Forensic is an image processing library which aims to detect copy-move forgeries in digital images. The implementation is mainly based on this paper: https://arxiv.org/pdf/1308.5661.pdf

• Convert the RGB image to YUV color space.
• Divide the R,G,B,Y components into fixed-sized blocks.
• Obtain each block R,G,B and Y components.
• Calculate each block R,G,B and Y components DCT (Discrete Cosine Transform) coefficients.
• Extract features from the obtained DCT coefficients and save it into a matrix. The matrix rows will contain the blocks top-left coordinate position plus the DCT coefficient. The matrix will have (M − b + 1)(N − b + 1)x9 elements.
• Sort the features in lexicographic order.
• Search for similar pairs of blocks. Because identical blocks are most probably neighbors, after ordering them in lexicographic order we need to apply a specific threshold to filter out the false positive detections. If the distance between two neighboring blocks is smaller than a predefined threshold the blocks are considered as a pair of candidate for the forgery.
• For each pair of candidate compute the cumulative number of shift vectors (how many times the same block is detected). If that number is greater than a predefined threshold the corresponding regions are considered forged.

First install Go if you don't have already installed, set your GOPATH, and make sure $GOPATH/bin is in your PATH environment variable.

$ export GOPATH="$HOME/go"
$ export PATH="$PATH:$GOPATH/bin"

Next download the project and build the binary file.

$ go get -u -f github.com/esimov/forensic
$ go install

In case you do not want to build the binary file yourself you can obtain the prebuilt one from the releases folder.

$ forensic -in input.jpg -out output.jpg

$ forensic --help

Image forgery detection library.
    Version: 

  -blur int
    	Blur radius (default 1)
  -bs int
    	Block size (default 4)
  -dt float
    	Distance threshold (default 0.4)
  -ft float
    	Forgery threshold (default 210)
  -in string
    	Input image
  -ot int
    	Offset threshold (default 72)
  -out string
    	Output image

Original image	Forged image	Detection result

Sometimes the library produces false positive results depending on the image content. For this reason I advise to adjust the settings. Also in some cases human judgement is required, but otherwise the library do a decent job in detecting forged images.

The more intensive the overlayed color is, the more certain is that the image is tampered.

• Endre Simo (@simo_endre)

Copyright © 2018 Endre Simo

This project is under the MIT License. See the LICENSE file for the full license text.