Ghiro – Automated Digital Image Forensics Tool
Sometime forensic investigators need to process digital images as evidence. There are some tools around, otherwise it is difficult to deal with forensic analysis with lot of images involved.
Images contain tons of information, Ghiro extracts these information from provided images and display them in a nicely formatted report.
Dealing with tons of images is pretty easy, Ghiro is designed to scale to support gigs of images.
All tasks are totally automated, you have just to upload you images and let Ghiro does the work.
Understandable reports, and great search capabilities allows you to find a needle in a haystack.
Ghiro is a multi user environment, different permissions can be assigned to each user. Cases allow you to group image analysis by topic, you can choose which user allow to see your case with a permission schema.
[adsense size='1']
Use Cases
Ghiro can be used in many scenarios, forensic investigators could use it on daily basis in their analysis lab but also people interested to undercover secrets hidden in images could benefit. Some use case examples are the following:
- If you need to extract all data and metadata hidden in an image in a fully automated way
- If you need to analyze a lot of images and you have not much time to read the report for all them
- If you need to search a bunch of images for some metadata
- If you need to geolocate a bunch of images and see them in a map
- If you have an hash list of "special" images and you want to search for them
Anyway Ghiro is designed to be used in many other scenarios, the imagination is the only limit.
Video
MAIN FEATURES
Metadata extraction
Metadata are divided in several categories depending on the standard they come from. Image metadata are extracted and categorized. For example: EXIF, IPTC, XMP.
GPS Localization
Embedded in the image metadata sometimes there is a geotag, a bit of GPS data providing the longitude and latitude of where the photo was taken, it is read and the position is displayed on a map.
[adsense size='1']
MIME information
The image MIME type is detected to know the image type your are dealing with, in both contacted (example: image/jpeg) and extended form.
Error Level Analysis
Error Level Analysis (ELA) identifies areas within an image that are at different compression levels. The entire picture should be at roughly the same level, if a difference is detected, then it likely indicates a digital modification.
Thumbnail extraction
The thumbnails and data related to them are extracted from image metadata and stored for review.
Thumbnail consistency
Sometimes when a photo is edited, the original image is edited but the thumbnail not. Difference between the thumbnails and the images are detected.
Signature engine
Over 120 signatures provide evidence about most critical data to highlight focal points and common exposures.
Hash matching
Suppose you are searching for an image and you have only the hash. You can provide a list of hashes and all images matching are reported.
Gloss