Multimedia Forensic Source Identification via Structural Signature Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

There is a lack of automated and practical methods for identifying the hardware and/or software sources of multimedia files through file format structural analysis, which is essential for forensic investigations, particularly in cases involving cybercrimes and the distribution or possession of multimedia content.

Innovation Solution

A system and method that utilize a processor and memory to receive files, identify supported multimedia file formats, parse structural elements, generate profile structural signatures, and compare them against a database of known signatures to determine the source hardware and/or software, employing a Naive-Bayes classification approach for probabilistic identification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Extent of automation

If manual forensic analysis methods are used to identify multimedia file sources, then analysis depth can be thorough, but automation and processing efficiency are lacking

Engineering Contradiction:
Improveautomation of forensic analysisVSAvoidaccuracy of source identification
Core Design Contradiction:
Extent of automationVSMeasurement precision

Solution Approach 1:

The patent replaces manual mechanical analysis with an automated computer-based system that extracts structural signatures from multimedia files and compares them against a database of known file writer signatures. The system automatically identifies file format, extracts structural elements, generates signatures, and determines source hardware/software without human intervention, thereby achieving full automation while maintaining identification accuracy through systematic computational analysis.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If existing forensic methods focus on scene content analysis, then manipulation detection is possible, but source identification capability is limited

Engineering Contradiction:
Improvesource identification accuracyVSAvoidcomplexity of analysis system
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent extracts specific structural signature elements from multimedia files that are characteristic of the file writer (hardware/software) used to create them. By isolating and analyzing these specific structural components rather than performing comprehensive scene content analysis, the system achieves accurate source identification while maintaining manageable system complexity through targeted extraction of relevant forensic features.

Inventive Principle:
Principle #2Taking out (Extraction)

3Measurement precision

If comprehensive structural analysis is performed on multimedia files, then source identification accuracy improves, but processing time increases

Engineering Contradiction:
Improvesource identification accuracyVSAvoidprocessing time for forensic analysis
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent segments the forensic analysis process into distinct modular steps: file format identification, structural element extraction, signature generation, and database comparison. This segmentation allows the system to process only relevant structural elements rather than analyzing entire files comprehensively, thereby maintaining high source identification accuracy while reducing overall processing time through efficient divide-and-conquer analysis.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentUS20240119084A1Source identifying forensics system, device, and method for multimedia files
Publication Date: 2024.04.11 MEDEX FORENSICS INC
  • US20240119084A1 patent drawing
  • US20240119084A1 patent drawing
  • US20240119084A1 patent drawing

AI summary

A system configured to perform a forensic analysis of a file including: one or more processors; and a memory storing computer-readable instructions that, when executed by the one or more processors, cause the system device to: receive one or more files for analysis; identify a file format for the file; determine whether the file format is a supported multimedia file; parse the file to separate structural elements from the file; generate a profile structural signature for the one or more files; a database including a plurality of profile structural signatures corresponding to known hardware and/or software; determining whether the one or more files matches one of the plurality of profile structural signatures; and providing an indication of an identity of the known hardware and/or software for the one or more files upon a determination that the one or more files matches one of the plurality of profile structural signatures. A method for performing a forensic analysis of a file is also disclosed.