In order for Camera Ballistics to work properly a sensor fingerprint from the tested camera/phone's sensor must be created. This sensor fingerprint carries vital information about the camera specifications and unique stats and identifiers, which will later provide the software the essential information needed to determine if any photo was or was not actually taken by the camera being investigated.
It is very easy to obtain the camera sensor's fingerprint and it will take you only a few steps.
1. With the subject device take 30+ pictures. These pictures MUST adhere to the following standards - they must be as simple as possible (pictures of a plain white walls or sky are recommended). Do not take pictures of objects with sharp edges or angles. Best results come from while walls or sky photos. With older cameras/phones taking 30 pictures may not not be enough to establish an accurate sensor fingerprint, therefore 70-80 is the recommended amount to ensure the best accuracy of the fingerprint later on.
2. Save all these pictures into a folder on your computer. This folder MUST NOT include anything else.
3. Open Camera Ballistic and click on
Learn.
4. Locate and load the folder with the previously taken sensor fingerprint pictures. After clicking OK they will automatically load.
5. Now click on Next and the application will proceed to create the sensor fingerprint. You will be asked to select a location in your computer where it will be stored. The process of fingerprint creation will then start automatically and will take up to few minutes, depending on the number of photos that have been loaded.
6. After the fingerprint creation is finished you will see detailed info about the camera/phone as well as a graph showing the fingerprint accuracy/quality.
7. That is it - you will find the created fingerprint at the location in your computer you have selected in the previous step.
In the next phase ("Analyze"), Camera Ballistics will now be able to use the fingerprint as a reference point in determining whether a picture was or was not taken by a specific camera by comparing the "Learn" phase fingerprint photos to the actual subject photos being investigated.
To learn about the next step, the "Analyze" phase - go
here.
Fingerprints can also used and integrated into our premier mobile device investigation tool
MOBILedit Forensic Express - more info about enabling Camera Ballistics within Forensic Express can be found
here.