Theia: a tool for the forensic analysis of mobile devices pictures

Currently the number of cameras embedded in mobile devices is growing at an unprecedented rate. Additionally, the quality and performance of these mobile cameras is steadily improving, and is closing in on that of classical digital cameras. This scenario makes the forensic analysis of images taken with mobile cameras increasingly important and necessary. Among the various branches of forensic analysis, this paper focuses on the reliable acquisition of the make and model of the mobile camera that produced a given image. For this we have developed a technique based on exchangeable image file format (Exif) metadata analysis, allowing us in certain cases to obtain both the make and model with which the photo was taken. This comes with considerable analysis of whether this metadata information could be trusted, and with additional tools that can help in discovering image manipulation. These and other capabilities have been integrated into a new tool we have developed called Theia, that also offers many other advantages to the forensic analyst that has to mass process and analyze thousands of images in the fastest and most forensically sound way. To that end, we have also incorporated various complex functions that greatly help the forensic analyst, such as different types of advanced queries on Exif metadata information of large sets of images, and advanced geopositioning capabilities.