HackThisSite - Forensic Mission 2

Challenge

Forensic 2 — Cheater

From: howard.davis@divorceattorneys.rus My client is being accused of cheating on his wife. A photograph has been presented in court that shows him with another woman in their bedroom, in their home. The woman in question is a known friend to them both. My client has stated that he did take the photo. However, he claims it was a selfie and no other person was present in the home or in the picture. As the forensic specialist for our law firm, are you able to detect any digital manipulation within this image?

Image link / Password: （提交字段名 forensic2，POST 回关卡页自身）

Solution

ELA 的基本假设是：JPEG 是有损压缩，整幅图被重新压一次时未编辑过的区域残余很小且分布均匀； 而被拼接、复制或二次压缩过的区域，其残余会明显偏离邻域。

完整的全局 ELA 脚本如下。它只计算整幅图的重压缩差异；区域统计和镜像/放大结果来自已保存的分析产物，未把缺失的脚本补写成确定步骤。

#!/usr/bin/env python3
"""Compute a global JPEG Error Level Analysis (ELA) summary."""

import argparse
import io

import numpy as np
from PIL import Image


def ela_summary(path, quality=90):
    original = Image.open(path).convert("RGB")
    buffer = io.BytesIO()
    original.save(buffer, format="JPEG", quality=quality)
    recompressed = Image.open(buffer).convert("RGB")
    diff = np.abs(
        np.asarray(original).astype(int) - np.asarray(recompressed).astype(int)
    ).max(axis=2)
    values = diff.astype(np.float32)
    return values.mean(), np.percentile(values, 90), int(values.max())


def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("image", nargs="?", default="selfie.jpg")
    parser.add_argument("--quality", type=int, default=90)
    args = parser.parse_args()
    mean, p90, maximum = ela_summary(args.image, args.quality)
    print("global  mean %.2f  p90 %.0f  max %d" % (mean, p90, maximum))


if __name__ == "__main__":
    main()

$ uv run python ela_summary.py selfie.jpg
global  mean 1.07  p90 3  max 24

Vulnerabilities

本题的 ELA 差异是定位可疑区域的线索，需要结合图像内容、压缩历史和噪声一致性判断。ELA 不能单独证明拼接，也不能保证所有重编码后的编辑都可识别。

ELA4LIFE!!