicted in a surveillance image and an identified suspect.
  • The comparison of objects, such as vehicles, depicted in surveillance images with those recovered in an investigation.
  • The comparison of a questioned image with a known camera and images from that camera to determine if the image was captured using that camera.

Photographic comparisons are frequently referred to as “side-by-side” comparisons because they usually involve a comparison of class and individualizing characteristics in imagery. The scientific processes involved in photographic comparisons are comparable to those used in other forensic disciplines, such as fingerprint analysis. Two commonly accepted scientific protocols that may be applied to photographic comparisons are ACE-V (Analysis, Comparison, Evaluation-Verification) and statistical analysis. Figure 2 illustrates demonstrative exhibits from a facial comparison examination in which ACE-V was used to individualize the subject as the same person in both images.

Figure 2 illustrates demonstrative exhibits from a facial comparison examination in which ACE-V was used to individualize the subject as the same person in both images.

Figure 2: Exhibits from a Facial Comparison Examination in Which ACE-V Was Used to Individualize the Subject as the Same Person in Both Images


Figure 3 illustrates a demonstrative exhibit from a clothing comparison examination in which ACE-V was used to individualize the camouflage jacket as the same one in both images.


Figure 3 illustrates a demonstrative exhibit from a clothing comparison examination in which ACE-V was used to individualize the camouflage jacket as the same one in both images.

Figure 3: An Exhibit from a Clothing Comparison Examination in Which ACE-V Was Used to Individualize the Camouflage Jacket as the Same One in Both Images

Content Analysis

Content analysis is the drawing of conclusions about an image. Targets for content analysis include, but are not limited to:

  • The subjects/objects within an image.
  • The conditions under which, or the process by which, the image was captured or created.
  • The physical aspects of the scene (e.g., lighting or composition).
  • The provenance of the image.

Examples include identification of a vehicle license plate number, analysis of a patterned injury, comparison of injuries depicted in an image sequence with autopsy results, determination of the presence of computer-generated imagery in an alleged “snuff” film, and determination of the type of camera used to record a specific image.

Image Authentication

Image authentication is verification by some defined criteria that the information content of the analyzed material is an accurate rendition of the original data. These criteria usually involve the interpretability of the data, not simple format changes that do not alter the meaning or content of the data.

Examples include:

  • Determining the degradation of a transmitted image.
  • Determining whether a video is an original recording or an edited version.
  • Evaluating the degree of information loss in an image saved using lossy compression.
  • Determining whether an image contains feature-based modifications, such as the addition or removal of elements in the image (e.g., adding bruises to a face).

Best Practices

The following guidelines describe the SWGIT-recommended best practices for the performance of forensic image analysis.

Evidence Management
Agencies should have documented procedures for handling, transporting, and storing evidence. Agencies should have chain of custody procedures in place and should follow these procedures.

Quality Control and Quality Assurance
Quality control and quality assurance policies and procedures should be implemented and documented. Technical and administrative peer reviews are integral components of quality control.

Security
There should be procedures in place to maintain the security of the working data, all notes, and other such analysis-related materials to provide the level of security and privacy needed by the organization. For example, archived case-related materials should be stored in a manner that limits access. The degree of access will be agency-specific.

Infrastructure
Agencies should have sufficient space, equipment, and facilities to adequately support the required quality and volume of work.

Work Management
Because forensic image analysis is a labor-intensive process, an upper limit on caseload should be established for every category of task.

Documentation
Most image analysis techniques are based on accepted scientific methods. The practitioner should have available documentation that describes and justifies the use of any method involved in the analysis. Such documentation can include peer-reviewed journal articles, scientific conference proceedings, reference books, internal white papers, or the results of empirical studies.

The application of analytic techniques in a given case should be recorded to the degree that a similarly trained professional would reach a comparable analytic conclusion.

Agencies should establish standards for the information to include when reporting results, as well as the format for the reports.

Training, Competency, and Proficiency
Practitioners of image analysis should follow SWGIT-SWGDE Guidelines and Recommendations for Training in Digital & Multimedia Evidence and SWGDE/SWGIT Proficiency Test Program Guidelines. These documents are available at

http://www.theiai.org/swgit/swgde/training_guidelines_october2004.pdf

and

http://www.theiai.org/swgit/swgde/proficiency_test_guidelines_october%202004.pdf,

respectively.

Analysts should have certification in their knowledge domains and associated forensic disciplines, when such certification is appropriate and available. However, the mere existence of a certification program does not imply that it is necessary, sufficient, or appropriate.

Analysts should demonstrate competency in their disciplines prior to being assigned unsupervised casework responsibilities. In addition, analysts should demonstrate proficiency and maintain continuing education activities. Agencies should document the competency, proficiency, and continuing education of each analyst.

The practitioner should demonstrate:

  • An understanding of the scope of the work and how it will be applied in the forensic environment.
  • Subject matter knowledge and competence.
  • Working knowledge of the potential image processing and image evaluation techniques.
  • Working knowledge of applications and tools used in the specific agency.
  • Working knowledge of SWGIT guidelines for capturing, storing, and processing imagery, including issues relating to such topics as data integrity and compression artifacts.
  • An understanding of legal precedent for the use of specific image processing techniques.
  • Knowledge of the techniques necessary to document the conclusions.
Standard Operating Procedures
Agencies should have standard operating procedures (SOPs) for the tasks being performed. These SOPs should reflect the work flow and be general enough to permit flexibility for the required tasks.

Work Flow
The following describes a generalized sequence of actions involved in the analysis of an image, as well as recommendations for performing those actions. The exact sequence will be agency-specific.

1. Reviewing a request for analysis

  1. The agency must confirm that it performs the requested analysis.
  1. The agency must ensure that the requestor has submitted all items needed to support the requested analysis or examination. Note: In some cases, it may be necessary for the agency to obtain additional items or information before an analysis can be completed.
  1. The agency must confirm that it has the necessary equipment, materials, and resources needed to conduct the requested analysis.
  1. The agency must assign the analysis request to the appropriate personnel.

2. Acquiring imagery

This is the implementation of the acquisition strategy determined in the initial assessment. It produces the image for the steps that follow. Often, analysis or examination may be performed on objects directly or on analog images without the need for digitization. The primary or original image should be archived in a manner that permits verification. The image-acquisition step is where the integrity of the primary or original data is initially established. Most often, subsequent steps are performed using working copies, but in all cases, the integrity of the primary or original image(s) must be maintained.

  1. If possible, the original or primary image, or a bit-for-bit duplicate, should be available for analysis.
  1. Triage imagery
  1. The practitioner must determine if the submitted material is suitable for analysis.
  1. The practitioner must determine if all of the submitted material, or only a subset of the material, is to be analyzed.

3. Producing working copies

The practitioner should produce working copies of images to be analyzed. This may require digitization from negatives or prints or conversion from other media.

4. Processing images to be analyzed

Note: Guidance relating to forensic image processing (FIP) and case-specific documentation requirements for FIP can be found in the following SWGIT documents: Recommendations and Guidelines for the Use of Digital Image Processing in the Criminal Justice System and Best Practices for Documenting Image Enhancement, available at

http://www.fbi.gov/hq/lab/fsc/backissu/jan2003/swgitdigital.htm

and

http://www.fbi.gov/hq/lab/fsc/backissu/july2005/index.htm,

respectively.

The practitioner should:

  1. Design an image processing strategy. This is the application of domain knowledge to choose which processes to apply to the image to extract the information necessary to draw a conclusion. The strategy should be justifiable. No single processing strategy is appropriate for all cases. This should be reflected in the organizational SOPs.
  1. Identify the appropriate tools needed to implement the strategy. There should be some references/documentation that the selected tools will permit implementation of the strategy.
  1. Implement the designed image processing strategy.
  1. Assess results. Determine that the image processing strategy yielded results suitable for analysis.
  1. If the results are suitable for analysis, then the practitioner should proceed to the analysis (Step 5). Otherwise, the practitioner should repeat the process of designing an image processing strategy until suitable results are achieved.
Note: Exploratory strategies that are not incorporated into the final work-flow pathway need not be documented in case notes. Agencies may wish to document this fact in their SOPs.

5. Analyzing processed data

The practitioner should:

  1. Determine if the criteria necessary for reaching a conclusion are present in the processed image.
  1. Specific criteria for reaching a conclusion should be identified and documented.
  1. In some cases, the criteria will reflect the subjective experience of the practitioner. Such conclusions should be confirmed through appropriate peer review.
  1. Reach a conclusion.

6. Reporting conclusions

  1. Some conclusions can be based on statistical criteria, whereas other conclusions are based on subjective criteria. Conclusions derived from photogrammetric analyses often can be reported in terms of statistical criteria. In contrast, many conclusions derived from image-content analyses are based on subjective criteria. The basis for, and uncertainty of, any conclusion should be reflected in the reporting.
  1. When a statistical basis for a conclusion can be made, the conclusion should be quantitatively reported. It may be possible to provide bounds on probabilities based on incomplete knowledge. (See Appendix A.)
  1. When statistical criteria do not exist, the conclusion should be reported in terms of the characteristics discerned. The ACE-V method is one way of doing this. Another way is to use a graded scale. An example of such a graded scale is provided in Appendix B.
  1. The report format and contents should follow agency standards.

Work-Flow Examples

Photogrammetric Analysis Example

A local police agency asks the state crime laboratory to determine the height of an individual depicted robbing a convenience store in a surveillance videotape. The police have two suspects of different heights and would like the crime laboratory to determine if either can be excluded on this basis.

Following the work flow delineated above, the agency proceeds:

  1. The agency reviews the request and:
  1. Determines that it performs this type of analysis.
  1. Determines that all necessary items to support the requested examination have been submitted.
  1. Determines that it has the necessary equipment, materials, and resources needed to conduct the requested analysis.
  1. Assigns the request to an analyst.
  1. The analyst acquires the necessary imagery.
  1. The analyst observes that the videotape has no markings that would indicate that it is a copy, then verifies that it is an original using available video processing equipment.
  1. The analyst reviews the video sequence of interest and locates images suitable for photogrammetric analysis.
  1. The analyst digitizes still images from the analog video sequence to use as working copies in the analysis.
  1. Standard image processing techniques, such as brightness and contrast adjustments and deinterlacing, are applied to the working images.
  1. The analyst imports the images into a photogrammetric application and conducts an analysis. This analysis results in a calculated value for the robber’s height, as well as a determination of the accuracy and precision of this result. The analyst compares these results with the reported heights of the two suspects and eliminates one of the suspects on this basis.
  1. The analyst writes the report. Per the crime laboratory’s SOPs, the report includes a review of the materials received, the request, the methods used, the results obtained, an estimate of accuracy and precision, the basis for the conclusion, and the conclusion.

Photographic Comparison Example

An FBI field office investigating a report of child abuse recovers a floppy disk containing digital image files that appear to depict the suspect’s left hand upon a victim. A second floppy disk is received containing digital image files of a known suspect’s left hand. An FBI image analysis unit is requested to perform a photographic comparison of the questioned and known hands to determine if the hands belong to the same individual.

Following the work flow described above, the unit proceeds:

  1. The agency reviews the request and:
  1. Determines that it performs this type of analysis.
  1. Determines that all necessary items to support the requested examination have been submitted.
  1. Determines that it has the necessary equipment, materials, and resources needed to conduct the requested analysis.
  1. Assigns the request to an analyst.
  1. The analyst acquires the necessary imagery.
  1. The analyst calls the investigating agency and determines that copies of the original images have been received. The authentication was performed by the investigating agency.
  1. The analyst reviews the imagery and selects several images for further analysis.
  1. The analyst makes copies of the selected imagery for use as working copies and safely stores the received data.
  1. Image processing techniques—such as brightness and contrast adjustments, unsharp masking, and multi-pixel averaging—are performed. The use of these techniques is documented per the unit’s SOP.
  1. The resulting images are analyzed, and it is determined that compression artifacts present in the questioned images prevent unambiguous identification of individualizing features on the hand. The class characteristics of the questioned and known hands, however, are observed to be similar. Therefore, the analyst concludes that similarities exist that allow the inclusion of the suspect but do not permit the identification or elimination of the suspect.
  1. The analyst writes the report. Per the unit’s SOPs, the report includes a review of the materials received, the request, the methods used, the results obtained, the basis for the conclusion, and the conclusion.

Content Analysis Example

A four-year-old child complaining of fever is admitted to the hospital. Emergency room physicians note a confluent red rash on the victim’s trunk and groin. The child begins having seizures, stops breathing, and dies. Resuscitation efforts fail. The local physician signs the death certificate as “death due to scarlet fever.” The coroner is not informed of the death, and the body is cremated. Three weeks after cremation, a family member makes the accusation that the child had been dipped in boiling water.

The emergency room physician had taken digital snapshots of the rash as a teaching tool. The county medical examiner’s office is asked to evaluate the imagery to determine if the injuries are consistent with scarlatina or child abuse.

Following the work flow described above, the medical examiner’s office proceeds:

  1. The agency reviews the request and:
  1. Determines that it performs this type of analysis.
  1. Determines that all necessary items to support the requested examination have been submitted.
  1. Determines that it has the necessary equipment, materials, and resources needed to conduct the requested analysis.
  1. Assigns the analysis request to a medical examiner.
  1. The medical examiner acquires the necessary imagery.
  1. The medical examiner calls the hospital and subpoenas the child’s records.
  1. The medical examiner confirms that the imagery is a copy of the digital snapshots taken by the emergency room doctor.
  1. The medical examiner reviews the documents and imagery and selects several images for further analysis.
  1. The medical examiner makes working copies of the selected imagery and safely stores the received data.
  1. No image processing is required.
  1. The selected images are analyzed, and it is determined that the pattern of injury on the body, the location of the rash on the body, and the texture of the rash are incompatible with immersion in boiling water. Examination of the medical records reveals a positive blood culture for Streptococcus pyogenes. In addition, a rapid test for influenza A was performed and was positive. Therefore, the medical examiner concludes that the skin lesion was due to scarlatina resulting from a S. pyogenes superinfection secondary to influenza A.
  1. The medical examiner writes the report. Per the SOPs of the medical examiner’s office, the reasoning behind the conclusions and the results are detailed.

References

Davis, P. Photography. 7th ed., Brown & Benchmark, Madison, Wisconsin, 1995.

American Society of Photogrammetry. The Manual of Photogrammetry. 4th ed., C. C. Slama, C. Theurer, and S. W. Henriksen, eds. Falls Church, Virginia, 1980.

Appendix A: Reporting Conclusions Through Quantitative Means (Commentary and Example)

Classic photogrammetric evaluation is amenable to estimation of error, either through the propagation of error involved in the calculations or in comparison with fiducials that may be present in an image. The reader is referred to standard photogrammetric and numerical methods texts for the former. In many images that require measurement, there are objects of known dimension. These may be used to provide estimates of error. Both common kinds of error (imprecision and bias) should be estimated if possible, and if not possible, the limitations of the method should be mentioned in the final report.

Example: Evaluation of Hostage Photograph

A government agency has obtained a photograph of a middle-aged male hostage. The agency wants an estimate of the time since his capture based on the assumption that the man has not been allowed to shave. The analyst is instructed to measure the hairs on the chin of the hostage and estimate the time since his last shave. The hostage photograph is taken with the hostage holding a newspaper below his chin, and the date is estimated to be in mid-May. In addition, the victim is wearing a known-brand shirt, with buttons of minimal manufactured tolerance. The button diameter is 12 mm (± 0.0001 mm).

Photogrammetric measurement of six buttons reveals an average measured diameter of 12.01 mm (± 0.02 mm). Measurement of 100 hairs on the chin reveals an average length of 3.2 mm (± 0.3 mm) for pigmented hairs and 7.2 mm (± 0.5 mm) for nonpigmented hairs.

The photogrammetric error is thus of an order of magnitude less than the error of the hair and can be discounted. The published average growth rate for beard hair is 0.47 mm/day (± 0.2 mm) for pigmented hair and 1.12 mm/day for white hair. The May date allows negligible adjustment for seasonal hair-growth variation (which may be up to 60 percent). White-hair growth data is discarded because of great interpersonal variation.

The estimate of beard growth is thus 3.2/0.47 = 6.8 days, with an estimated error of

[(0.3/3.2)(0.3/3.2) + (0.2/0.42)(0.2/0.42)]1/2 x 6.8,

or 3.3 days.

The estimate is thus that the hostage had been kept for 6.8 ± 3.3 days, ignoring the (sizeable) seasonal variation and (possibly sizeable) nutritional effects. Both the error and the ignored sources of error are noted in the final report.

Appendix B: Reporting Conclusions Through the Use of a Graded Scale (Commentary and Example)

When a statistical basis for the conclusion can be made, the conclusion should be reported in terms of probability. When statistical criteria do not exist, the conclusion may be reported in terms of the characteristics discerned and their correspondence or disagreement. One way of doing this is through the use of a graded scale such as the following:

  • Grade 0: Exclusion.
  • Grade 1: Correspondence of class characteristics only.
  • Grade 2: Correspondence of class characteristics and pseudorandom characteristics for which the underlying probability distribution is unknown.
  • Grade 3: Correspondence of class characteristics and acquired/random characteristics that can be considered unique within a selected population.

It may be possible to provide bounds on probabilities based on incomplete knowledge. If the examiner decides to provide such a bound, then a statement of probabilities can be made as commentary, with explicit description of the underlying assumptions. For example, in the case of a piece of clothing with a given fabric pattern, an estimate of a certain percentage could be made that the cloth has a given orientation for one panel and another percentage for another panel. If the assumption is made (and stated) or if investigation of the manufacturing process allows a determination that the orientations are independent, then it is possible to calculate a total probability by multiplying the individual probabilities. Thus, if panel A is at most 40 percent likely to have a given orientation and panel B is at most 40 percent likely to have a given orientation, then an upper bound of 16 percent of the clothing thus made will have that particular combination of panel orientations. For the most part, however, these kinds of data are not available to investigators, and the limit of examination will be a grade-based conclusion.