FourMatch: A Photoshop Plugin That Can Spot Manipulated Photos

Earlier this year, we wrote about a new company called Fourandsix (pronounced “forensics”), a collaboration between a former Photoshop product manager and a professor who’s an expert in digital forensics. The goal of the new startup was to build powerful tools that would make detecting digital photo manipulation easy. Well, the first Fourandsix product is now available.

Called FourMatch, it’s an extension for Photoshop CS5/CS6 that “instantly distinguishes unmodified digital camera files from those that may have been edited.”

Unlike the duo’s other secretly brewing projects that haven’t been announced yet, FourMatch doesn’t take a photograph’s content itself into consideration. Instead, it peers into the file’s metadata to search for indications of tampering. The company explains,

FourMatch leverages the fact that there is nearly endless variety to exactly how hardware and software products can choose to store a JPEG file. This variety results in a distinctive set of “signatures” from each hardware and software product. Once an image has been edited and resaved from a software product, this signature is changed to match the software rather than the original capture device. Thus, when a file signature correctly matches a known signature from the device that captured the photo, you can be confident that the photo has not been edited.

Fourandsix has built a database of more than 70,000 signatures representing more than 2,400 camera models and mobile devices, as well as signatures from a variety of image editing programs and online services. When you purchase a copy of FourMatch, you’re also purchasing access to this valuable database, which is updated frequently as new devices become available. Loaded with this database, FourMatch can quickly assess the authenticity of many images.

Appearing as a floating panel on the right side of your Photoshop workspace, the plug-in shows a “green light” when the currently open JPEG file has metadata that matches the company’s signature database. This means that the photo has not been edited at all since leaving the camera from whence it came.

A red light indicates that the camera information metadata has been completely stripped away from the image — a sure sign that the image has at least gone through some kind of processing.

Yellow indicates that a camera has been identified, but the metadata signature doesn’t completely match an entry in the database. This doesn’t necessarily prove photo manipulation, since alterations that don’t affect the visual image itself can still alter the EXIF data.

The plugin can also make an educated guess as to which program was used to edit the photo, even if there isn’t any mention of the program in the metadata.

Check out this introduction video for a better idea of how the plugin works:

Determining the authenticity of images is useful for a variety of fields, from photojournalism and photo contests, to law enforcement and insurance.

The price of the program suggests that it’s not designed for ordinary consumers: a license that includes one year of maintenance and updates will set you back $890. The company is planning to donate 2 percent of the proceeds to the National Center for Missing & Exploited Children in an effort to combat the abduction and sexual exploitation of children.

Discussion