Photo forensics using image signatures

1. A system for evaluating an image, comprising:

a processor configured to

analyze a plurality of attributes of the image, wherein the plurality of attributes includes attributes belonging to a plurality of different attribute categories,

determine that a portion of the attributes imperfectly matches a reference attribute signature corresponding to a device, wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes determining that an image signature determined using at least a first identifier of a first attribute of the plurality of attributes of the image belonging to a first attribute category and a second identifier of a second attribute of the plurality of attributes of the image belonging to a second attribute category matches only in part the reference attribute signature associated with the device, and

distinguish whether the imperfect match likely corresponds to a modification; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein distinguishing whether the imperfect match likely corresponds to the modification includes determining whether the imperfect match is a consequence of a reference attribute signature database coverage for the device.

3. The system of claim 1 , wherein distinguishing whether the imperfect match likely corresponds to the modification includes determining whether the imperfect match is a consequence of a variability of possible reference attribute signatures for the device.

4. The system of claim 1 , wherein distinguishing whether the imperfect match likely corresponds to the modification includes determining whether a compression of the image corresponds to an image editing software compression.

5. The system of claim 1 , wherein distinguishing whether the imperfect match likely corresponds to the modification includes providing an identifier of a degree of confidence that the image has not been modified.

6. The system of claim 1 , wherein distinguishing whether the imperfect match likely corresponds to the modification includes providing information identifying a reason the portion of the attributes imperfectly matches the reference attribute signature.

7. The system of claim 1 , wherein the modification includes a resaving of the image after the image was saved by the device.

8. The system of claim 1 , wherein analyzing the plurality of attributes of the image includes analyzing a dimension of the image.

9. The system of claim 1 , wherein analyzing the plurality of attributes of the image includes analyzing a compression parameter of the image.

10. The system of claim 1 , wherein analyzing the plurality of attributes of the image includes analyzing a thumbnail of the image.

11. The system of claim 1 , wherein analyzing the plurality of attributes of the image includes analyzing a metadata of the image.

12. The system of claim 1 , wherein analyzing the plurality of attributes of the image includes determining a signature that represents one or more of the plurality of attributes of the image.

13. The system of claim 1 , wherein analyzing the plurality of attributes of the image includes determining whether the image has been compressed more than one time.

14. The system of claim 1 , wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes determining that the image signature does not completely match any single reference attribute signature in a reference attribute signature database, and in response to the determination that the image signature does not completely match any single reference attribute signature, searching the reference attribute signature database to identify the reference attribute signature that imperfectly matches the image signature.

15. The system of claim 1 , wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes searching through a group of reference attribute signatures and each of the group of reference attribute signatures identify device model common attributes of all devices of a same device model.

16. The system of claim 1 , wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes searching through a group of reference attribute signatures known to be associated with device models of a same device manufacturer to identify the imperfectly matched reference attribute signature.

17. The system of claim 1 , wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes utilizing a match pattern specifying specific attribute category components of the image signature that must match the reference attribute signature in order for the imperfect match to be determined.

18. The system of claim 1 , wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes utilizing a match pattern specifying the portion of the attributes that must explicitly not match the reference attribute signature in order for the imperfect match to be determined.

19. A method for evaluating an image, comprising:

analyzing a plurality of attributes of the image, wherein the plurality of attributes includes attributes belonging to a plurality of different attribute categories;

using a processor to determine that a portion of the attributes imperfectly matches a reference attribute signature corresponding to a device, wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes determining that an image signature determined using at least a first identifier of a first attribute of the plurality of attributes of the image belonging to a first attribute category and a second identifier of a second attribute of the plurality of attributes of the image belonging to a second attribute category matches only in part the reference attribute signature associated with the device; and

distinguishing whether the imperfect match likely corresponds to a modification.

20. A computer program product for evaluating an image, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

analyzing a plurality of attributes of the image, wherein the plurality of attributes includes attributes belonging to a plurality of different attribute categories;

determining that a portion of the attributes imperfectly matches a reference attribute signature corresponding to a device, wherein determining that the portion of the attributes imperfectly matches the reference attribute signature includes determining that an image signature determined using at least a first identifier of a first attribute of the plurality of attributes of the image belonging to a first attribute category and a second identifier of a second attribute of the plurality of attributes of the image belonging to a second attribute category matches only in part the reference attribute signature associated with the device; and

distinguishing whether the imperfect match likely corresponds to a modification.

21. The method of claim 19 , wherein distinguishing whether the imperfect match likely corresponds to the modification includes providing an identifier of a degree of confidence that the image has not been modified.

22. The method of claim 19 , wherein distinguishing whether the imperfect match likely corresponds to the modification includes providing information identifying a reason the portion of the attributes imperfectly matches the reference attribute signature.

23. The method of claim 19 , wherein analyzing the plurality of attributes of the image includes analyzing a compression parameter of the image.

24. The method of claim 19 , wherein analyzing the plurality of attributes of the image includes analyzing a metadata of the image.

25. The computer program product of claim 20 , wherein analyzing the plurality of attributes of the image includes analyzing a metadata of the image.