Source Identifying Forensics for Digital Media

A system, comprising:

• at least one data processor;
• and
• memory storing instructions configured to cause the at least one data processor to perform operations comprising:
• receiving an image file;
• parsing the image file to identify a plurality of structural elements of the image file;
• determining, based on one or more identified structural elements, at least a first marker, sub-marker, or key-value pair and a second marker, sub-marker, or key-value pair associated with the image file;
• generating, based on the identified structural elements and at least the first marker, sub-marker, or key-value pair and the second marker, sub-marker, or key-value pair, at least one profile structural signature that characterizes a combination of attributes specific to at least one of a type of device and a type of program that wrote the image file;
• and
• providing, using a graphical user interface, a visual representation of the profile structural signature, wherein the visual representation includes a mapping of at least the first marker, sub-marker, or key-value pair and the second marker, sub-marker, or key-value pair.

A non-transitory computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing system, cause the at least one data processor to implement operations comprising:

• receiving an image file;
• parsing the image file to identify a plurality of structural elements of the image file;
• determining, based on one or more identified structural elements, at least a first marker, sub-marker, or key-value pair and a second marker, sub-marker, or key-value pair associated with the image file;
• generating, based on the identified structural elements and at least the first marker, sub-marker, or key-value pair and the second marker, sub-marker, or key-value pair, at least one profile structural signature that characterizes a combination of attributes specific to at least one of a type of device and a type of program that wrote the image file;
• and
• providing, using a graphical user interface, a visual representation of the profile structural signature, wherein the visual representation includes a mapping of at least the first marker, sub-marker, or key-value pair and the second marker, sub-marker, or key-value pair.