vicgc / phoenix

phoenix is a small command line image forensics tool

phoenix - Image Forensics

phoenix is a small image forensics tool that can run some common analyses on images. It was inspired by the image analyses at the Hackerfactor Blog, and implements some of the algorithms used there. It is named phoenix because it has resurrected many times before taking its final form in C++.

Features:

• Error Level Analysis
• Luminance Gradient
• Average Distance
• HSV and Lab colorspace histograms
• JPEG quality estimate (ImageMagick-style and Hackerfactor jpegquality estimates)

#Usage

• -h | -help display help text.
• -f | -file <path> Required, the path to the source image.
• -o | -output [path] Save results in files (as PNG), optionally to path.
• -d | -display Display results.
• -ela Error Level Analysis
• -lg Luminance Gradient
• -avgdist Average Distance
• -hsv HSV Colorspace Histogram
• -lab Lab Colorspace Histogram

#Screenshots Here are some examples of phoenix output with the image used in the legendary Body By Victoria analysis by Neal Krawetz.

##ELA (Error Level Analysis)

##LG (Luminance Gradient)

##AVGDIST (Average-Distance of Neighbor Pixels)

##HSV Colorspace Histogram

##Lab Colorspace Histogram

#Compiling phoenix depends on OpenCV 2.4.6 and Boost 1.54.0 Libraries. Exact versions are probably not required. Edit the variables in Makefile-variables.mk to match your OpenCV and Boost library paths. Running make should compile if everything is in place.

#Resources Some resources I used while developing many of the algorithms here.

• Hackerfactor Blog
• Quality Time with Your JPEGs
• Exploring JPEG
• ELA From Scratch
• elsamuko Image Forensics