Digital Forensics Detection and Disruption of JPEG Steganography by George Jasper Trawick II A dissertation submitted to the Graduate Faculty of Auburn University in partial fulfillment of the requirements for the Degree of Doctor of Philosophy Auburn, Alabama August 9, 2010 Keywords: Steganography, Digital Forensics, Information Assurance Copyright 2010 by George Jasper Trawick II Approved by John A. Hamilton Jr., Chair, Professor of Computer Science Kai H.Chang, Professor of Computer Science Eric S. Imsand, Assistant Research Professor of Computer Science ii Abstract The use of digital media and internet communications has grown for business and personal use, and so has the use of digital communications by criminal and terrorist elements. Of particular interest in both criminal investigations and national security is the use of covert communications channels by terrorists and criminals. A primary challenge faced by law enforcement is founded in the tremendous capacity of modern storage devices. The terabyte sized digital storage available to the public today allows for enormous amounts of evidence items to be hidden among millions of mundane, generic files. To forensically image and analyze these files can take days, sometimes weeks. When a criminal uses steganography to hide illicit content inside the otherwise mundane files, the investigators? mission becomes many times more difficult, if possible at all. Criminals are using applications that implement digital steganography to secretly communicate, plan, coordinate and execute their unlawful activity. When criminals add encryption to the immense number of steganographic implementations available it results in a combination proving to be nearly insurmountable for law enforcement and government agencies. This research introduces a unique and novel method that allows for the detection and possible tracking of steganographic messages hidden on a suspect?s digital storage device. The current state of the research shows that there are opportunities in exploration of specific areas of JPEG implementation combined with non-traditional hashing iii techniques; to find new methods for detection of steganographic images. This research focuses on a particular genre of steganography that is implemented using JPEG images. In particular this research focuses on those steganographic implementations that exploit the transform domain of the JPEG compression algorithm. The findings in this research demonstrate that within the results from the JPEG compression algorithm are artifacts that remain constant between repeated compressions. This research uses emerging methods of non-traditional hashing to expose likely steganographic images within a finite set or database of images and identify a possible digital fingerprint allowing law enforcement new capabilities in coping with the use of steganography as a tool for criminal activities. iv Acknowledgments I am truly proud and humbled by all of the people who have willingly sacrificed for me and have contributed to my research, both directly and indirectly. It has been my privilege to work with a great collection of outstanding professors and students during my time at Auburn University. I begin by thanking my advisor, John Andrew Hamilton Jr. Drew your unwavering support has helped me in succeeding in the completion of this research. I am honored to have been a part of the Information Assurance Exercise and the Wounded Warrior Forensics training that Auburn University provides to our nations wounded service members. I will keep the memories of teaching those men and women with me for the rest of my days. I must also recognize the sacrifices of my family during this long struggle of research. To Mom and Dad, watching over me still, your love and wisdom instilled in me those traits necessary to achieve all that I have. Dad, thank you for inspiring me to become a leader of men, a seeker of the light that knowledge provides and teaching me to always choose the path of greatest reward, not of least resistance. To my wife and daughters, Robbie, Tiffany, and Tasha, each of you have provided me with the inspiration I needed throughout my time at Auburn and in the U.S. Army, to keep moving forward. Thank you, for keeping me constantly striving to set the best example for you and to make you as proud of me as I am of each of you. v To the Long family, Cheryl, Ben, Keller and Abbey, you may never fully realize how much your generosity and sacrifices have enabled Robbie and I to achieve the completion of this research. I am forever indebted to each of you. I must also pay a special tribute to my brothers and sisters in arms, those members of the United States Armed Forces, who stood watch on the front lines; while I labored safely here at home. Not a day passes that I am not grateful for your sacrifice and aware of my blessings. There are several dozen folks who have stood beside me over the years. Of note are the leaders and mentors I had the fortune to work for at the United States Joint Forces Command. First, a special thanks to Lynn Schug, the true Chief Information Officer (CIO) of Joint Force Command. Thank you, for believing in me and putting your reputation on the line to see that I was not overlooked by the labyrinth of leadership within Joint Forces Command. Thank you for helping me to set the foundations that led me to this point and never letting me travel too far off track. To Colonel Mark Vanous, USMC, thank you, for your mentorship, leadership and friendship. It was your commitment to my success that assured that I would have this once in a lifetime opportunity and your unwavering support that motivated me to see it through. Finally to Colonel Robert Troisi USAF, thank you for your guidance and support. It was your experience and no non-sense leadership that kept me focused on the goals of achieving all that I possibly could both militarily and academically. Finally, I want to thank God for all the blessings I have received in my life, the glory of my achievement most surely belongs to You. vi Table of Contents Abstract .......................................................................................................................... ii Acknowledgments ......................................................................................................... iv List of Tables and Figures ...............................................................................................x Definitions ................................................................................................................... xiii Chapter 1 Introduction ....................................................................................................1 Chapter 2 Related Work ..................................................................................................5 2.1.1 Steganographic Applications ..........................................................................5 2.1.2 Steganalysis.....................................................................................................9 2.1.4 Digital Hashing .............................................................................................18 2.1.6 Piecewise Similarity Hashing .......................................................................19 2.2 Observations ........................................................................................................23 Chapter 3 Motivational Example ..................................................................................24 Chapter 4 Experimental Design and Theory .................................................................27 4.1 Persistent Discernable Landmarks in JPEG Images (Theory I) ..........................30 vii 4.1.1 Experimental Data and Software Collection.................................................31 4.1.2 Theory I Experiment and Data Structure ......................................................37 4.1.3 Data Sample and Image Category Validation ...............................................38 4.1.4 TEST 1 Quality Reduction by 20% ..............................................................41 4.1.5 TEST 2 Image Rotation by 180? ...................................................................42 4.1.6 TEST 3 Size Reduction by 20% ...................................................................42 4.1.7 TEST 4 Quality Reduction by 50% ..............................................................43 4.1.8 TEST 5 Size Increase by 20% ......................................................................43 4.1.9 TEST 6 Restore Test1 Quality ......................................................................43 4.1.10 TEST 7 Restore Test 4 Quality ...................................................................44 4.1.11 TEST 8 No Manipulation Save As only .....................................................44 4.2 Experimental Results ...........................................................................................45 4.2.1 Test 1 All Image Categories .........................................................................45 4.2.2 Test 2 All Image Categories .........................................................................47 4.2.3 Test 3 All Image Categories .........................................................................49 4.2.4 Test 4 All Image Categories .........................................................................50 4.2.5 Test 5 All Image Categories .........................................................................51 4.2.6 Test 6 All Image Categories .........................................................................53 4.2.7 Test 7 All Image Categories .........................................................................55 4.2.8 Test 8 All Image Categories .........................................................................58 4.3 Theory I Conclusion ............................................................................................59 4.4 Landmark ZVMCUs can be used for Image Identification (Theory II) ..............60 4.4.1 Theory II Experimental Process....................................................................61 4.4.2 Theory II ZVHash Value Comparison Test ..................................................61 viii 4.4.3 Theory II False Positive Test ........................................................................62 4.5 ZVHash Experimental Results Theory II ............................................................63 4.5.1 Known History Categories I-III ZVHash Results .........................................64 4.5.2 Unknown History Categories IV-VI ZVHash Results .................................65 4.5.3 Special Case Categories VII-VIII ZVHash Results ......................................66 4.5.4 False Positive Experimental Results .............................................................68 4.5.5 Saturation Exempt ZVHash Results .............................................................70 4.5.6 Saturation Adjusted False Positive ZVHash Results ....................................71 4.5.7 Realistic Test Condition Results ...................................................................72 4.6 Theory II Conclusion ...........................................................................................74 4.7.1 Theory III Experimental Process ..................................................................76 4.7.2 Steganographic Embedding Experimental Results .......................................79 4.7.3 Test 8 to Steganographic Embedding Routine Examinations .......................81 4.7.4 Steganographic Embedding Routine Anomalies ..........................................82 4.4.6 Results of Levene Test for Equality of Variance ..........................................85 4.7.5 ZVMCU Homogeneity as Steganographic Indicator ....................................87 4.7.6 Theory III Conclusion ...................................................................................95 Chapter 5 Key Contributions and Conclusion...............................................................97 5.1 Key Contributions ...............................................................................................97 5.2 Conclusion ...........................................................................................................98 Chapter 6 Future Work ................................................................................................100 Bibliography ................................................................................................................101 Appendix A: Publically available Steganographic programs ....................................105 ix Appendix B: References for Sample Size Calculations. ............................................108 Appendix C: Detail results for Test One all image Categories ..................................109 Appendix D: Detail results for Test Two all image Categories .................................114 Appendix E: Detail results for Test Three all image Categories................................119 Appendix F: Detail results for Test Four all image Categories .................................124 Appendix G: Detail results for Test Five all image Categories .................................129 Appendix H: Detail results for Test Six all image Categories ...................................134 Appendix I: Detail results for Test Seven all image Categories ................................139 Appendix J: Detail results for Test Eight all image Categories .................................144 Appendix K: Source code: Zero Variance Minimal Computer Unit Locator ............149 Appendix L: Source Code: ZVMCU results .............................................................154 Appendix M: Source Code for ZVHashComparer.py ................................................158 Appendix N: Source Code for Mover.py ...................................................................161 Appendix O: Source Code for FalsePositveTest.py ...................................................162 Appendix P: MD5 Hash Results for Theory III .........................................................166 Appendix Q: Wald-Wolfowitz Runs test Details ........................................................175 Appendix R: Chi-Squared Critical Values ..................................................................177 Appendix S: Frequency Tables for ZVMCUs? ? ? ? ? ? ? ? ? ? ? ? ? ? ...181 x List of Tables and Figures Figure 1: Steganographic-Secret communications process. ................................................2 Figure 2: Steganographic Component Relationships .........................................................10 Figure 3: Visual Example of the JPEG Compression Routine ..........................................13 Figure 4: The RGB to YCbCr transform from the EXIF standard version 2.1. ...............14 Figure 5: Visual Representation of 64 DCT coefficients (Khayam 2003) ........................15 Figure 6: Two Dimensional DCT Transform ....................................................................16 Figure 7: Quantization matrix. Courtesy: images.digitlmedianet.com .............................17 Figure 8: Traditional Hash routine compared to Piecewise Context Hash Routine ..........20 Figure 9: Demonstration of Digital Forensic imaging .......................................................22 Figure 10: Steganographic & Sibling image detection process overview .........................26 Figure 11: A ZVMCU compared to a Non-Zero Variance MCU ......................................32 Figure 12: The ZVMCU Locator Program ........................................................................33 Figure 13: Manipulation Comparisons to Baseline for Establishment of ZVMCUs .........34 Figure 14: Wald-Wolfowitz Runs Test Results .................................................................39 Figure 15: Wald Wolfowitz Runs test on All images (size) ..............................................40 Figure 16: ZVMCU Frequency Test (StatPlus2009 v5.8) .................................................41 Figure 17: Test 1 ZVMCUs Delta .....................................................................................45 Figure 18: Average number of ZVMCUs per Image .........................................................46 Figure 19: Test 2 ZVMCUs Delta from baseline...............................................................48 xi Figure 20: Impact of rotation on average ZVMCUs per image .........................................48 Figure 21: Test 3 impact on average number of Zero Variance MCUs per image ............50 Figure 22: Percentage of images with ZVMCUs compared from test 1 & test 4 ..............51 Figure 23: Test 5 Average ZVMCUs per image to Baseline data .....................................52 Figure 24: Test 5 Change of Percentage of Images with ZVMCUs to Baseline ...............52 Table 1: Quantization table for Test 1, Image 1, and Category 2 ......................................54 Table 2: Quantization table for Test 6, Image 1, and Category 2 ......................................54 Figure 25: Change in ZVMCUs per Image Test 6. ............................................................55 Table 3: DCT quantization tables for Image 8, Image Category 1 Test 4 .........................56 Table 4: DCT quantization table for Image 8, Image Category 1 Test 7 ...........................56 Figure 26: Number of Images with ZVMCUs & Average ZVMCUs per image ..............58 Figure 27: Visual representation of the ZVMCU Hash Comparison process ...................62 Figure 28: ZVHash Results Categories I-III .....................................................................64 Figure 29: ZVHash Results for Unknown History categories ...........................................66 Figure 30: ZVHash results for special cases ......................................................................67 Figure 31: False Positive test one Categories 3-5 ..............................................................69 Figure 32: Demonstration of ZVMCU value saturation impact on false positives ...........69 Figure 33: False Positives test two Categories 2-6 ............................................................70 Figure 34: Effects of Zero Saturated ZVMCUs on match rates ........................................71 Figure 35: Saturation settings effect on false positives .....................................................72 Table 5: Real World Example Test Results for 16 Suspect Images ..................................74 xii Table 6: Size chart for hidden data embedded in cover images. ......................................79 Figure 36: Steganographic Routine embedding results .....................................................80 Figure 37: Saturation Exempt ZVHash matches for Steganographic images....................81 Figure 38: ZVMCU Count Distribution for Baseline images ............................................83 Figure 39: Image Sample Size Distribution All 4000 Images in Sample Set ....................84 Table 7: Levene Test for Equality of Variance for Save As images .................................86 Table 8: Levene Test for Equality of Variance for Steganographic images .....................86 Figure 40: Steganalysis process using ZVMCUs & Non-Traditional Hashing .................88 Figure 41: Histogram for Suspect image set ZVMCU quantity .......................................90 Figure 42: Suspect Image Dataset Size Distribution ........................................................91 Table 9: Suspect Image Set total ZV matches ..................................................................92 Figure 43: Steganographic Detection process overview ....................................................93 Figure 44: Steganographic suspects from dataset of 1700.................................................94 xiii Definitions Zero Variance Minimal Computer Unit (ZVMCU): The nomenclature used to describe a grouping of 64 pixels extracted as an 8 X 8 block, where the color values of every one of the 64 pixels are equal. Having identical RGB values results in the JPEG compression routine having minimal impact on the DCT coefficients of that MCU. Image Categories: A compartmentalization of images based upon their origin, size, resolution, and size -resolution relationship. There are eight image categories used in this research. Data Sets: A data set is a compartmentalization within an Image Category that further divides the group of images into a manageable number based upon the number of baseline ZVMCUs within the image. Each Image Category is divided into six individual datasets. Minimal Computer Unit: Terminology used to describe the 8 x 8 block of pixels used by the JPEG compression routine and used in this research as the building blocks of the partial image hash routine. Hidden Data: Can be any type of digital data that is concealed using steganography. The hidden data is embedded into a cover image. xiv Cover Image: An image file that is used as a container for embedding hidden data. A cover image does not have hidden data; it is merely a container. Once data is hidden within the image, it becomes a Steganographic Image. Steganographic Image: Also called a Stego Image: is an image file with data hidden inside the file structure. The data may be hidden with any number of steganographic techniques, as detailed in Appendix A. A steganography image is created using a cover image and hidden data. Consanguineous: From the American Heritage dictionary ?Of the same lineage or origin; having a common ancestor.? (The American Heritage? Dictionary of the English Language 2004.) In this dissertation, consanguineous is used to differentiate JPEG images which are visually identical, but are not from the same original parent image, from those images that originate from the same singular parent JPEG image. For readability the term sibling is used interchangeably with consanguineous. Digital Hash: A hash is an alphanumeric value mathematically derived by applying a hashing algorithm to a digital file. A digital hash must be one way, meaning you cannot derive the digital file contents from the digital hash. Also, every digital hash for every digital file must be unique; no two different files should ever have the same digital hash value. 1 Chapter 1 Introduction Steganography is the art and science of secret communications. The use of steganography can be dated back thousands of years. Some of the earliest known steganographic uses were military in nature. Beginning with Demaratus? use of wax tablets to cover secret orders to his commanders in the war on Greece around 480BC, (McCullagh 2001) (Hosmer and Hyde 2003) through World War I and II with the use of microdots and invisible inks, and continuing today with Al-Qaida?s use of steganography to organize attacks on America and other countries around the globe, covert communications has proven a necessary and valuable tool. (Kelly 2001) (Kellen 2001) 2 Figure 1: Steganographic-Secret communications process. When applied in today?s digital world, the use of steganography allows for the secret transmission of large amounts of information from one source to many receivers covertly or it may be used to simply hide criminal activities from outside detection. The use of this technology is not limited to terrorists and warriors. All types of criminals are exploiting the power of steganography to hide their illegal activities from law enforcement. Of all the criminals, child pornographers are of particular interest. Child pornographers are using steganography to secretly transmit and store illegal images of children free from detection by current law enforcement wiretap and tracing techniques. Steganography is nearly impossible to detect in transmission, and it is just as difficult to detect within data at rest on a computer. Law enforcement and national security analysts need improved methods to detect hidden content, in order to find, track, prevent, and prosecute these criminals. While there is ongoing research in both the embedding and detection algorithms of steganography, most of the research is limited in scope to a particular type of media or 3 to a particular set of known steganographic programs. Further, the current state of the art steganography detection shows that there is still vast room for improvement in both the detection and extraction of covert messages within steganographic images. The research presented here demonstrates previously unknown methods enabling law enforcement the ability to detect and possible track JPEG steganographic images residing within a finite set of digital images. This capability will prove especially useful for use by computer forensic investigators. This research offers the following contributions to the computer science field. This research produced an ability to identify unique, stable, and persistent landmarks within an image that endures the JPEG lossy compression algorithm, which does not exist today. Further, these methods are the first to use non-traditional hashing techniques (Hurlburt 2009) (J. Kornblum 2006) (Roussev, Golden and Marziale, Multi-resolution similarity hashing 2007) as a method to compare images with the specific purpose of steganography detection among a captured set of JPEG images. Next, by using new techniques and combinations of old techniques, this research is unique in offering law enforcement methods that will reduce the amount of time and effort needed in finding and extracting only those images that are most likely to have hidden content. The results of this research provide law enforcement investigators and national security analysts a new ability to find consanguineous or sibling images on a computer that have different digital message digest. Having the ability to find persistent landmarks allows law enforcement to discover and possibly track how and where images are being shared. The remainder of this dissertation is organized as follows. Section 2 summarizes related work in the area of image steganography, steganalysis and non-conventional 4 hashing techniques. Section 3 is motivational example. In Section 4, the experimental design, experiment processes and experiment results are detailed. Section 5 details the key contributions and conclusions of the research. Section 6 gives an overview of future research and work. 5 Chapter 2 Related Work 2.1 Strengths/Limitations of Related Work The related works to this research are widely varied covering areas from digital steganography applications, Joint Photographic Experts Group (JPEG) standard implementation and compression, digital hashing algorithms and steganalysis. While the effects of the JPEG compression routine on the implementation of certain steganography algorithms formed the genesis for this research, the limitations in the areas of steganography, steganalysis, and non-traditional hashing compose the main motivators of the research. 2.1.1 Steganographic Applications Currently there are many researchers who are involved in extensive work researching to identify and quantify the implementation strengths and weakness of the currently available steganographic implementations (Kharrazi, Sencar and Memon 2005) (Lin and Delp 1999) (Dunbar 2002). Evidence shows that researchers are focused on new and innovative techniques to improve the current state of steganographic technologies, (Chae and Manjunath 1999) (Fridrich, Pevy and Kodovsk, Statistically undetectable jpeg steganography: dead ends challenges, and opportunities 2007) (Filler and Fridrich 2009). Researchers for professional organizations and corporations seem interested in detection 6 and extraction of steganographic images (Cole 2003) (Dunbar 2002) (Hurlburt 2009) (Kellen 2001). In their research of the current strengths and weakness of universal steganalysis, Kharrazi et al, worked with both steganalysis and steganographic technologies, and demonstrated several embedding techniques used for JPEG images (Kharrazi, Sencar and Memon 2005). In other research, Lin and Delp explained that there are generally three common techniques used to embed information in digital images and classified these techniques as Least-Significant Bit embedding (LSB), transform embedding, and perpetual masking (Lin and Delp 1999). Other authors, like Karen Bailey and Kevin Curran (Bailey 2004), describe the embedding techniques from a slightly different perspective. These authors describe image noise, clutter, texture and signal as four general models for embedding a message in an image. LSB embedding would fall into the noise model, transform embedding would be categorized as signal, and perpetual masking would be in the clutter model. The texture model is more suited for watermark technologies as the manipulation within this domain could be made visible in the image. Yet another author, Eric Cole, has a different classification scheme. In his book, Hiding in Plain Sight, Cole describes three classifications for steganography, insertion based, substitution based, and generation based (Cole 2003). This categorization is broader and more general than the previous examples such that Cole?s substitution classification would encompass all three areas previously described. The insertion based techniques do not alter the original bits that represent the image; instead they exploit areas of the file that are disregarded by applications that read the file. This has an advantage of allowing a larger size hidden message but a disadvantage in that 7 it is easier to detect and extract. The generation class steganographic applications create a new image file from the message file. The major drawback to creation method is that the file created, usually a fractal image, (Cole 2003) does not represent a real object and would draw attention from most examiners. There are hundreds of available steganographic programs (appendix A). This study will use only a few of the more well-known applications from each model or classification set as an example to explain the overall methodology of the implementation routines. Least-Significant Bit (LSB) embedding is used by the applications like S-tools and EZsteg. (Johnson and Jajodia 1998) S-Tools and EZsteg employ the LSB technique each using a slightly different implementation with S-tools focused on 24 bit images and EZsteg working with 8 bit images. Neither of these implementations will work with JPEG images, however, because the lossy JPEG compression algorithm would destroy any embedded data (Johnson and Jajodia 1998). As noted by Neil Provos, (Provos 2001) the LSB embedding process inevitably alters the statistical characteristics of an image file, making any rudimentary LSB implementation statistically detectable. Another technique is employed by the program Outguess, which uses two steps in its steganographic algorithm. First, Outguess uses a method to determine the maximum amount of data that can be embedded without detectable changes to the images? first order statistics and the second step is the use of a pseudo-random number generator (PRNG) to generate a seed starting point overcoming the limitations of serial insertion into the LSB of an image. However, because Outguess replaces the bits that represent the colors of an image, it suffers from visual degradation of the image as the embedded file 8 size reaches its maximum. The next steganographic technique researched is the method employed by the F5 application. F5 does not use LSB to embed the secret message. Instead, F5 falls into the category of transform techniques. F5 embeds its digital message in non-zero AC-DCT1 coefficients, if the embedding process causes the coefficient to become zero; it skips to the next non-zero AC-DCT coefficient. Using the Discrete Cosine Transform (DCT) coefficients combined with a PRNG that is seeded by a user entered password, F5?s decrements the absolute value of the DCT coefficients by one. Then using a matrix embedding technique F5 spreads the secret message across the cover image in such a way as to be undetectable by most statistical attacks, according to the author of the algorithm (Fridrich, Goljan and Hogea 2003). As pointed to by Quach et al. (Quach, Perez- Gonzalez and Heileman 2009) many steganographic programs try to avoid detection by preserving first order statistics, hoping to make the files statistically identical. In all there is plenty of research in the area of embedding information into digital images in a multitude of manners, each with its own strengths and weaknesses. This area of research is useful and necessary for discovering new techniques, as well as, improving on old techniques of steganography. Understanding this area of research is indispensable for anyone interested in the field of steganalysis specifically for the intentional detection, disruption and extraction of steganographic messages. 1 The terminology AC-DC is a reference to electrical current. The term meaning Alternating or Direct Current for electrical circuits, here denotes the difference DCT coefficients. The AC coefficients are subject to quantization, and thus change, where the DC coefficients are not quantized and remain stable. 9 2.1.2 Steganalysis Where steganography is defined as the art and science of covered or concealed writing, Steganalysis is the art and science of the discovery of the covered writings or secret communications. Germane to the research here, steganalysis is any technique or procedure that can be used to discover information embedded in a digital file. Just as cryptanalysis is to cryptology, steganalysis is to steganography. Similar to cryptanalysis, there are several broad areas of Steganalysis. Quach et al., point out two categories they call ?method-specific and universal?. (Quach, Perez-Gonzalez and Heileman 2009) These terms are very descriptive. The method- specific steganalysis category aims to detect only certain types of steganography or steganographic images produced from a particular program. Universal steganalysis looks to discover the presence of any hidden data in a steganographic image regardless of technique. (Goljan, Fridrich and Holotyak 2006) There are databases of known steganographic signatures available to the forensic investigators (Wingate 2005) that fall into the method-specific category, and while useful, there are increasing numbers of new and undocumented techniques that demonstrate a need for universal detection. Several interesting examples of universal techniques come from Fridrich et al. (Fridrich, Goljan and Du, Steganalysis based on JPEG compatibility 2001) and Lyu et al. (Lyu and Farid n.d.) Fridrich?s approach uses the DCT quantization tables of both the cover image and steganographic image. The quantization tables are examined and compared to determine if the resulting DCT coefficients have been modified. In another work by Lyu et al, they used ?multiscale and multiorientation image decomposition? to analyze the first and higher order magnitude and phase statistics of digital images. They 10 developed an effective universal steganalysis technique but its capability was limited to detection of steganographic images that had hidden data that exceeded 95% of the capacity of the cover image. This technique would be ineffective against steganographic images that embed to less than 50% of capacity. These two techniques have a couple of elements in common. First, is the reliance on the availability of the original cover image for comparison. Second, both techniques are looking for a set of features that can be used to distinguish a steganographic image from a non-perturbed cover image. The relationship of the cover image, hidden message, steganographic algorithm and steganographic image is shown in figure 2. Figure 2: Steganographic Component Relationships Unlike cryptanalysis, to defeat steganalysis there is no need to reveal the hidden message. In steganalysis revealing that there is secret communications occurring removes the power of steganography. But similar to cryptanalysis, steganalysis still attempts to reveal the hidden or secret message. In the discussion of universal steganalysis, it is useful to compare quickly with universal cryptanalysis. Three scenarios for uncovering the encrypted or in this case hidden message exist: 11 The analyst has: 1. The original cover image file and suspected steganographic image file. 2. The hidden message file and the known steganographic image file. 3. The steganographic embedding algorithm and steganographic image file. Steganalysis applications and theory rely on having access to more than one portion of the embedding method. Universal steganalysis uses any two of the three in combination to create a data set of known artifacts. Then using analytical methods, they use these known artifacts to create steganographic classifiers to identify suspected steganographic files (Quach, Perez-Gonzalez and Heileman 2009). This research will provide a method that allows the analyst access to the original cover image if it?s available 1.3 JPEG Implementation Standards. The Joint Photographic Experts Group (JPEG) is responsible for the publication of the JPEG standard, formally known as ISO/IEC IS 10918-1 (Wallace 1991) (Khayam 2003) and is officially titled Digital Compression and Coding of Continuous-tone Still Images (ITU81). The standard is a collaborative effort between the International Telecommunications Union (ITU)2 and the International Standards Organization (ISO) to develop standardized methods for the representation, storage, and transmission of graphical images. Though the standard outlines requirements for both lossy and lossless implementations, the default and most widely used implementation is the lossy format and is the focus of this research. It is the changes to the digital signature of an image file during the compression and decompression of digital images that presents the forensic 2 ITU (International Telecommunication Union) is the United Nations Specialized Agency in the field of Telecommunications. Some 166 member countries, 68 telecom operating entities, 163 scientific and industrial organizations and 39 international organizations participate in CCITT which is the body which sets world telecommunications standards (Recommendations). 12 examiner with the challenge of finding and matching suspected image files with known image files. The quantization of the DCT coefficients during the JPEG compression process is the fundamental area of data loss, and hence changes to the digital hash of an image file. However, data loss during the compression process is not the only reason that two identical inputs will produce digitally different outputs. As noted by Wallace, ?independently designed implementations of the very same (Forward Discrete Cosine Transform) FDCT or (Inverse Discrete Cosine Transform) IDCT algorithm which differ even minutely in precision by which they represent cosine terms or intermediate results, or in the way they sum and round fractional values will eventually produce slightly different outputs from the very same input.? (Wallace 1991) This is the reason that an image opened and saved in an image editing software package will have a different digital signature from the original image or the exact same image opened and saved by a second image editing software package. An in-depth examination of the JPEG compression routine introduces several areas of interest for research into digital artifacts. Figure 3 gives an overview of the JPEG compression/decompression components in sequence. Of note is that the quantization tables and Huffman coding tables used are stored in the header information of the compressed file in accordance with the EXIF standard. (JEITIA, EXIF Format for Digital Still Cameras: Version 2.2 2002) A deeper look at each of these is important to understand where in this process we might find an exploitable artifact that will remain constant between compressions as well 13 as, any limitation that will exist in the stability of such an artifact. Figure 3: Visual Example of the JPEG Compression Routine Figure 3 is a visual representation of the JPEG compression and decompression routine, of note is the location of the quantization tables in the process. The formal equation for the two dimensional discrete cosine transform takes the form that follows: In the DCT transform equation above, In the example, u and v are horizontal and vertical spatial frequencies for an 8x8 sample. 14 An image is a series of pixels laid out in a 2 dimensional X-Y plain. The two dimensional Discrete Cosine Transform yields a set of frequencies based upon the values derived from 8x8 blocks of these pixel values. The 8x8 blocks (F(x,y)) of image values are extracted starting in the upper left corner and working from left to right, top to bottom of the image. (Khayam 2003) The first step in the compression of a JPEG image is to transform the pixel data from the 24 bit Red Green Blue (RGB) domain into the 8 bit YCbCr (YCC) domain. The algorithm takes as input three 8 bit numbers ranging from (0-255) representing red, green, and blue colors of a pixel. The algorithm seen in figure 4 demonstrates how the numbers are then parsed through a reversible, but not lossless, color space transform into Luminance(Y),Chrominance Red (Cr) and Chrominance Blue (Cb), commonly written as YCrCb, as mandated in ITU-R BT.601. (JEITIA, EXIF Format for Digital Still Cameras: Version 2.2 2002) Figure 4: The RGB to YCbCr transform from the EXIF standard version 2.1. As noted by Sorell (Sorell 2008) and Khayam (Khayam 2003) transforming the values from the RGB color space to the YCrCb color space, allows for the targeted reduction of only those values that are least detectable by the human eye. These YCrCb values are further adjusted from unsigned values to signed values before they become the input to the DCT. Figure 5 is used to demonstrate a common visual example of the 64 DCT coefficients of an 8x8 image block. The horizontal frequencies are represented by u in the transform equation and the vertical frequencies are represented by v. 15 Figure 5: Visual Representation of 64 DCT coefficients (Khayam 2003) As a visual example, figure 5 also demonstrates how the lower frequencies of an image block are represented in the upper left corner, where the higher frequencies are presented in the lower right corner. This critical step allows the use of quantization tables in the quantization step to be predetermined for certain levels of quality. These predetermined tables may offer an opportunity to find stable artifacts or a fingerprint that remains through the JPEG compression routine. Kornblum noted in his research that it is possible to distinguish images that have been modified by software from those untouched images through the analysis of the quantization tables. (J. D. Kornblum 2008) The quantization tables have larger values towards the lower right corner which when used as the divisor of the quantization coefficients allows for greater reduction of the higher frequency values within the DCT coefficients. Specifically, splitting the signal in to three channels, Y is the brilliance or brightness of a particular pixel and CbCr or chrominance of blue and red channels respectively. The samples values are then shifted by -128 to center the values on zero. 16 (Wallace 1991) The focus of the JPEG DCT lossy compression is on the color channels. The more detectable channel of brilliance is recorded as the DC component in the most upper left hand corner of the coefficient transform matrix. These 8x8 blocks of shifted CbCr values are then used as input into the 2D DCT with the output being the 64 DCT coefficients for the 8X8 block (F(u,v)). The outcome of the DCT is that the 8x8 blocks have been transposed from their DCT coefficients into the spatial frequency3 signal components, specifically the DC or non fluctuating and AC or changing components. Figure 6 demonstrates a commonly used example of a resulting 2D DCT transform. Of note in figure 6 is the relative positioning of the absolute values of the coefficients. Notice how the values progress from upper left to lower right. Also, notice the DC value in the upper left corner is much larger than the remaining AC values. Figure 6: 2 Dimensional DCT Transform This feature of the 2 dimensional DCT to always place the DC (non-changing) value in the upper right corner provides an avenue of research for a stable JPEG artifact. However, this value is not stored and is dependent on the actual Y channel value of the preceding 8x8 block (MTU). This value is subject to change from one compression to the next and does not remain absolute through the compression decompression cycle. However there is evidence that it is possible to identify the tables used in prior 3 Spatial Frequency is a measure of changes in pixel values across an image block 17 compressions and therefore, possible to determine the original DC value of an image. (Sorell 2008) Another area of possible exploration is the use and storage of the quantization tables. An example quantization table that is often used in literature is shown in figure 7. Figure 7: Quantization matrix. Courtesy: images.digitlmedianet.com Though, there are commonly used tables that are recommended by the JPEG standard (JEITIA, EXIF Format for Digital Still Cameras: Version 2.2 2002), applications and developers are free to implement their own. However, most standard and readily available applications use the recommended tables; this was problematic to Kornblum?s research (J. D. Kornblum 2008). Kornblum researched the possibility of determining the origin of an image, either by camera type or software developer, based upon the values used in the quantization tables. So the use of standardized tables is problematic for Kornblum?s categorization research. However, it is the standardized implementation of the tables that is germane to the research presented here not the values within the tables. Further, there is evidence that the steganographic community has knowledge of the flaws of the current quantization tables and some are looking to use custom tables to improve steganographic performance (Almohammad, Ghinea and Hierons 2009). 18 2.1.4 Digital Hashing Roussev et al addressed some of the issues facing digital forensic investigators today. ?Large-scale digital forensic investigations present at least two fundamental challenges. The first one is accommodating the computational needs of the large amount of data to be processed. The second one is extracting useful information from the raw data in an automated fashion?. (Roussev, Richard and Marziale, Multi-resolution similarity hashing 2007) This research addresses these two challenges using novel methods to identify only those images most likely to contain steganographic material and sibling images within a dataset. 2.1.5 Overview of traditional cryptographic hashing. A hash function is a mathematical algorithm that takes as its input an arbitrary amount of data and produces an output of a predetermined fixed length. The length of the output is the same regardless of input size. Cryptographic hash functions are regarded as primitive functions for many other cryptographic functions. (Silva 2003) The viability of a hash function is dependent upon several basic principles. For a one way hash function: The hash function must be published with no obscured input. The output of x? is always a fixed and predictable length regardless of input x. The hash function h(x) must generate a unique output x? for all input x. There can be no information about input x derivable from x?. (Preneel 2005) For the area of digital images, as with other digital files, hash functions are useful and powerful tools that allow the detection of even the slightest change of a document or file. Further, for the field of digital forensics, hash values offer a powerful method for 19 examiners to filter through the enormous amounts of digital data and separate known files from unknown files. Companies such as Access Data provide databases of cryptographic hashes of known file types for just this purpose. (Hurlburt 2009) There are other companies and agencies that offer specialized hash databases such as the Steganography Analysis and Research Center (SARC) that provide a database for known steganographic programs. (SARC Editort 2009) There is also the National Center for Missing and Exploited Children (NCMEC) that provides a hash database of images of known exploited children to law enforcement agencies. (NCMEC n.d.) These applications of cryptographic hashing while useful do not fulfill the purpose of this research. There are several areas of non-traditional hashing that shows promise for allowing the comparison and extraction of visually similar digital files from a finite set of digital files. 2.1.6 Piecewise Similarity Hashing Jesse Kornblum detailed his technique of context triggered piecewise hashing in 2006. (J. Kornblum 2006) The author describes a method to use traditional hash functions in a method he refers to as context triggered, to determine similarity between two digital files whose traditional hashes would not match. As outlined in the paper, if a single file (F) is modified even by one bit, either through insertion or deletion, then saved as a separate file (F?) the cryptographic hash h(F) will not equal the cryptographic hash h(F?), however, F & F? will share large sequences of identical bits. A simple example would be changing a few words or even a single character in a text document or email then saving the document. Comparison of the cryptographic hashes of the two files would produce different hash signatures. However, the majority of the content in the two 20 documents is identical. Context triggered piecewise hashing breaks down the contents of a file into context triggered segments and then hashes each segment separately. The similarity between the files becomes a function of the number of identically hashed segments found within the file, see figure 8. This will prove to be a powerful tool for the computer forensic examiner allowing him to find text files that have been edited but are in fact the same document. There is a limitation of the author?s method that was noted. This method is not effective on JPEG image files. The JPEG compression algorithm modifies nearly every portion of the image file; the piecewise context triggered hashing would not be effective. (J. Kornblum 2006) Figure 8: Traditional Hash routine compared to Piecewise Context Hash Routine 2.1.7 Multi-resolution Similarity Hashing In working to address the fundamental challenges facing digital forensic investigators mentioned earlier, Roussev et. al worked to help reduce the effort and time required when creating hashes of large amounts of data, such as a multi-gigabyte storage device. In traditional forensic cases, the first order of business is to acquire a forensically 21 sound copy or image of the data set under investigation. With the large sizes of today?s storage devices, this process can take several hours to complete. Once complete a digital hash will be computed to validate the data integrity of the image and then the investigator can begin work on the collected data image. In their work, Roussev et al set out to develop a multi-resolution similarity hash that will run concurrently with the copy routine. (Roussev, Golden and Marziale, Multi-resolution similarity hashing 2007) The content is split into variable sized portions and then hashed into a series of Bloom filters.4 This allows for context discovery while the initial copy is being performed. The authors list several other benefits such as the technique works on arbitrary pieces of data, it is scalable allowing comparison of data sets that are orders of magnitude different in size, and maintains privacy, allowing partial hashes of datasets to be compared against known files without having to seize or open the questionable data. This concept of multi-resolution similarity hashing is useful for forensics, but falls short of being able to accommodate the bit level changes that are incurred when a JPEG file is manipulated by steganographic software. Therefore, it would not be capable of extracting consanguineous JPEG image files. The following graphic demonstrates the differences between the traditional methods for collecting forensic evidence from a suspect?s computer and the Multi- Resolution Similarity Hashing method. 4 A probabilistic algorithm to quickly test membership in a large set using multiple hash functions into a single array of bits. (http://www.itl.nist.gov/div897/sqg/dads/HTML/bloomFilter.html) 22 Figure 9: Demonstration of Digital Forensic imaging Another researcher that is looking at non-traditional hashing with an eye for both forensic and steganographic applications is Dustin Hurlbut from Access Data. In his publication, ?Fuzzy Hashing for Digital Investigators? (Hurlburt 2009) the author details the methods used by Access Data?s Forensic Tool Kit implementation of a fuzzy hash. This publication describes an actual forensics oriented implementation for the work done by Kornblum in his piecewise similarity hashing. There are a few minor differences in how the trigger values are determined and the implementation of the rolling hash algorithm. Otherwise, fuzzy hashing as described by Hurlbut is a corporate instantiation of context triggered piecewise hashing with the same JPEG oriented limitation as the original process. 23 2.2 Observations As explained in the previous section, there are gaps in the current state of digital steganography and steganalysis research. Further, there are possible discoveries that can be made in exploration of the JPEG implementation scheme and non-traditional hashing that could produce significant improvements in digital forensic investigations. The discoveries presented in this research bridge these gaps, explores the possibilities for digital forensics, and furthers the current state of the research providing an innovative method for the discovery of possible steganographic images and consanguineous JPEG image files. 1. Identify and bridge gaps in research between state of the art fuzzy hashing, serial hashing and JPEG compression for the identification of nearly identical sibling JPEG image files in a finite population. 2. Develop a method that will allow for the unique identification of JPEG images that is robust enough to survive recompression by JPEG lossy compression techniques. 3. Develop a quantifiable method for the reduction of suspect population of images, significantly reducing the forensic effort necessary to detect, identify and/or disrupt steganographic communications and techniques. 24 Chapter 3 Motivational Example Digital forensic investigators are taking notice of the use of steganography by ordinary users. The fact that steganography is available to hide communication and data from an investigator coupled with the extreme difficulty in detection provides the initial motivation for this research. In a whitepaper from BackBone security steganalysis is described as ?very young and evolving extension of traditional forensics? (Wingate 2005). BackBone Security is the parent company of the Steganography Analysis and Research Center (SARC). SARC provides a comprehensive database of known steganographic signatures, as well as, state of the art steganalysis software to the nation?s digital investigators and law enforcement officers. In researching the current state of steganography in digital forensics, I found there are areas of opportunity that might be exploited that can further improve the state of steganalysis, such as the fact that different JPEG manipulation software likely use different quantization tables resulting in different hashes of an identical file (J. D. Kornblum 2008), the use of different quantization tables has been explored by Farid, and he has produced a method to determine if a JPEG image has been altered by editing software and to identify which software most likely last edited the image. (Farid 2006) 25 Other research has indicated possible landmarks in JPEG images. Fridrich alluded to a ?semi-fragile watermark or unique fingerprint? that is available for comparison. (Fridrich and Goljan, Practical steganalysis of digital images: state of the art 2002). The apparent viable avenue of exploration in the JPEG compression routine may provide a method to identify stable landmarks in a JPEG image provides another motivation for this research. Additional motivation comes from a related areas of research, cryptographic hashing. Cryptographic hashing has proven a valuable and necessary tool in digital forensics. It is common to use databases of hashes of known files to discover or discard digital evidence in a storage device. Research has proven the usefulness of using partial or piecewise hashing to discover related text files, but has stopped short in being able to reliably do so for JPEG images. Even though doing so would greatly enhance an investigators chance of finding a steganographic cover object. (Hosmer and Hyde 2003) This lack of useful hash methods for JPEG images provides the final piece of motivation for this research. The research presented in this dissertation demonstrates that using the previously unexplored JPEG landmarks called zero variance minimal computer units (ZVMCUs) and a variation of the context triggered piecewise hash, called ZVHash it is possible to find visually similar JPEG files in a finite dataset. Further, using the comparisons of the ZVMCU quantities of the cover image and steganographic image it is possible to predict potential JPEG steganography in the same finite dataset. 26 Figure 10: Steganographic & Sibling image detection process overview Figure 10 gives a graphical introduction to this process that is described in detail in the rest of this work. The research presented in this dissertation shows that in the implementation of the JPEG compression standard there are avenues for the exploitation of the piecewise hash method that allows an investigator to match a suspected steganographic object with its cover object. The findings in this research provide new found methods for the detection of JPEG steganography and for the location and forensically viable matching of consanguineous JPEG images within a finite dataset. 27 Chapter 4 Experimental Design and Theory In the creation of a sample set of JPEG images on which to conduct experiments, the ability to sample the universal population of JPEG images is nearly impossible as there are no methods that would allow for the random sampling neither of every possible storage device nor to account for every JPEG image created. The size of the sample used in this research was a primary consideration. The sample size needed to be large enough as to facilitate reducing any unintentional bias that might occur from the limited sampling techniques. However, the sample size could not be so large as to make it computationally infeasible to manage. Initial calculations of an estimated sample size was conducted using the following formula from Creative Research Systems (Creative Research Systems 2010) Where: ss = sample size Z= confidence level (95% for this research) P = decimal value of likelihood of selection of wrong choice (50%) c= confidence interval, normally between 1 and 5. (3 for this research) 28 Selection of 95% confidence level provides assurance that the sample size will be adequate to mirror the universal population of JPEGs giving us a relative assurance that a any sample JPEG drawn from the parent population would have a 95% probability of fitting into our sample population this helps maintain the integrity of the findings of the research. The selection of a confidence interval also called the margin of error is normally expressed as a plus or minus expression of acceptable error in a survey. A margin of +/- 3% is a typically acceptable error rate for most sampling. Given these parameters the recommended sample size is ss = .952 * .50 *(1-.50)/.032 = 251 Careful consideration was given to the additional selection criteria for the images used in this research as well. These additional criteria also influenced the research sample size. The history of the image is an important factor in the experiments conducted in this research, as such; the availability of JPEG images with a known history became a determining factor for the sample size. A sample set of 1500 images, approximately 2.5 gigabytes, were selected from a population of 3000 known history images available. These images where further categorized by size into three groups of 500 each that created the standard for the rest of the research sample. Therefore, a like number of 1500 images with unknown history were acquired as were 1000 additional special category images. The final sample image database consists of 4,000 distinct JPEG images ranging in size from 346 bytes and a resolution of 24 X 24 pixels to 14 Megabytes and more than ten million pixels and a total size of 4.46 gigabytes. The upper bounds of the image size were set at 14 megabytes. A recent study of popular digital cameras shows that the more common, compact point and shoot style cameras 29 have a pixel range from seven to twelve megapixels and the more expensive professional grade digital SLR cameras produce between twelve and fifteen megapixels. (Goldborough 2008) These upper limit capacities result in uncompressed image size of approximately 45MB, with JPEG compression the storage size of these images become approximately 3MB). (Forret 2010) However, the efficiency of the JPEG compression routine is dependent upon the frequency distribution in the image; some images may have far less compression. Therefore, the sample database includes image sizes ranging up to 14MB. The image database is divided into eight image categories based on the images history and image size. Image history is important for realistic testing. Because we are investigating the impact of image editing software on the viability of indelible image landmarks, we need to be able to compare between raw images straight from the capture device and those images that have been opened and possibly modified by image editing software. As the realization of zero variance minimal computer units may be dependent upon the image size and number of overall pixels. Image size and resolution are also used as factors for categorization. These images were collected through two primary means. First, the known history categories 1-3 are all original images taken by the author using a variety of digital cameras. Second, categories 4-7 are images that were located and downloaded from a variety of sources on the Internet. Category 7 is a special category in that the images are very small in size and low resolution, commonly referred to as thumbnail images. Category 8 is a mixture of known and unknown history images, creating a realistic mixture that replicates what might be found on a typical user?s storage device. The statistical methods used in the validation of the determination for sample 30 size and confidence of a random sample is detailed in section 4.1.3 Data Sample and Image Category Validation. 4.1 Persistent Discernable Landmarks in JPEG Images (Theory I) Problem: A computer investigator using traditional hashing methods to locate visually similar JPEG images will find only limited success. This traditional method of finding identical computer files fails to find all visually similar JPEG images, because, the DCT compression routine of JPEG images changes the traditional message digest or hash values between two, otherwise, identical images (Hurlburt 2009). The massive size of storage devices today and the number of possible images an investigator may need to review makes a manual review impracticable if not impossible. Digital forensic investigators need a method to find those JPEG images that are visually similar among the possible tens of thousands of image files on a suspect storage device. The discovery of persistent digital landmarks allows investigators to search for visually similar or sibling JPEG images on the storage device. Further, the method is useful in the discovery of multiple copies of visually similar but digitally different images on a storage device which might be another indicator of steganographic use. Other efforts at locating digitally similar files have produced some very good products such as fuzzy hashing techniques (Hurlburt 2009), context triggered piecewise hashing (J. Kornblum 2006) and multi-resolution similarity hashing. (Roussev, Golden and Marziale, Multi-resolution similarity hashing 2007) However, each of these approaches differs in how the files are located, and none have proven useful for locating visually similar, digitally different JPEG images. 31 The foundational theory to this research is that JPEG images possess certain landmarks that can be used to find visually similar but digitally different JPEG files in a finite dataset. The hypothesis for the first set of experiments is those JPEG images possess certain landmarks that endure the JPEG compression routine. In addition to finding visually identical but digitally different images, more germane to the research here is discovery of consanguineous images. The term consanguineous, is used occasionally in this dissertation, it distinguishes between two types of visually similar but digitally different JPEG images. JPEG images that share a common parent image are consanguineous. However, two pictures taken of the exact same object just seconds or months apart are two distinct, non-consanguineous images, though they maybe visually identical and indistinguishable. This important distinction is necessary as legal considerations may dictate the need to present and defend an images history or lineage. 4.1.1 Experimental Data and Software Collection The database of images used in this research is categorized into eight image categories based on size, history, and resolution. For every image in the database a digital hash or MD5 message digest is stored in a separate file. An MD5 message digest is a common method used to uniquely identify digital files. The MD5 algorithm takes in a digital file of any length and produces a unique 32bit alphanumeric message digest that is unique to that digital file. Each image category is then evaluated for the number of zero variance minimal computer units (ZVMCUs) using searching algorithm implemented in a program written by the author called ZVMCUlocator.py. (Appendix K) A zero variance minimal computer unit is a grouping of 64 contiguous, non-overlapping 32 pixel values collected in a manner that mimics the JPEG compression routine of using 8 by 8 blocks and whose individual values are all identical. Figure 11 is an example of ZVMCU compared to a normal MCU. The examples in figure 11 are actual MCUs from database used in this research. Figure 11: A ZVMCU compared to a Non-Zero Variance MCU The example on the left is a ZVMCU with all 64 pixels having the same value of 228,196,173 and the MCU having a starting X-Y coordinate value of 680,1008. The MCU on the right is a normal MCU with pixel values that vary across the 8x8 block. The results from ZVMCUlocator.py are then used to further categorize the image categories into six datasets based upon the number of ZVMCUs found in each image. For testing, eight different methods, discussed in detail in the following sections, each baseline image is manipulated. Each resulting manipulated image is stored and evaluated independently. This program is used to locate any minimal computer units (MCU) that have a zero factor frequency variation (ZV) which results in a set of AC DCT coefficients of all zero values. 33 In figure 12, a general understanding of how the ZVMCUlocator examines an image creating an output that includes the number of ZVMCUs in the image and the color-coordinate pairs associated with each ZVMCU in the image. Figure 12: The ZVMCU Locator Program After all images from all categories are manipulated and evaluated, the resulting data of the number and location of the ZVMCUs in each image is evaluated. The evaluation of this data generates the necessary proof that ZVMCUs are present in JPEG images that they remain between manipulations and are stable enough for further examination as a viable landmarks within a JPEG image. Figure 13 gives a visual representation of the comparison process. Each manipulation is compared against the baseline to determine the effects of the manipulation on the ZVMCU population of the image. 34 Figure 13: Manipulation Comparisons to Baseline for Establishment of ZVMCUs Software selection: GIMP image editor: This software package is chosen because of its popularity as an open source image editor and the powerful features it offers for batch processing images. GIMP is used to perform seven of the eight manipulations, quality reduction to 80%, rotation of 180 degrees, size reduction to 80%, quality reduction to 50%, size increase to 120%, quality restoration of test1 to 100%, and quality restoration of test 4 to 100%. The final manipulation opens each image independently then performs a save as operation renaming and relocating the image to a new directory. This final manipulation was performed with a custom program written by the author, Mover.py (Appendix N). Adobe Photoshop 8: This software is used because of it powerful feature set and it is a very popular commercial offering of image editing software. This software was used as a validation tool to verify the actions being performed by GIMP. 35 Using Photoshop to open a select set of images and evaluate that the expected manipulations were reproduced in a separate software package and that both software programs were reporting the same metadata about the images. Microsoft Photo manager: Microsoft Photo manager was used sparingly in the research, but is chosen for use because of its default installation on Microsoft Operating Systems makes it widely available for use. IRFANVIEW: This freeware, open source image editing software package is chosen for its ability to view HEX and EXIF information of JPEG images. While useful mainly in the preliminary stages of the database creation; the ability to view, record, and evaluate the HEX and EXIF data proved useful in the decision making process for image selection. Image selection: For the purpose of this research a sample database of 4,000 JPEG images was collected. The images were collected from several sources and are categorized based upon each images? size, dimensions, and history. The categorizations provide the ability to differentiate the viability of the landmarks found in the images. Allowing for the examination of the ratio of ZVMCU?s to image size and evaluation of the impact of image editing software on the ZVMCU?s. The first three categories are raw images that are known not to have been edited by software. These images have all been acquired by the author from several cameras and loaded directly into the database. The three categories are divided by image size and resolution, with category I containing the largest images average size 4.1MB, category II contains medium sized images with an average size of 857KB, and category III the 36 smallest with an average size of 115KB. Categories IV through VI contain 1500 images downloaded from a variety of internet sites. The histories of these images are unknown. This sample of 1500 images is divided into three categories. These categories are characterized by image size and resolution with category III having the largest images and category VI the smallest. Category VII and VIII are special cases. Category VII is comprised of thumbnail sized images less than 3 kilobytes. Category VIII is special in that it contains both known and unknown history images with sizes that are all less than 1 megabyte. A detailed description of each category follows: ? Image Category I is 500 known history photographic images with an average size of 4MB and a resolution between seven and nine megapixels. ? Image Category II is 500 known history photographic images with an average size of 857KB and a resolution between one and two megapixels. ? Image Category III is 500 known history photographic images with an average size of 115KB and a resolution just under one megapixel. ? Image Category IV is 500 images with unknown history with an average size of 2.9MB and a resolution between three and nine megapixels. ? Image Category V is 500 images with unknown history with an average size of 552KB and a resolution between one and three megapixels. ? Image Category VI is 500 images with unknown history with an average size of 133KB and a resolution less than one megapixel. ? Image Category VII is 500 thumbnail size images with unknown history and an average size of 3KB and a resolution less than 10 thousand pixels. 37 ? Image Category VIII is 500 images with known & unknown history with an average size of 433KB and with a resolution greater than 3 Megapixels. Hash Selection: MD5: used to validate the integrity of the original images prior to testing SHA1: alternate method for image integrity validation 4.1.2 Theory I Experiment and Data Structure The foundational theory to this research is that JPEG images possess certain landmarks that can be used to find visually similar JPEG files in a finite dataset. The process for experimentation of this theory begins with the examination of the base line images in each category. First, an MD5 hash is obtained and stored for all base line images. Next, using the custom program ZVMCUlocator.py, each image is examined for the existence of zero variance minimal computer units. The ZVMCUlocator program mimics the JPEG compression routine in traversing the image and examining each pixel as a member of an 8x8 blocks or minimal computer unit (MCU). If the RGB values of all the pixels within the MCU are equal to one another, this block is labeled as a zero variance minimal computer unit (ZVMCU) and its color value and coordinates are recorded along with other metadata, such as image height, width and size. Each Image Category is then sub-divided into six datasets based upon the number of baseline ZVMCUs found in the images. Dataset 1 is a collection of images that have zero ZVMCUs in the images. Dataset 2 is a collection of images with between one and ten ZVMCUS. Dataset 3 is a collection images with greater than 10 but less than 100 ZVMCUs. Dataset 4 is a collection images with greater than 100 but less than 1000 ZVMCUs. Dataset 5 is a collection images with greater than 1000 but less than 10K 38 ZVMCUs. Dataset 6 is a collection images with greater than 10K ZVMCUs. Each image is manipulated in a series of eight tests and then the image is revaluated for changes in the number of ZVMCUs. In the testing of the images for theory I, 8 independent tests are conducted as detailed in the following sections. The results from the test manipulations are recorded and the results are presented. Each of the 8 tests performs a singular manipulation of each of the 4000 images in the baseline dataset with the exception of test 6 and test 7. Test 6 and 7 use image copies that resulted from manipulations in test one, reduction in quality by 80% and test four, reduction in quality by 50%, respectively, allowing the examination of the impact of multiple manipulation on an image. 4.1.3 Data Sample and Image Category Validation The images used in this body of work represent a cross section of images that would constitute a typical users JPEG image collection. Statistical tests were conducted on all 4000 images of the baseline dataset as well as on the resulting datasets from each of the test manipulations conducted in this dissertation. The intent of this testing is to provide a level of assurance of the random nature of the image collection and to minimize any unintentional bias of image selection or of the population of ZVMCU?s within the images. The tests chosen to examine the randomness of the data sample used in this work, the Wald-Wolfowitz Runs test, a Frequency test, and the Kolmogorov-Smirnov test (K-S test). The detailed results from each test are available for review in Appendices Q, R, and S respectively. The Runs test is used to determine if the input data comes from a random process. (Filliben and Heckert 2010) The null hypothesis for the Wald-Wolfowitz Runs test (H0) 39 is that the sample collection is the result of a random process. The alternative hypothesis for this (H1) is that the sample population demonstrates characteristics that are not consistent with a random sample. In figure 14, the results from the Wald-Wolfowitz Runs test demonstrate that we cannot reject the null hypothesis that our distribution comes from a random process. The National Institute of Standards and Test (NIST), handbook on statistics states that the z- score is compared to a standard normal table and that at a 5% significance level, a z-score with an absolute value greater than 1.96 indicates non-randomness. (Filliben and Heckert 2010) Figure 14: Wald-Wolfowitz Runs Test Results As seen in figure 14 all z scores from all image categories individually, as well as a single collective run, were all below the 1.96 necessary to reject the null hypothesis. Figure 15, shows a Runs Test conducted on the size attribute of the entire image sample 40 set. In this case, all 4000 images were used in the Runs Test. At a 5 % error rate, the adjusted Z-score was -1.389, reinforcing the failure to reject the null hypothesis for the sample image dataset used in this research. The details of the calculations and the Wald- Wolfowitz Runs test algorithm are defined in detail in appendix Q. Figure 15: Wald Wolfowitz Runs test on All images (size) The next test conducted to test the randomness of the data sample is a frequency test, followed by a K-S test for normality. According to Hamilton et al. the Frequency test and the K-S test are useful in measuring the similarities between the empirical distribution and the distribution of the sample population. (Hamilton, Nash and Pooch 1997) The Frequency test conducted on the sample set contained in this work was calculated using Stat Plus 2009 v.5 software package, which creates a frequency of the occurrence of values across the distribution of a series of partitions based upon the overall size of the sample. 58 partitions were selected using the formula of With the following results in the frequency distribution of ZVMCUs across all images in the sample set demonstrated in figure 16 and detailed in Appendix S. 41 Figure 16: ZVMCU Frequency Test (StatPlus2009 v5.8) The results from this frequency test indicates a non-normal distribution of values with 2782 images out of 3430 images containing less than 304 ZVMCUs. This distribution is expected as the ZVMCU quantity in an image is influenced by the size and resolution of the image and the distribution of size is commensurate to the distribution displayed in figure 16. 4.1.4 TEST 1 Quality Reduction by 20% Test 1 uses image editing software to reduce the image quality of the original image by 20%. This reduction in quality is the result of the software invoking a discrete cosine transform quantization table with values necessary to reduce the quality of the image. All other JPEG configuration and compression criteria are set to negate any unwanted additional changes. 42 As the quantization table used for a 20% reduction in quality will have higher divisor values than the quantization table used for 100% quality, this will cause larger number of the DCT coefficients to be set to zero and the expected outcome of the reduction in quality will be an increase in the total number of ZVMCUs. 4.1.5 TEST 2 Image Rotation by 180? This test rotates the original image 180 degrees. The image is then saved using criteria that will minimize any further influence of the JPEG compression routine. Quality remains at 100%. All sub-sampling is set to 1:1. Compression optimization is turned off. The rotation of the image will alter the starting values and the following series of values of the JPEG compression routine. With a new starting point for the compression routine, the impact on the number of ZVMCUs is stochastic; however, this test is useful and necessary to measure the changes in the quantity and position of the ZVMCUs in the image as it is possible that landmarks will endure the rotation. 4.1.6 TEST 3 Size Reduction by 20% In test three the size of the original image is reduced by 20%. This is a reduction in the size of the image maintains quality at 100%. The result is a reduction in image resolution, though the number of bytes necessary to store the image increases. As the reduction in resolution is a reduction in the total number of pixels making up the image, the expected effect would be either no change or a reduction in the number of ZVMCUs. This reduction though not predictable or quantifiable should not change the value or location of the remaining ZVMCUs in the image. 43 4.1.7 TEST 4 Quality Reduction by 50% Test four reduces the quality of the original image by 50%. This is a drastic and sometimes visible reduction in quality. This test is necessary to help scale the amount of influence changes in quality has on the number of ZVMCUs in an image. As with the prior quality reduction experiment in test one, the expected outcome is an increase in the total number ZVMCUs available in an image. 4.1.8 TEST 5 Size Increase by 20% In test five the size of the original image is increased by 20%. This increase in the size of the image maintains quality at 100%. Using the software editing programs described earlier, when each image is saved, the software editing program GIMP is instructed to increase the images size by 20 percent of its original size. GIMP employs interpolation to increase the size of the image. The result is an increase in image resolution by 20%. The space necessary to store the file on disk will increase accordingly. As the increase in resolution is an increase in the total number of pixels making up the image, the expected effect would be either no change or an increase in the number of ZVMCUs. This increase in ZVMCUs is not predictable; however it should not change the value or location of other ZVMCUs in the image. 4.1.9 TEST 6 Restore Test1 Quality Test six attempts to restore the quality of an image whose quality was previously reduced. Test six differs slightly from the other test. In test six, the original image is not used. Instead, the resulting image from test one (quality reduction by 20%) is used. The need to use an image with a verifiable starting point and a known reduction was 44 necessary to accurately measure the pure effects of the image quality restoration to 100%. As this test takes an image with previously reduced image quality and there are no methods to recover from the lossy compression routine, there should be no change in the number or location of ZVMCUs in the image. 4.1.10 TEST 7 Restore Test 4 Quality Test seven increases the quality of an image whose quality was previously reduced. Test seven differs slightly from the other tests in the theory I experiments. In test seven, the original image is not used. Instead, the resulting image from test four (quality reduction by 50%) is used. The need to use an image with a verifiable starting point and a known reduction was necessary to accurately measure the pure effects of the image quality restoration to 100%. As this test takes an image with previously reduced image quality and there are no methods to recover from the lossy compression routine, there should be no change in the number or location of ZVMCUs in the image. 4.1.11 TEST 8 No Manipulation Save As only Test eight does not perform any image manipulations. This test is a realistic and likely the most common cause for alterations in an images message digest. This test opens each image independently then using a save as function to save each image file with a new name and in a new directory. This action changes the message digest of the image without any changes to the image size, color, geometry or quality as performed in previous test. Appendix P is a demonstration of the changes to the MD5 signature for images between the baseline and the save as only images. (Appendix P) 45 4.2 Experimental Results 4.2.1 Test 1 All Image Categories The first manipulation in the experimental series reduces the quality of the image by 20%. The results as detailed in Appendix C show that a quality reduction causes a dramatic increase in the number images with zero variance minimal computer units (ZVMCUs) present. The number of ZVMCUs per image was also dramatically increased. Figure 17 demonstrates the delta in the number of images with ZVMCUs from baseline to post manipulation. The largest delta in the pre-existing versus the manipulated image set is in category 1 while the smallest change was in image category 7. Figure 17: Test 1 ZVMCUs Delta These finding indicate that the history of the image influences the number of pre- existing ZVMCUs as well as, the number that will be created from quality reduction. As seen in Categories 1-3, these are all known history images with no previous manipulation made to the images. The higher resolution category 1 saw the greatest increase in the number of ZVMCUs, with ZVMCUs found in every image in the Category. Image size 0 100 200 300 400 500 600 BaseLine ZVs Test1 Delta 46 is also a factor in an images tendency to have ZVMCUs. Category 7 contains the smallest images in the database. As expected, with fewer pixels and overall image space, there are fewer opportunities for ZVMCUs to occur or be created. This is also evidenced by the trending of fewer overall images with ZVMCU?s from Categories 1 to 3 and from Categories 4 to 6. As noted earlier, Categories 7 and 8 are special case categories. Figure 18: Average number of ZVMCUs per Image Figure 18 demonstrates the influence of size and resolution on the average number of zero variance minimal computer units contained within an image. Quality reduction by only 20% has a great impact on the number of available ZVMCUs. The smallest average numbers of starting ZVMCUs appear in the known history images. This group averaged a total of 226, 222 and 111 ZVMCUs per image respectfully. This group also had the largest percentage increase in the average numbers, with over 100% increases in each category. This indicates a couple of points for the unknown history categories 4-6. First, based on the percentage of ZVMCUs before test 1 manipulation, it is apparent that these images had at least one, but possibly multiple editing or quality 0 500 1000 1500 2000 2500 3000 3500 4000 4500 Baseline After Test1 47 reductions done in the past. Further, these findings tend to indicate that additional manipulation will result in continued creation of ZVMCUs in an image. The findings of test one will be useful in building the metrics necessary to locate visually similar but digitally different JPEG files in a known dataset. 4.2.2 Test 2 All Image Categories The second manipulation experiment consisted of rotating each image 180 degrees. Rotation is a common manipulation for images and results in modifications of both a derived MD5 hash value and the number of zero variance MCUs in an image. The results from this manipulation signify that the known history categories, which are images without previous manipulation, experience the slightest amount of deviation in the number of images with ZVMCUs. Those datasets with unknown histories, likely having been edited previously demonstrated an overall reduction in the total number of images with ZVMCUs. The average reduction in images without zero variance minimal computer units was 18.75 per image category. Figure 19 shows the deviation in the number of images with ZVMCUs from the baseline dataset. Notice that image category 7 demonstrates the greatest deviation. Category 7 is a special class of exceptionally small images, in both size and resolution. Category seven?s diminutive size images limit the opportunity for a great number of ZVMCUs so any reduction will be a large percentage of the whole. 48 Figure 19: Test 2 ZVMCUs Delta from baseline Of equal importance to the research is the overall number of ZVMCUs found in each image. The overall number or changes in the number per image will impact the ability to demonstrate indelible landmarks within the image. In Figure 20, the results from a rotation of the image show a generally negative impact on the average number of ZVMCUs found per image. Figure 20: Impact of rotation on average ZVMCUs per image 0 50 100 150 200 250 300 350 400 450 Category 1Category 2Category 3Category 4Category 5 Category6 Category 7Category 8 Test 2 Change in Images with ZVMCUs BaseLine ZVs Test2 Delta Category 1 Category 2 Category 3 Category 4 Category 5 Category 6 Category 7 Category 8 % of change 17.52 8.26 -8.82 -0.79 -13.11 -6.09 -50 -0.94 -60 -50 -40 -30 -20 -10 0 10 20 30 Per centa ge Change in ZVMCUs per image 49 The overall average number of zero variance MCUs decreased by 6.75 %. The major deviation from the average were in Category 1, which contains the largest images in both resolution and size, this category had an overall increase in the number of ZVMCUs per image. While Category 7, containing the smallest of all the images in the database, demonstrates the greatest percentage of decrease of almost 50%, the actual decrease was from an average of 3 ZVMCUs per image to 2 ZVMCUs per image. These results show that rotation of an image does not exclude an image from having indelible landmarks identified and indicates in fact that a majority of the ZVMCUs remain intact through both the rotation and subsequent recompression of the image. 4.2.3 Test 3 All Image Categories Test 3 in the experimental series reduces the size of the image by 20%. As seen in the detailed results in Appendix E. Reducing the size of an image exhibits an increasing reduction in the number of ZVMCUs per image as the size of the images decrease. This was consistent with both the known and unknown history images and with the special case categories 7 and 8. Of particular interest in the results from test 3 is the large percentage of decrease in the average number of zero variance MCUs found in each image. Figure 21 illustrates the reduction in the average number of ZVMCUs per image. 50 Figure 21: Test 3 impact on average number of Zero Variance MCUs per image The results of reducing an image in size by 20%, while expected, are an area for concern for the stability of the possible landmarks found in an image. Additionally, occurrences of images with baseline ZVMCUs greater than 100 have been reduced to zero. These findings indicate that using ZVMCUs as landmarks may not be universal across all images and circumstances. Further, if the ZVMCU count falls to zero, other methods will have to be incorporated to prevent the occurrence of false negatives. 4.2.4 Test 4 All Image Categories The impact of reducing the quality of an image was tested previously in test 1. In Test 4 the quality is reduced further, to a 50% reduction in image quality. The testing of additional reduction in quality is necessary to scale the impact of the quality reduction on images. As some JPEG software implementations will impart quality reduction unless the user specifies that the image quality is to be maintained at 100%. The results of test four are as expected and the number of ZVMCUs continues to increase. In figure 22, the percentage of images in each dataset with ZVMCUs for both test 1 and test 4 are compared against the baseline. Category 1 Category 2 Category 3 Category 4 Category 5 Category 6 Category 7 Category 8 % of change -59.87% -86.34% -207.69% -130.80% -154.47% -148.92% -216.35% -156.28% -250.00% -200.00% -150.00% -100.00% -50.00% 0.00% Per centa ge Change in ZVMCUs per image 51 Figure 22: Percentage of images with ZVMCUs compared from test 1 & test 4 The increase in images with ZVMCUs is consistent throughout all the image categories. These findings indicate that not only are the landmarks stable through the quality reduction and subsequent recompressions, but that the available number of ZVMCUs actually increases to near 100% for all image categories. Further, these findings lend credibility to the establishment of ZVMCUs as viable landmarks for future use. 4.2.5 Test 5 All Image Categories Test five increases the images size by 20%. As detailed in the test description, the increase in size in accomplished through software manipulation. The outcome of the increase in size is dependent on the starting size of the image, resulting in varying effects in both the total number of images with ZVMCUs and the average number of ZVMCUs per image. In figure 23 the variation of the average number of ZVMCUs per image is readily noticeable. Image Category 1, the grouping with the largest images and the greatest resolution, experiences increases in the average number of ZVMCUs per image. 0.000 0.200 0.400 0.600 0.800 1.000 1.200 Baseline Test 1 % Test 4 % 52 Though, in figure 24 it shows that the total number of images with ZVMCUs in category 1 decreases. While all categories experienced a decline in the total number of images with available ZVMCUs, the average number of ZVMCUs per image proved to be less predictable. The trend appears to be that the larger images experience an increase whereas the smaller images remained constant or decreased. Figure 23: Test 5 Average ZVMCUs per image to Baseline data Figure 24: Test 5 Change of Percentage of Images with ZVMCUs to Baseline 0 500 1000 1500 2000 2500 3000 3500 BL Avg ZV/IMG Avg ZV/ IMG 0.000 0.100 0.200 0.300 0.400 0.500 0.600 0.700 0.800 0.900 1.000 Baseline % IMG w/ZV 53 Test 5 shows that while there is stability throughout all image categories, this stability is not absolute. Although, a majority of the images retain or in some cases gain ZVMCUs, the small reduction in the percentage of images with viable ZVMUs indicates a possible need for an additional method, such as the use of EXIF data for matching to help prevent false negative returns. 4.2.6 Test 6 All Image Categories Test 6 examines the impact of saving an image whose quality has been previously reduced with a quality setting of 100%. This particular test is very useful in determining the reaction of the ZVMCUs within an image that is being repeatedly modified. For our purposes these results will be most telling in the legitimacy of the use of ZVMCUs as possible image landmarks. In the first step of this experiment, test 1, the image quality was reduced by 20%. Next, the resulting images were then opened and using the features provided in the image editing software program, the quality settings were changed to save the image at 100% quality. While the actual image quality will remain constant, the selection and storage of a quantization table will change, resulting in changes to the images message digest. Table 1 and Table 2 are the actual quantization tables used and stored with image 1, image category 2, for test one and test six respectively. Of note here is the difference in values in the quantization tables. The majority of divisor in table 1 is 40, where in table 2, all divisors are equal to 1. This means that there will be very little if any changes to the image made by the process of increasing quality. 54 Table 1: Quantization table for Test 1, Image 1, and Category 2 Table 2: Quantization table for Test 6, Image 1, and Category 2 The recorded changes for test 6 are miniscule. The maximum change in any category was less than .4% in the average number of zero variance MCUs per image as seen in figure 25. Further, there were no reductions in the number of images with ZVMCUs out of 4000 images processed. 55 Figure 25: Change in ZVMCUs per Image Test 6. Out of all the images processed, images in category 1 experienced the greatest change. Of the images in category 1, image number 474 demonstrated the highest increase in the number of zero variance MCUs from test 1 to test 6 with 130 additional MCUs created. This number is less than one percent of the total. Average increases in all categories remained at less than one percent. As indicated in the earlier tests, the known history categories seem to demonstrate the greatest fluctuation from the baseline indicating that the initial editing of an image will have the greatest impact on the ZVMCU population in an image. Test 6 results favor the use of ZVMCUs as persistent landmarks for image identification and steganographic discovery. 4.2.7 Test 7 All Image Categories Test 7 is an extreme case study on the attempted restoration of an image from a 50% quality reduction to 100% quality. The resulting implementation in the software Category 1 Category 2 Category 3 Category 4 Category 5 Category 6 Category 7 Category 8 % of change 0.36% 0.16% 0.00% 0.04% 0.03% 0.00% 0.00% 0.03% 0.00% 0.05% 0.10% 0.15% 0.20% 0.25% 0.30% 0.35% 0.40% Per centa ge Change in ZVMCUs per image 56 editing program causes a choice of vastly dissimilar quantization tables to be used in the compression routine for the image. Table 3: DCT quantization tables for Image 8, Image Category 1 Test 4 Table 4: DCT quantization table for Image 8, Image Category 1 Test 7 The numbers shown in Table 3 and Table 4 represent the divisors used in the JPEG compression routine when the program divides the DCT coefficients in step 2, shown in figure 1 by the quantization table. They are used again to multiply the resulting compressed values during the decompression phase. 57 The differences in these numbers result in changes to some of the remaining non- zero coefficients in the JPEG image. These changes in turn, cause slight variation in the number of ZVMCUs per image. So even though, the quality of the image is unchanged and all other factors remain the same, there are slight changes to the actual pixel values within an image. These changes affect not only the ZVMCU population but the MD5 hash calculations as well. Resulting in differing hash sets for what is visually exactly the same image. 58 4.2.8 Test 8 All Image Categories Test 8 is the most common type of manipulation an image is likely to undergo. That is the image is opened, viewed and saved to a different location and file name. This test replicates this action. Opening each image and saving it to a new location. The results of this test show conclusively that the using ZVMCU?s as a landmark criteria is a viable way to locate visually similar JPEG images files in a dataset. In figure 26, the viability and stability of ZVMCUs is demonstrated. Every category experiences either no change or a very slight increase in the available number of images with ZVMCUs. Figure 26: Number of Images with ZVMCUs & Average ZVMCUs per image Category 1 Category 2 Category 3 Category 4 Category 5 Category 6 Category 7 Category 8 T8 Images W/ZVMCUs 0.28 0.57 0.82 0.97 0.91 0.77 0.18 0.99 Baseline Images W/ ZVMCUs 0.28 0.41 0.38 0.75 0.70 0.75 0.17 0.95 % change in Avg number of ZV per Image 0.18 0.78 0.66 0.68 0.45 0.38 0.00 0.27 -0.20 0.00 0.20 0.40 0.60 0.80 1.00 Per centa ge Percent of images with ZVMCUs from Test 8 comparisions 59 4.3 Theory I Conclusion The hypothesis in the experimentation for theory I is that JPEG images possess certain landmarks that are robust enough to endure the JPEG compression routine. The results are conclusive that JPEG images do in fact possess zero variance minimal computer units and these ZVMCUs endure the more common image manipulations and subsequent image compression routine. These number of ZVMCUs found in an image are influenced by many factors. The factors shown here to influence the availability of ZVMCUs include, image size, image resolution, and image history. Further, the availability of ZVMCUs as viable landmarks is influenced by manipulation operations on the images. Some operations have a greater impact than others. Of concern to the viability of this research are those operations that have a negative impact on the population of predetermined ZVMCUs. In test 3, image size reduction by 20%, we see a profound impact on the number of both images with ZVMCUs and the average number of ZVMCUS per image. This result is not unexpected as the default image rescaling algorithm in most image processing software relies upon some form of interpolation for the reduction or addition of pixels in an image. GIMP uses linear interpolation in its image resampling and as implemented in these experiments results in pixels with the least variance from its neighbors being removed, hence a reduction in ZVMCUs. While test 3 demonstrates the necessity for the addition of a method to reduce false negatives, it does not discount the usefulness of ZVMCUs as viable landmarks for image identification. The preponderance of the data and analysis of the experimental results 60 demonstrates that the foundational theory in this research is well founded and credible for additional experimentation and research. 4.4 Landmark ZVMCUs can be used for Image Identification (Theory II) Theory II builds upon the foundation theory proven in the first set of experiments. That JPEG images do possess certain viable landmarks, referred to as ZVMCUs. These landmarks are present in all categories of images and are relatively stable through most manipulations. The Theory II hypotheses is that the zero variance minimal computer units can be combined with non-traditional hashing methods to produce a fingerprint of a JPEG image that will be useful in locating consanguineous files in a finite dataset. It has been shown that most, if not all, steganographic embedding routines leave behind some trace elements of their operations (Fridrich, Goljan and Hogea 2003) (Fridrich and Goljan, Practical steganalysis of digital images: state of the art 2002) (Hosmer and Hyde 2003) (Goljan, Fridrich and Holotyak 2006). Most of the detection techniques rely on either discovery of a known signature or through careful analysis of first and second order statistics. (Lyu and Farid n.d.) (Kharrazi, Sencar and Memon 2005) (Provos 2001). However, a majority of these techniques researched rely on having the original cover image as a baseline in order to extract the hidden data. This presents a problem to the forensics investigator. The problem is how to match a cover image to a possible steganographic image. Most knowledgeable users of steganalysis understand that leaving the original cover in place is equivalent to leaving your encryption key available to investigators, so finding the original image or similar images could prove a vital tool for the investigator. Additionally, an investigator would find it difficult to distinguish a cover image from any other copy of an image. The method presented here to find the 61 consanguineous files in a finite dataset will use non-traditional hashing techniques to locate identical ZVMCUs that can be cross referenced between images. 4.4.1 Theory II Experimental Process Building on the results from experiments conducted in theory one, each of the now 360005 images are evaluated for the presence ZVMCUs. The result of each examination is a dataset that consists of the coordinates and color values of each ZVMCU in the image. The combination of the 16.7 million possible colors with the hundreds of thousands or even millions of possible coordinate locations provides a sufficient total of unique data points for image matching6. This dataset is used as input to the custom program ZVHashComparer.py. (Appendix M) The program is described in detail in the next section. 4.4.2 Theory II ZVHash Value Comparison Test The ZVHashComparer.py program written specifically for this research, takes as input the results from the ZVMCUlocator.py. The program creates a unique vector for each image containing the message digest of each ZVMCU color-coordinate combination that was located by the ZVMCUlocator program. These vectors are stored using the image name. Each signature within each vector is then systematically compared to each signature of every suspect image. The results of the ZVHashcomparer is a text output of which images were matched, the number of ZVMCUs found in each image, and the number of message digest signatures that were matched. Figure 27 is a visual 5 Each Test in theory one produced 4000 independent images (8 * 4000) + 4000 original baseline images = 36000 images each with a unique MD5 signature. 6 100 x100 image resolution X RGB combinations = 1.678E+11: images with 2588x2592 = 1.691E+14 62 representation of the ZVHashcomparer routine. Figure 27: Visual representation of the ZVMCU Hash Comparison process Comparisons were made between all similar images across all test sets though not all images possessed ZVMCUs so some images were not useful in the experiment. As demonstrated in the experimentation of Theory I, every image category exhibited a percentage of images that did not possess ZVMCUs. As the hashing method here depends upon the RGB-coordinate data point of ZVMCUs within an image, those images without ZVMCUs were excluded from the final results. The image category test results that follow reflect this exclusion of images without viable ZVMCUs. 4.4.3 Theory II False Positive Test In creating a method that will locate visually similar JPEG images that share a common lineage within a finite data set it is necessary to determine the possibility of false returns. The rate of false positives is determined by recording the matches returned when comparing known dissimilar images. In this test, all 500 images from two categories were compared to all 500 images in two separate categories. Unlike the comparison test in shown in section 4.4.2, in this test every image in the category was compared to every image in the second category, at total of 10,500 comparisons. This 63 test was conducted twice using two sets of independent images. A total of 21,000 comparisons were made in search of false positive matches. False negatives will be determined by extrapolating the number of matches made in test one from the number of known matches. 4.5 ZVHash Experimental Results Theory II The results from the ZVHash experiment are positive and prove the viability of using ZVMCUs as a means to uniquely identify sibling JPEG image files that have different message digest signatures. Each image in each category has a possible eight matches in the database, one resulting from each test performed for theory I. The program ZVHashComparer.py conducts both the hash of the ZVMCUs contained in each image as well as a comparison of those hashes to return possible matches from the database. For this series of experiments several factors influence the results. First, it is apparent that the pixel value saturation points need to be considered when comparing ZVHash values. Unlike the possible 16.7 million other possible color combinations, contiguous areas with ZVMCU values of either (0,0,0) or (255,255,255) are more common and might be introduced into almost any individual image. Additionally, careful review of those images with ZVMCUs of saturated values, demonstrated that these ZVMCUs tended to be located in large contiguous groupings. This is expected from an image that has either extreme under or over exposed areas. The effect of removing these saturated ZVMCUs from the hashing algorithm is detailed in 4.5.5. Another area that needed to be taken into account is images that have only a miniscule number of ZVMCUs. In repeated testing, when a floor of 5 ZVMCUs was set as a discriminator, the matching results were better by a factor of approximately 5%. However, for accuracy and consistency across 64 the experiments, no floor value was used in the following results. Though in future implementations, floor values should be used as a quality factor to facilitate the reduction of false negative returns. 4.5.1 Known History Categories I-III ZVHash Results The first set of ZVHash results are from categories 1-3. These are the known history categories containing images that had not been previously altered by photo editing software. The resulting images from each of the manipulation test conducted in theory one were used to find matches throughout the database of images. The results demonstrated in Figure 28 show that in the majority of cases sibling images can be located using the non-traditional hashing technique implemented in ZVHashCompare.py. Figure 28: ZVHash Results Categories I-III The percentage of matches found demonstrate that using a non-traditional hash technique of ZVMCU value/coordinate pairs is a viable means for locating sibling JPEG files. These image categories began with a known history of no prior editing, all manipulations to these image categories was done during the research. The match rate of Category 1 Category 2 Category 3 Images with ZV Pairs 4003 3875 2955 Number of Matches 2668 2555 2679 % of matches 66.65% 65.94% 90.66% 01000 20003000 40005000 Num ber of im ag es ZVHash Results Known History Categories I-III 65 the known history images is analogous with the match rate returned for the unknown history images. These images have each experienced just one manipulation, with the baseline images experiencing zero manipulations. This accounts for the difference in the overall images with viable ZV pairs when compared to the unknown history images. The results from this test indicate that the ZVHash algorithm is equally useful as an image detection mechanism for images that have not been altered as it is for images that have had prior manipulations. 4.5.2 Unknown History Categories IV-VI ZVHash Results The results from this experiment track closely with the results from the previous categories. The main difference in the results is in the total number of image pairs that were determined to be viable. The unknown history category found almost 2000 more images per category as viable versus the known history categories. As mentioned earlier, this is a result of the total number of available ZVMCU?s in each image. The general trend in both the unknown and known history categories seems as image size and resolution decreases the percentage of matches increase. This is contrasted by the fact that the larger images returned a greater number of viable image pairs when compared to smaller image categories. This trend can be seen in Figure 29, where the number of viable image pairs decrease by approximately 1000 images across the categories, but the number of matches increase by almost 10% over the same range. This change across categories is the result of fewer independent and isolated ZVMCUs in the images, resulting from the smaller image size and reduced number of possible pixel locations. This is reinforced in the findings of special case category 8. As discussed in 4.5.1, setting 66 floor values will help improve the rate of matching by eliminating those images with less than 5 viable ZVMCUs. Figure 29: ZVHash Results for Unknown History categories 4.5.3 Special Case Categories VII-VIII ZVHash Results These two categories of images are included mainly for completeness and consistency of the research. Of most interest in these results is that the percentage of matches remains fairly consistent with all the other categories of images. Category VIII?s results confirm the findings in the previous experiment that image resolution impacts the likelihood of matching ZVMCU hashes in an image. All the images in category VIII are less than one megabyte in size, which if size was a factor would put the match results on par with image categories III and VI, however, the results are more closely aligned with those of categories I and IV. Categories I and IV, like category VIII have resolutions IMCat 4 IMCat5 IMCat 6 Images with ZV Pairs 6067 5274 4316 Number of Matches 4050 4076 3708 % of matches 66.75% 77.28% 85.91% 0 1000 2000 3000 4000 5000 6000 7000 Num ber of im ag es ZVHash Results Unknown History Categories IV-VI 67 greater than 4 megapixels and all three categories have similar returns in the percentage of matches at approximately 65%. Figure 30: ZVHash results for special cases Category VII demonstrates a particularly interesting result. As seen in Figure 30, category VII maintains a match percentage that is generally equivalent to all the other image categories this is in spite of the diminutive size of the images and the extremely small number of actually useable image pairs. These results, while included for completeness and consistency, support the use of ZVMCU?s for image matching. IMCat 7 IMCat 8 Images with ZV Pairs 342 6256 Number of Matches 201 4040 % of matches 58.77% 64.58% 0 1000 2000 3000 4000 5000 6000 7000 Num ber of im ag es ZVHash Results Special Case Categories VII & VIII 68 4.5.4 False Positive Experimental Results A false positive return in this collection of experiments is defined as there being at least one ZVHash match between the two dissimilar images. The two categories of images compared are known to have no sibling or likely visually similar files between them. The expected false positive rate is zero. In reality, the false return rate is 3.8% for the photographic images in categories 3 and 5. An image that has zero ZVMCUs is not a viable image for comparison so those images are not factored into the equations. The first false positive test used categories three and five. As found in theory one and demonstrated in figures 18 and 24, 38% of category three and 69% category five contained images with viable ZVMCUs, at baseline. This percentage changed as the result of the differing manipulations. The average viable ZVMCUs resulting from all tests are 59% and 75%, for categories 3 and 5 respectively. The combined results of all the manipulations are experienced in the false positive results. The percentage of images with viable ZVMCUs found in this experiment is 53%, with 1751 viable images being used out of a possible 3314. The number of false positive matches from the viable population of 1751 images is only 35 or just 1.9% of the population. Figure 31 presents a graphical representation of these results. 69 Figure 31: False Positive test one Categories 3-5 This percentage of false positives is not exceedingly high, but for the purpose of image discrimination of large data sets the actual number of false images returned is still too large. A closer examination of the actual image pairs returned as matches demonstrate that image over-exposure or under-exposed is a leading factor in the number of false returns, Figure 32. Therefore, modifications to the ZVHash algorithm that excludes pixel saturation points should reduce the number of false positives and bring the false positive return rate into a more acceptable range. Figure 32: Demonstration of ZVMCU value saturation impact on false positives Total comparisons, 3314 1681 35 False Positives 1.99% Viable Pairs 1716 70 Figure 33: False Positives test two Categories 2-6 In figure 33 the results of false positive test run on categories 2 and 6. These categories are chosen because, as in categories 3 and 5, they have zero probability of containing any possible matches or even likely visually similar images. Category 2 contains images taken by the author and downloaded directly to the computer, where category 6 contains images downloaded from the Internet. These results reinforce the finding in the previous false positive test conducted with categories 3 and 5. 4.5.5 Saturation Exempt ZVHash Results As discussed in the previous findings, when JPEG files have large areas that are either under-exposed (255,255,255) or over exposed (0, 0, 0), there is an increased probability for false matches between otherwise dissimilar files. In order to account for this the ZVHash algorithm was modified to include the ability to indicate the amount of acceptable pixel saturation within an image. The ability to set different saturation points allows the user the ability to select a level of acceptable false positive and false negatives as may be needed for a particular data set. As seen in these results, reducing the number Total comparisons, 1601 1800 27 False Positives 1.48% Viable Pairs 1827 71 of saturated ZVMCUs from unlimited, demonstrated in 4.5.1, to a setting that disregards all ZVMCUs with saturated color values improved the match rate by as much as 16%. (Figure 34) Figure 34: Effects of Zero Saturated ZVMCUs on match rates 4.5.6 Saturation Adjusted False Positive ZVHash Results The real improvements to the algorithm and to the overall stability of theory two is found in including a saturation setting in the reduction of false positives. Figure 35 shows a dramatic decline in the false positive rate when even a small portion of the saturated ZVMCUs are excluded from being matched. It is evident that for any practicable use of ZVMCUS as landmarks in identifying consanguineous JPEG files in a finite dataset, saturation of the ZVMCUs will have to be taken into account. The best method for this is to allow for an on the fly adjustment of the number of saturated ZVMCUs dependent upon the needs of the investigator and the dataset that is being examined. Category 1 Category 2 Category 3 Category 4 Category 5 Category 6 Category 7 Category 8 unlimited saturation 64.09% 61.37% 81.45% 62.15% 72.71% 76.50% 66.01% 60.34% saturation exempt 78.31% 63.82% 97.08% 73.47% 80.79% 86.07% 56.35% 65.31% 0.00% 20.00% 40.00% 60.00% 80.00% 100.00% 120.00% Effects of Zero Saturated ZVMCUs 72 Figure 35: Saturation settings effect on false positives 4.5.7 Realistic Test Condition Results To illustrate the actual results possible with the ZVHash method. This section presents the results from a simulated real world scenario. In this experiment 16 images were selected from the test results database, two from each image category based upon the overall average ZVMCUs for that image category. The 16 images represent the suspect images the investigator is attempting to locate in a large dataset. As described in the initial problem statement, a major challenge for investigators is locating visually similar but digitally different images in a finite dataset. This experiment replicates that problem by searching a dataset of 4000 images for just 16 sibling JPEG image files. The search was conducted using the ZMHashcomparer.py to first create a ZVHash of each of the suspect images. These ZVHash results were then compared to the ZVHash results of each of the 4000 images in the dataset. The following results show that the ZVHash method is a viable means for image identification. This ZVHash method correctly identified all 16 sibling JPEG image files in the dataset of 4000. As detailed in Table 5, Categories 3 & 5 Categories 2 & 6 unlimited saturation 1.99% 1.48% Saturation < 500 1.10% 0.83% saturation exempt 0.26% 0.57% 0.00% 0.50% 1.00% 1.50% 2.00% 2.50% Zero Saturation False Positive 73 the average false positive rate is just 0.32% and a maximum of 71 false images were returned. The average number of false positive images returned from the database of 4000 is just 14; this number is easily manageable in a human visual review of the images. However, a visual review may not be necessary if a further qualifier, such as EXIF data or first order statistics is added to the selection process. As seen in table 5, the average rate of matches of individual ZVHash results between the similar images in the dataset is consistently greater than 95%, with an average matching rate of 99.47%. False positive returns could be further reduced when the match rate of individual ZVHash results is added to the routine as selection criteria. In this example, if the match rate was used as a criterion to exclude images that did not have a match rate of over 90%, then those false returns with less than a 90% would be excluded. The MD5 hashes of each of the images are included to illustrate two very important points. First, the MD5 hashes demonstrate that the sibling JPEG image pairs have different traditional hashes. Second, it reconfirms that using traditional implementation of the MD5 routine will return zero matches from the database. 74 S u s p e c t I m a g e n u m b e r M a t c h e s o u t o f 4000 F a l s e P o s i t i v e / 4 0 0 0 D a t a b a s e I m a g e n u m b e r D a t e b a s e I m a g e Z V M C U s S u s p e c t I m Z V M C U s M a t c h e d Z V M C U s % o f Z V M C U s M a t c h e d M D 5 H a s h ( o r i g i n a l ) M D 5 H a s h ( S u s p e c t ) M a t c h e d M D 5 's 1 1 0 . 0 0 C t 6 I m 1 5 504 1196 504 1 . 0 0 0 0 6 6 c 8 d 3 d 9 a 7 e f f 7 3 d 4 c 8 8 7 0 9 9 e b 4 3 6 2 6 0c 5 d 5 1 5 a 0 9 2 e c c a 6 7 0 4 5 0 1 1 8 0 7 7 1 2 c 6 4 0 2 1 0 . 0 0 C t 7 I m 2 5 3 8 3 1 . 0 0 0 0 3 3 d d f 2 e b 3 f c d 8 6 2 c d f e a 3 1 c 1 1 0 e f d 2 1 84 9 8 5 e 8 b d 1 d c e e b b 6 9 a 1 d a a 7 6 3 d 0 a 3 7 b 0 3 1 0 . 0 0 C t 5 I m 2 6 2313 8782 2313 1 . 0 0 0 0 3 2 8 1 6 8 e f 7 1 f a b d b f f 2 7 a 5 6 5 e d 1 9 e f 2 b 62 3 2 a f d 3 2 e 5 9 4 e 5 9 3 0 0 5 1 4 8 0 3 f c 2 8 a 1 4 b 0 4 72 0 . 0 2 C t 7 I m 2 8 6 18 6 1 . 0 0 0 0 5 9 d 9 c 7 2 1 b 3 2 c 9 0 c 8 6 2 6 e 1 3 c 1 0 3 e 2 a 4 0 e1 9 a d 1 d 2 2 a b 7 a 9 1 a 3 1 2 7 b 8 a 7 9 b b 5 6 9 1 7 9 0 5 1 0 . 0 0 C t 6 I m 3 5 593 1186 593 1 . 0 0 0 0 4 9 b c b 6 b c 0 a 5 3 b 6 7 6 1 f b 0 0 a 2 0 c 7 0 d 4 2 f f 1 2 4 4 8 4 f f 2 b 5 a 1 1 b 4 a 9 b 6 a c 5 9 9 c b 0 9 3 6 9 0 6 1 0 . 0 0 C t 8 I m 3 8 2959 6234 2959 1 . 0 0 0 0 a e 2 0 6 8 7 f 0 c 4 d 0 7 0 a 6 a 0 4 2 0 1 b a 3 0 9 c 3 c 5d 9 7 2 d f 4 f 7 9 c 6 d d a 5 a c d e 6 1 e 7 d 8 f d e 3 e 9 0 7 15 0 . 0 0 C t 1 I m 4 3 217 219 216 0 . 9 9 5 4 6 c 2 d 8 c 0 6 8 8 2 b c 9 c d 3 3 8 d f b 9 7 f 3 6 e 7 0 e a b 2 1 8 4 9 1 5 3 6 b f 6 5 4 e f 9 9 4 d 2 8 2 4 3 3 0 e 0 e 7 0 8 29 0 . 0 1 C t 2 I m 4 5 210 253 200 0 . 9 5 2 4 e f b b 7 c 2 4 4 5 4 e e 7 b b 0 f d 2 7 4 d b a 4 a 3 9 c 5 c8 8 8 5 e c c d 1 3 d 1 e 9 e 8 d e a 6 4 c f c 5 4 7 a 5 2 0 0 0 9 38 0 . 0 1 C t 5 I m 4 9 2433 2433 2433 1 . 0 0 0 0 d f e 0 a 0 6 2 c f d 5 f 9 1 9 f 5 4 7 a 1 1 b 1 9 8 3 4 e 6 36 e c b d 2 9 7 9 0 0 5 d 6 3 3 e 7 8 1 6 7 d b 4 d d e f 9 6 50 10 11 0 . 0 0 C t 4 I m 5 1 1129 1288 1127 0 . 9 9 8 2 0 3 c 5 b f b 3 0 7 a 1 0 0 8 8 5 5 c 6 a 4 b 2 0 9 3 e 5 4 6 34 5 1 9 b b 7 6 8 2 7 8 e 0 b d c 8 5 2 f 0 1 9 2 8 6 f b 6 3 b 0 11 1 0 . 0 0 C t 8 I m 5 2 3822 4933 3750 0 . 9 8 1 2 f d 2 8 b 0 8 7 7 4 7 d 9 6 2 6 5 2 b 3 f a a a 8 5 5 5 d c c 01 0 b 0 6 6 d 3 5 c 2 7 b f 3 9 3 f 8 9 5 2 1 e 4 b 8 4 1 0 b a 0 12 1 0 . 0 0 C t 4 I m 6 6 1168 1656 1163 0 . 9 9 5 7 7 d 0 3 1 5 3 b 3 b c 7 5 5 d a 3 8 f 8 d 0 5 8 e b 9 3 a 1 1 f e 8 d 3 8 2 4 7 8 d 6 7 3 3 c 9 6 4 1 0 8 5 e a a b c e 1 8 8 5 0 13 10 0 . 0 0 C t 1 I m 7 9 280 283 278 0 . 9 9 2 9 3 6 9 9 5 1 b 2 4 8 d 7 1 d 9 e 8 3 7 9 5 e 4 a f 6 a 0 a 9 2 2e 8 d b 6 e c d 7 c 2 5 8 d 1 e 1 e 8 8 d e 8 2 6 4 d 8 9 c 1 8 0 14 1 0 . 0 0 C t 3 I m 8 2 95 159 95 1 . 0 0 0 0 c 7 4 c c d 6 2 a 4 5 8 c b 1 7 1 9 f 4 d 6 0 9 f d 7 0 d 2 6 d b a d 0 6 6 8 5 1 9 a 2 1 e 8 2 6 4 d 1 2 4 9 9 1 3 9 2 6 5 8 e 0 15 1 0 . 0 0 C t 3 I m 8 7 162 184 162 1 . 0 0 0 0 e 0 4 d 3 d f 3 6 d 9 9 e 3 2 5 3 1 9 c f b a 2 2 d 4 c 2 d c af 5 d 6 7 0 3 7 a 2 6 9 0 5 4 7 8 0 9 3 f 5 2 0 1 a 5 0 b 6 4 4 0 16 39 0 . 0 1 C t 2 I m 1 0 6 341 371 341 1 . 0 0 0 0 3 5 9 6 4 e 3 6 8 0 a f b a 4 0 6 0 8 5 e d 8 c 6 c 6 d 9 3 2 ca 1 9 2 1 d e 2 2 7 7 8 c a 4 b 1 0 6 f f b 4 d e e 3 6 9 0 7 f 0 A v e r a g e s 1 3 . 9 3 8 0 . 3 2 % 0 . 9 9 4 7 0 Table 5: Real World Example Test Results for 16 Suspect Images 4.6 Theory II Conclusion The findings in this phase of the experimentation is conclusive proof of the viability of using the ZVHash method as a means to identify JPEG images that were at one time digitally identical, but now differ in their digital construction, such that traditional hash routines are ineffective. The average match rate established in sections 4.5.1, 4.5.2 and 4.5.3 of 72.06% 7 is acceptable considering the images have endured multiple and contrasting manipulations that greatly affect the viability of the ZVMCUs and further change their digital and visual similarity to the original. Likewise, the results of testing for false positive returns were very encouraging. Although the unconstrained returns were as high as 1.99% the 7 All image category match rates detailed in figures 16, 17 & 18 divided by eight. 75 ZVHash still served to reduce the possible population of possible images by 98% and reduced the actual number of images to a visually manageable number. However, it was proven in section 4.5.6 that the false positive return rate can be reduced to less than 1% of the population when saturated ZVMCUs are accounted for in the search algorithm. The most influential findings of the effectiveness of the ZVHash and its contributions to digital forensics are illustrated in 4.5.7. This experiment replicates a possible real world problem searching for possible matches of 16 JPEG image files in a dataset of 4000. ZVHash matched 100% of the suspect image files with zero false negatives. The false positive returns from the unconstrained ZVHash were just 0.32% with an average of just 14 misidentified matches per category. As explained in the detailed results, a constrained version that accounts for ZVMCU saturation and incorporates a metric for individual ZVHash match percentages will reduce this number further. These results confirm the original theory established for this section, that using a non-traditional hash method on zero variance minimal computer units located in JPEG image files is a practical and viable means to locate consanguineous JPEG images files in a finite dataset. 4.7 ZVHash can be used to Identify Steganographic Images (Theory III) The final theory in this research is the most complex and complicated. It brings together the findings of the previous experiments and introduces the unknown effects of several different steganographic algorithms. Theory III is that JPEG steganographic images can be identified in a finite dataset using the ZVMCUs and the ZVHash routine. The theory is based on the findings of the persistence of the ZVMCUs and on the match rates returned by ZVHash on known pairs of JPEG image files. It is believed that the 76 steganographic embedding routines that exploit the transform domain of the JPEG compression algorithm will perturb the ZVHash match rate resulting in an identifiable anomaly in the dataset. 4.7.1 Theory III Experimental Process This experiment will take a set of known cover images (CI) created in experiment I, a set of known secret messages (SM) and three known steganographic embedding routines (SP) and create a dataset of steganographic images (SI) that will be the basis for the final experiment. Each steganographic image will be evaluated for identifiable landmarks using the ZVHash routine detailed in theory II. The creation of the steganographic dataset involves three basic steps, selection of the cover image, selection of the secret message, and embedding using the selected software package. The selection of the steganographic program is determined by the programs ability to use JPEG images as containers and to save the steganographic image in the JPEG image format.8 The three programs chosen, JPhide and Seek (JPHS), PJSteg, and Steghide, are all capable of creating JPEG steganographic images and are similar in design but differ in implementation of their algorithms. JPhide & Seek (JPHS) uses a cryptographic algorithm called Blowfish. Incorporating the users? passphrase and a pseudo-random number generator, the algorithm determines how to embed the secret message in the transform domain of the compression routine. The program introduces some noise into the cover image and with 8 Not all image based steganographic programs are capable of creating JPEG steganographic images. Some, like Cryptapix and Secure Engine, can use JPEG?s as a container but will create the steganographic image in a non-lossy format like BMP. 77 the matching original image there are programs available to detect JPHS. This program is of particular interest because of its easy to use Windows graphical users interface. The ease that a person can download and employ JPHS makes it a very viable tool for anyone looking to conceal communications or digital content. The second steganographic tool chosen is PJSteg. This is a windows based JPEG steganography tool that includes an easy to use graphical user interface. This program stores the embedded data in the least significant bits of the JPEG image. While statistically detectable if the embedded data is too large, this is one of the few programs that can store the steganographic image in the JPEG format. The third software selection is Steghide. Steghide is a UNIX based, command line JPEG steganography program. As outlined in the Steghide manual pages, Steghide uses a graph-theoretic approach to Steganography. The algorithm works by first compressing and encrypting the secret data. Locations of pixels where the secret data will be stored are selected using a pseudo-random number generator that is seeded by the user password. First, pixel values that match the embedding secret data are sorted out and used. Then the remaining data is embedded across the image data. The program claims that the images? first order statistics are maintained as a result of the embedding routine. The cover images used in this portion of the research were selected using three criteria, image size, image history, and average ZVMCU count. In all 48 images were selected as cover images from the database. Six images from each category where selected based upon their average number of available ZVMCUs. By selecting cover 78 images from each category, a cross representation of the database is achieved and an equal number from each size and history category were selected. Although the characteristics of the images in category 7 make them ill suited for use as cover images, six cover images from this category was included in the experiments. As noted earlier, the size of the hidden data impacts the steganographic images probability of detection. Larger embedded files perturb more of the images data so as the embedded file size increases so does the likelihood of introducing detectable changes. The hidden data for this portion of the experiments were all text based files that allowed for precise manipulation of the file size. The selection criteria for the files to be used as hidden data was based upon the reports from JPHS on the maximum data size its embedding routine would allow as seen in table 6. The text files that were used as hidden data were created using Notepad and saved in various sizes from 50 bytes up to 1024 Kilobytes allowing the best possible match to the storage capabilities of the individual programs. The hidden data files were characterized into three groups, large, medium and small based upon the JPHS reported embedding capacity. Large files are greater than 70% of the maximum embedding size. Medium hidden data files are approximately 50% of the maximum embedding size and small hidden data files are less than 30% of the maximum. 79 Table 6: Size chart for hidden data embedded in cover images. 4.7.2 Steganographic Embedding Experimental Results Using each of the 3 steganographic embedding programs each of the 48 cover images was embedded with a small text file, a medium text file and a large text file, creating 144 individual steganographic JPEG files for each steganographic program. In all, a total of 432 individual steganographic images were created using the three embedding programs. Each of these 432 steganographic images were then evaluated as detailed in Theory II, for the quantity of ZVMCUs present per image and for total number of images with viable ZVMCUs. A set of ZVHash results was created for each of the steganographic images. The ZVHash of each of the 432 steganographic images was then compared to the ZVHash of each of the 48 cover images for possible matches and possible anomalies. As seen in Figure 36, the ZVHash routine proved to be a viable means for identification of consanguineous image files, even if those files have been manipulated with steganographic software. The ideal return would have been 48 matches for each of the size categories in each of the software programs. The ZVHash routine found 100% of 80 the image files pairs in the dataset. However, as seen in the previous experiments, there are a number of false positives that are present when the image saturation points are not taken into account. Figure 36 details the results for all three embedding routines and demonstrates viability of the ZVHash as an image matching algorithm. The false positive results varied from 67 to 73, per category. In figure 37, the results of removing pixel saturation is demonstrated. It is clear that accounting for the saturation points is necessary and useful means to control the number of false positives. Figure 36: Steganographic Routine embedding results JPHS LRG JPHS MED JPHS SMALL PJSTG LRG PJSTG MED PJSTG SMALL STEG HIDE LRG STEG HIDE MED STEG HIDE SMALL Images with ZV Pairs 48 48 48 48 48 48 48 48 48 Number of Matches 115 113 115 118 118 119 120 121 120 0 50 100 150 Num be r of im ag es Steganographic Embedding ZVhash results 2304 comparisons 81 Figure 37: Saturation Exempt ZVHash matches for Steganographic images 4.7.3 Test 8 to Steganographic Embedding Routine Examinations In looking for anomalies in the steganographic embedding routines it is necessary to have a solid base line for comparison. In building this baseline, test 8 was chosen as the model because the save as method provides the most predictable and repeatable results of all the manipulation tests. For this experiment, four software editing tools, Microsoft Photo Manager, Photoscape, GIMP and IRFANVIEW, were used to conduct the ?save as? method on all 500 images from Category 8. Category 8 was chosen because it provides a mixture of known history and unknown history images of a variety of sizes. Also, Category 8 provides the most images with viable ZVMCUs for experimentation. After the save as operations were complete, the next step is to verify if the photo editing software packages altered each of the 500 images digital signatures. This was accomplished by comparing the digital signatures of the base line images from category 8 to each of the 1,500 post save images. (Appendix O). The next step was to verify that the digital signatures between each of the separate save as procedures were JPHS LRG JPHS MED JPHS SMALL PJSTG LRG PJSTG MED PJSTG SMALL STEG HIDE LRG STEG HIDE MED STEG HIDE SMALL Images with ZV Pairs 34 34 34 34 34 34 34 34 34 Number of Matches 39 37 39 42 42 43 46 43 40 0 50 Num ber of im ag es Steganographic Embedding ZVhash results Saturation Exempt 82 identical. This is to verify that there were no changes from one implementation to the next across the 3 tests for each software package. (Appendix O) These two procedures were necessary to verify the baseline comparisons were similar to the steganographic embedding routine comparisons detailed in section 4.7.2. 4.7.4 Steganographic Embedding Routine Anomalies A careful analysis of each of the individual matches from the ZVHash routine has indicated some small anomalies in the steganographic embedding routine that are not present in the similar testing done in Theory II. In Test 8, the test where an image was not manipulated but simply saved as a new name, the ZVMCUs average value changed across the images. In the steganographic image pairs the average ZVMCU value remained constant across the embedding routines. Further, the number of ZVMCUs present in each image fluctuated between the individual manipulations in the other 7 tests, as well as, in test 8. However, for the steganographic embedding programs, the number of ZVMCUs found in each image remained unchanged between the steganographic image and the cover image. This difference between normal manipulations and steganographic embedding routine suggest an avenue for the detection of steganographic images that are embedded in the transform domain of JPEG images. However, as seen in the following testing the fluctuations in the ZVMCU average value for the 8 manipulation tests proofed to be statistically insignificant. 83 4.4.5 Statistical Testing of Variance of ZVMCUs for Predictable Anomalies The population of the ZVMCUs for the baseline images (control group), the steganographic image (test group 1) and the save-as images (test group2) all have non- normal distributions (Figure 38). The distribution of the ZVMCU quantity found in the test set of images as seen in Figure 38 matches the distribution of the size variable for the same set of images. (Figure 39) Figure 38: ZVMCU Count Distribution for Baseline images 84 Figure 39: Image Sample Size Distribution All 4000 Images in Sample Set The statistical model normally used to measure differences in variance is the F- Test. However, because the sample population does not follow a normal distribution, the Levene Test for Equality of Variance is a more appropriate choice. (Filliben and Heckert 2010) The Levene test is used to test for homogeneity across variance. In testing the null hypothesis for theory III, that there is zero variance in the quantity of ZVMCUs in the results between the control group and the test groups, the Levene Test for Equality of Variance is the best choice due to the non-normal distribution of the dataset. The formal definition of the Levene test follows: H0: H1: Informally and relevant to the data presented in this research. The (H0) or null hypothesis is that the variance of the control group is equal to the test group. The (H1) or alternative hypothesis is that steganographic embedding software cause anomalies in the variance of the quantity of the ZVMCUs of JPEG images. The test statistic for the Levene test is defined as: 85 Where N is the sample size of the image groups (144 images), k is the number of sample groups (3 groups) subset of the sample. According to the National Institute of Standards and Technology (NIST), the selection of the value for Zij is dependent upon the actual distribution of the data. For a dataset with a skewed distribution such as the image samples, the recommended definition for Zij is Where Yij is the median of the group. (Filliben and Heckert 2010) Other definitions are available but are not as well suited to our dataset. 4.4.6 Results of Levene Test for Equality of Variance The results of the Levene Test for Equality of Variance test fail to reject the null hypothesis and therefore do not encourage the use of the variance of ZVMCUs in an image as an indicator for steganographic embedding in JPEG images. The control group began with the 500 baseline images from category 8. These 500 images were then manipulated using GIMP, Microsoft Photo manager, IRFANVIEW, and Photoscape. Each image is then opened and saved in a new directory using the save- as routine from each program. Subsequently, a dataset of ZVMCUs for each image is computed and a ZVHash of the color coordinate pair is obtained. The resulting ZVHash for each image is then compared to the baseline ZVHash. A total of 2309 images out of a possible 25009 were found with viable ZVMCUs. The Levene Test for Equality of Variance was 9 500 Baseline + 2000 Save As images = 2500 86 conducted on the value of ZVMCUs for all 5 datasets. The results are demonstrated in Table 7. BaseLine Gimp Msphoto PhotoScape IRFANVIEW Median 311.5 325.5 321 617.5 635 Mean 256.4 257.0 255.9 323.3 323.9 Variance 68905.8 68883.9 68422.5 75826.3 758035. n 408 408 411 406 406 df 407 407 410 405 405 Levene's Test 0.611 p 0.655 a 0.05 Accept Null Hypothesis because p >0.05 Table 7: Levene Test for Equality of Variance for Save As images In Table 8, the results from the Levene variance test of the steganographic image population also demonstrates a p value of >0.05. Interestingly, the p value for the steganographic images is 1.0. This indicates, as seen in the details, that there is no variance at all between the values. Whereas, the Save As experiment in Table 7, p = 0.655, indicating there is at least some change, though not significant enough to show that it is not random. The varying Mean and Median values compared to the steganographic image ZVMCUs allows for further investigation. Baseline JPHS-L JPHS-M JPHS-S JPSTG-L JPSTG- M JPSTG-S Steghide-L Steghide-m Steghide-s Median 255.00 255.00 255.00 255.00 255.00 255.00 255.00 255.00 255.00 255.00 Mean 339.64 339.64 339.64 339.64 339.64 339.64 339.64 339.64 339.64 339.64 Variance 76814.1 1 76814.1 1 76814.11 76814.11 76814.11 76814.11 76814.11 76814.11 76814.11 76814.11 n 47 47 47 47 47 47 47 47 47 47 df 46 46 46 46 46 46 46 46 46 46 Levene? s Test 0.000 p 1.000 a 0.05 Accept Null Hypothesis because p >0.05 Table 8: Levene Test for Equality of Variance for Steganographic images 87 The results from this variance test informs us that the variance demonstrated in the save- as experiment is not significant enough to say the variance is not a result of random sampling. Though both sample populations have an insignificant variance in the number of ZVMCUs per tested image, the homogeneity in median, mean and variance across the three different steganographic embedding routines provides an indicator of a non normal manipulation that may provide a means of identifying steganographic images. 4.7.5 ZVMCU Homogeneity as Steganographic Indicator The culmination of the experiments in the research has produced a method that serves as a possible indicator of steganographic embedding in JPEG images that has not existed until now. Using the combined techniques described in this dissertation, it is possible to distinguish just those images that have embedded steganographic data and their related cover images. The final hypothesis is that steganographic images can be culled from the population of images in a finite dataset, reducing the possible suspect images from thousands down to a manageable set of pairs. An overview of the process can be seen in figure 40 and an explanation follows. A finite dataset is searched for sibling image files using the ZVMCU locator method as demonstrated in theory I and II. The new population of suspect images is expected to be at least 98% smaller than the original image population, as demonstrated in theory II. This creates the initial set of images in the suspect pool of images. 88 Figure 40: Overview of Steganalysis process using ZVMCUs & Non-Traditional Hashing The remaining images are then inspected for matching MD5 signatures. If multiple images are found with matching MD5 signatures, only one of the MD5 matches needs to remain in the suspect pool. Next the remaining images are compared. If two images having differing MD5 signatures but exactly the same ZVMCU quantity then it is plausible that one of the images is embedded with steganographic content and the other sibling image is the cover image. The hypothesis is then; given two images, IM1 and IM2. If F (MD5) IM1!=F(MD5) IM2 && Count (ZVMCUs) IM1 == Count (ZVMCUs) IM2: Then steganographic embedding is plausible. In the pilot test for this theory 9 cover images from the sample database were selected to become steganographic images and were subsequently hidden in a simulated suspect 89 dataset of 1700 images. Each of the three steganographic programs was then used to embed secret data into the 9 cover images. Each program embedded a large, a medium and a small hidden file in one of 3 cover images, just as performed in the earlier experimentation of section 4.7.2. The decision process for the number of images for the suspect collection is based on the following sample size formula: (Creative Research Systems 2010) Where: ss = sample size Z= confidence level (95% for this research) P = decimal value of likelihood of selection of wrong choice (50%) C = confidence interval, normally between 1 and 5. (3 for this research) In this study, the traditional use of a confidence level of 95% provides sufficient assurance that our sample size is of adequate size. The selection of a confidence interval of 3%, is a typically acceptable error rate for most sampling. Given these parameters the recommended sample size is Ss = .95 * .50 *(1-.50)/.032 = 264 An adjustment is made for the fact that we have a finite sample dataset of 500. That adjustment is made using the following formula: This calculation is straight forward and gives us a suggested sample size of 133 A sample size of 133 from 8 categories would result in a suspect collection of only 1064. In order to create a more accurate representation of a suspect?s image collection 90 additional copies of images were added to the selection process. In all 224, samples were taken from each category. This sample size exceeds the minimum requirements and produces a realistic size suspect data collection. A total of 1700 images constitute the suspect image dataset including the nine steganographic images. The method used to build the suspect image dataset intentionally insured that a copy of the original cover image was included, as well as, multiple other duplicate images. The frequency distribution of the suspect dataset is demonstrated in the following graphs. Figures 41 and 42 demonstrates an image size and ZVMCU quantity frequency distribution of the suspect image set that is equivalent to the distribution demonstrate across the entire sample dataset used in this research as seen in figures 38 and 39. Figure 41: Histogram for Suspect image set ZVMCU quantity 91 Figure 42: Suspect Image Dataset Size Distribution The methods that have been detailed throughout this work were then applied to the suspect dataset. The ZVMCUlocator program was used to create a dataset of ZVMCUs for the 1700 images in the suspect image collection. Next, the dataset of ZVMCUs is used as input for the ZVHash program. The ZVHash program compares every image to every other image in the collection (except itself) resulting in over 1.4 million comparisons10 for this collection of 1700 images. This process produces a dataset of image matches based on the percentage of ZVMCU hash matches. Along with the expected false matches, it is anticipated the hashing routine will return the nine steganographic images, in addition to intentional additional copies injected into the suspect data set. The addition of intentional image copies simulates what a user may have stored across multiple files on their computer and a variable that any investigator would have to expect to encounter. At a 1% and greater match rate the ZVHash routine returned 975 possible matched image files. This number is expectedly high as no metrics were applied to neither eliminate the matches resulting from pixel saturations as detailed 10 The total comparisons = 0.5 x 1700(1700 +1) = 1,444,150. 0 1 2 3 4 5 6 Nu mb er of Im ag es (Fr eq ue nc y) Suspect Image set Image size in Bytes Images 1-1700 Suspect Image set Size Distribution 92 in theory II nor to eliminate digitally perfect matches. However, by scaling the matches based on the percentage of ZVMCUs matched reduced the number of matches to a manageable amount. In table 9, the actual image matches returned by the ZVHash routine are presented. Of note in this table is how quickly the false matches are eliminated when the returns are scaled based on the percentage of ZVMCUs matched. Suspect Images ZV matches pairs Image matches 975 Image matches = 100 % 508 Perfect ZV match PAIRS 48 Table 9: Suspect Image Set total ZV matches However, not all of the 96 images (48 pairs) are possible candidates as steganographic or cover images. As outlined in the hypothesis for this experiment, the application of the traditional MD5 hash routine will identify identical images whose duplicate copies can be also be removed. As images with matching MD5 signatures are visually and digitally identical so only one need to remain for examination as a cover image or steganographic image. An MD5 signature was obtained for each of the 96 matches and 48 duplicates were removed from the suspect pool. The final step manually reviewed and removed 31 additional image files which did not have a compatible match from the suspect image collection of 48 images resulting in a suspect steganographic image set of just 17 images. Within these 17 images were seven of the nine steganographic images that were hidden in the initial suspect data set of 1700 images. (Figure 43) 93 Figure 43: Steganographic Detection process overview In the final test of the methods described in this research, a few criteria are modified. The final test increases the number of steganographic images that are introduced in to the suspect population of 1700 images. To maintain a realistic suspect data set, the percentage of steganographic images and cover images was kept at 5%. Therefore, a total of 45 images were selected to be used as cover images. Using the same methods described previously, each of the three embedding routines was used to embed 5 large, 5 medium and 5 small hidden files. This resulted in 15 steganographic images per embedding routine and a total of 45 steganographic images. This process created 90 image files (45 CI + 45 SI) which were hidden in the suspect dataset of 1700 images. To accommodate the additional 45 steganographic images being embedded an equal number of images were removed from the original dataset of 1700. 94 The exact process as described earlier and visualized in figure 43, is used to process this new suspect collection of images with the following results. Figure 44: Steganographic suspects from dataset of 1700 Figure 44 demonstrates some very important finding in the research. First, the number of initial match returns is significantly less. These results are expected because the pilot suspect collection contained more legitimate copies intentionally embedded in the suspect dataset of 1700 that were removed to accommodate the new steganographic images. These numbers demonstrate the ability to reduce a suspect dataset from a size that is visually unmanageable to a number that can be reasonably analysed visually. The expected return for matches in this experiment is a minimum of 90 individual files or 45 pairs, plus the unknown number of copies remaining in the suspect collection. Just as was done the pilot experiment, the final step manually reviewed the remaining 122 images in the suspect dataset, image pairs where matched and examined. In addition to the legitimate steganographic pairs found, there were also 11 pairs of other image matches found in the dataset. The results from the perfect matched pairs are 34 out of 45 steganographic images and cover images were discovered in the suspect dataset of 1700. This is 75.5% success rate and compares to the 77.7% success rate in the pilot test. Of 95 the steganographic images not found by the methods described in this research, each steganographic image had one of two metrics in common. Either the image was embedded with the JPhide and Seek routine or the image was embedded with a hidden file that was larger than the recommended capacity. In an effort to improve the success rate and test the ability of adjusting the metrics for image matching, a single parameter was changed to attempt to increase the success rate while minimizing the false positive returns. The parameter that was changed is seen in figure 44; the matching algorithm was allowed to choose images whose ZVMCU matches differed by plus or minus 1 ZVMCU. The new parameters increase the successful returns to 91.1%. The four images that were not returned after this singular parameter was altered were all images whose embedded file exceeded the recommended capacity. By exceeding the recommended capacity, the embedding routine is unable to maintain the first order statistics, making it vulnerable to other steganalysis procedures discussed during the introduction. 4.7.6 Theory III Conclusion The findings from these experiments conclusively support the combination of ZVMCUs and the non-traditional hash techniques of ZVHash as viable tools in finding probable steganographic images in a finite dataset, without any priori information on the steganographic content, algorithm or cover image. The result from the testing of variance between the quantities of ZVMCUS per image produced results showing that the variance in the ZVMCUs across the sample population is insignificant and does not qualify it for use as an indicator for steganographic embedded files. However, the fact that every dataset in the steganographic image group returned exactly the same Median, Mean, and 96 Variance demonstrates how the embedding routines manipulate the underlying pixel structure in order to maintain the first order statistics. This is in contrast to the save-as routine, which did cause changes, though these changes were statistically insignificant across each of the different photo editing software packages. This insignificance however, does not exclude the ZVMCU as a possible tool for the detection of steganographic images. It does however; rule out the use of the variance in the ZVMCUs in the population as a detection tool. As demonstrated ZVMCUs can be used to find sibling images in a dataset, then using the comparison of the quantity of the ZVMCUs with the traditional hash routine, images can be categorized with a level of confidence to their likelihood of containing embedded information. The effectiveness of the methods discovered and described in this research is clearly present in the results from the final test. The final test demonstrated that the ZVMCU landmarks combined with traditional MD5 hashing and non-traditional hashing of the ZVHash routine, is effective in locating JPEG steganography in a finite data set. The methods defined in this research located 77% of the steganographic images in the pilot test and 91% of the steganographic images out of a possible 1700 suspect images, in the follow on test. The notable aspect of this final test is that the blind nature of the examination. The method uses no prior knowledge or metrics in locating the probable steganographic images, setting it apart from other steganalysis methods. Another factor setting this research apart from other steganalysis routines is that the ZVHash routine is effective with small and medium size hidden files, where other universal steganalysis methods fail to detect smaller embedded files. 97 Chapter 5 Key Contributions and Conclusion 5.1 Key Contributions ? Discovered previously unknown robust landmarks named zero variance minimal computer units (ZVMCU) in JPEG images that remain viable through the JPEG compression routine ? Developed a method that allows for the unique identification of consanguineous JPEG images in a finite population by incorporating the newly discovered ZVMCUs and a unique implementation of the traditional message digest routine that is robust enough to survive recompression by JPEG lossy compression techniques. ? Developed a quantifiable method for the reduction of suspect population of images, significantly reducing the forensic effort necessary to detect, identify and/or disrupt steganographic communications and techniques. ? Successfully demonstrated the combination of methods useful in detection of steganographic embedding in JPEG images that has not previously existed. 98 5.2 Conclusion There are several significant contributions are accomplished in this research. The first contribution delivered with is the discovery of a method to uniquely identify JPEG images that succeeds in matching consanguineous images across the JPEG compression routine where traditional digital signatures fail. The second contribution from this research is the discovery of a method useful in assisting digital forensic investigators by effectively and efficiently reducing the dataset of images they need to review in search of steganographic images. The third contribution to the academic and scientific communities is the development of a new process capable of detecting JPEG steganographic images in a finite dataset without prior knowledge of the steganographic algorithm, hidden content or cover image. These contributions were accomplished through a meticulous and detailed set of experiments each culminating in a successful demonstration of the objective. The first set of experiments established the existence and persistence of landmarks named ZVMCUs that are present in a large portion of JPEG images. Further, the first set of experiments demonstrated the robustness of the ZVMCUs to multiple types of image manipulations across a full range of image size and resolutions. Building upon the first findings, the second set of experiments set out with the goal of finding sibling images in a finite dataset. Combining non-traditional hashing techniques with the newly discovered ZVMCUs, the second set of experiments concluded in a successful demonstration of the ZVHash routines? ability to match visually similar images in cases where a traditional hash routine would fail. The final set of experiments, ambitiously undertook the mission to discover a reliable method to identify JPEG steganographic embedding in a finite data set of JPEG images. By exploring the qualities 99 of the ZVMCUs variance in comparison to the normal population, an anomaly of the JPEG steganographic embedding routines was discovered and exploited. This anomaly is that the steganographic embedding routines tendency to maintain the images? first order statistics. This caused a zero variance in the quantity of ZVMCUs between the cover image and the steganographic image. The techniques discovered in the first set of experiments were brought to bear on this anomaly with positive results. The combination of the landmark ZVMCUs, traditional message digest, and image matching capabilities of the ZVHash routine, resulted in a method that successfully identified 91% of the steganographic images in a finite data set. Each of these accomplishments contributes its own unique and new found capability to the law enforcement and security communities. However, it is the contributions of the new found landmarks and embedding anomalies to the computer science research community that truly opens the door for further exploration into JPEG steganalysis. In summary, this research proved that there are viable landmarks that can be located in JPEG images and these landmarks can be used to accurately find consanguineous JPEG images and detect transform domain JPEG steganography. 100 Chapter 6 Future Work The field of steganography and steganalysis is a dynamic and growing area of research. There are many exciting avenues that have been uncovered in the current research that will be exciting to explore further. In continuing with this research the first project is the refinement of the ZVHash routine to eliminate false positives and to expand its capabilities by incorporating established image discrimination techniques such as using EXIF data as additional matching and selection criteria. The refinement of the ZVMCU locator and ZVHash software in effort to make its JPEG image matching capabilities more powerful and adjustable is also a planned area of continued research. In addition to the continued research in universal jpeg steganography detection, I plan to continue to research is finding methods to possibly extract the hidden data in digital image steganography. Further, I plan to continue searching for methods that will create a forensically appropriate technique to track a known image across the Internet to facilitate law enforcement in their efforts to prosecute criminals, possibly through the injection of indelible landmark ZVMCUs. In the unexplored territory, I plan to extend my research into other areas of steganography such as covert channels in TCP-IP transmissions, digital music and videos. 101 BIBLIOGRAPHY Bibliography Almohammad, Adel, Gheorghita Ghinea, and Robert M. Hierons. "JPEG Steganography: A Performance Evaluation of Quantization Tables." Advanced Information Networking and Applications, International Conference on (IEEE Computer Society) 0 (2009): 471- 478. Bailey, Curran Kevin. Steganography The Art Of Hiding Information. BookSurge Publishing, 2004. Chae, Jong J., and B. S. Manjunath. "Technique for image data hiding and reconstruction without host image." Edited by Ping W. Wong and Edward J. Delp. SPIE, 1999. 386-396. Cole, Eric. Hiding in Plain Sight: Steganography and the Art of Covert Communication. John Wiley & Sons, Inc., 2003. Dunbar, Brett. "Sans Reading Room." San.ORG. SANS. January 18, 2002. http://www.sans.org/reading_room/whitepapers/covert/a_detailed_look_at_steganographi c_techniques_and_their_use_in_an_opensystems_environment_677 (accessed June 15, 2009). Farid, Hany. Digital Imaage BAllistic from JPEG Quantization. Hanover: Dartmouth, 2006. Filler, Tomas, and Jessica Fridrich. "Complete characterization of perfectly secure stego- systems with mutually independent embedding operation." IEEE Computer Society, 2009. 1429-1432. Filliben, James J., and Alan Heckert. NIST/SEMATECH e-Handbook of Statistical Methods. Feburary 16, 2010. http://www.itl.nist.gov/div898/handbook/ (accessed may 10, 2010). Forret, Peter. Megapixel Calculator Digital Camera Resolution. May 20, 2010. http://web.forret.com/tools/megapixel.asp (accessed June 8, 2010). Fridrich, Jessica J., Miroslav Goljan, and Dorin Hogea. "Steganalysis of JPEG Images: Breaking the F5 Algorithm." Springer-Verlag, 2003. 310-323. 102 Fridrich, Jessica, and Miroslav Goljan. "Detecting LSB steganography in color and gray- scale images." IEEE Multimedia 8 (2001): 22-28. Fridrich, Jessica, Miroslav Goljan, and Rui Du. "Steganalysis based on JPEG compatibility." Edited by Andrew G. Tescher, Bhaskaran Vasudev, V. Michael Bove and Jr. SPIE, 2001. 275-280. Fridrich, Jessica, Tomas Pevy, and Jan Kodovsk. "Statistically undetectable jpeg steganography: dead ends challenges, and opportunities." ACM, 2007. 3-14. Goldborough, Ried. infotoday.com. June 15, 2008. http://www.infotoday.com/linkup/lud071508-goldsborough.shtml (accessed June 8, 2010). Goljan, Miroslav, Jessica Fridrich, and Taras Holotyak. "New blind steganalysis and its implications." Edited by Edward J. Delp and Ping Wah Wong. SPIE, 2006. 607201. Hendricks, Gary. Top 10 Cameras Under 300 dollars. June 1, 2010. http://www.basic- digital-photography.com/top-10-popular-digital-cameras-under-300.html (accessed June 8, 2010). Hosmer, Chet, and Christopher Hyde. "Discovering Covert Digital Evidence." Cleveland, Oh: Wetstone Technologies, 2003. Huang, Fangjun, Bin Li, and Jiwu Huang. "Attack LSB Matching Steganography by Counting Alteration Rate of the Number of Neighbourhood Gray Levels." 2007. I--401-- I--404. Hurlburt, Dustin. "Fuzzy Hashing for Digital Forensic Investigators." Seattle, Wa: Access Data, 2009. "Japan Electronics and Information Technology Industries Association, Exchangeable Image File Format for Digital Still Cameras: EXIF Version 2.2." Japan Electronics and Information Technology Industries Association, Exchangeable Image File Format for Digital Still Cameras: EXIF Version 2.2. 2002. Johnson, N. F., and S. Jajodia. "Exploring steganography: Seeing the unseen." Computer 31 (1998): 26-34. Kellen, Tom. "SANS Reading Room." SAN.ORG. Feburary 2001. http://www.sans.org/reading_room/whitepapers/stenganography/hiding_in_plain_view_c ould_steganography_be_a_terrorist_tool_551 (accessed June 6, 2009). Kelly, jack. "USA today." USAToday. November 19, 2001. http://www.usatoday.com/tech/news/2001-02-05-binladen.htm (accessed August 1, 2009). 103 Kharrazi, Mehdi, Husrev T. Sencar, and Nasir Memon. "Benchmarking steganographic and steganalysis techniques." Edited by Edward J. Delp and Ping W. Wong. SPIE, 2005. 252-263. Khayam, Syed Ali. "The Discrete Cosine Transform: Theory and Aplication." Michigan State University, 2003. Kornblum, Jesse D. "Using JPEG quantization tables to identify imagery processed by software." Science Direct (Elsevier) 5, no. s21-s25 (2008). Kornblum, Jesse. "Identifying almost identical files using context triggered piecewise hashing." Digital Investigation (Elsevier Ltd) 3S, no. S91-S97 (June 2006): 91-97. Lin, Eugene T., and Edward J. Delp. "A Review of Data Hiding in Digital Images." 1999. 274-278. Lyu, S., and H. Farid. "Steganalysis Using Higher-Order Image Statistics." McCullagh, Declan. "Wired News." Wired News. Feburary 20, 2001. http://www.wired.com/politics/law/news/2001/02/41861 (accessed July 15, 2009). NCMEC. http://www.ncmec.org/ (accessed 10 15, 2009). Preneel, Bart. "National Institute of Standard and Technology." csrc.nist.gov. U.S. Government. October 1, 2005. http://csrc.nist.gov/groups/ST/hash/documents/preneel_nist_v2.pdf (accessed September 25, 2009). Provos, Niels. "Defending against statistical steganalysis." USENIX Association, 2001. 24-24. Quach, Tu-Thach, Fernando Perez-Gonzalez, and Gregory L. Heileman. "Model-based steganalysis using invariant features." Edited by Edward J. Delp, Jana Dittmann, Nasir D. Memon and Ping Wah Wong. SPIE, 2009. 72540B. Roussev, Vassil, Golden Richard, and Lodovico Marziale. "Multi-resolution similarity hashing." (Elsevier) 4S, no. S105-S113 (2007): 9. 104 Roussev, Vassil, Richard G. Golden, and Lodovico Marziale. "Multi-resolution similarity hashing." Digital Investigation (Elsevier) 4S (June 2007): 105-113. SARC Editort. SARC. 10 15, 2009. http://www.sarc-wv.com/default.aspx (accessed 10 15, 2009). Silva, John Edward. "An overview of Cryptographic Hash Functions and their Uses." SANS Reading Room Version1.4b (2003): 13. Sorell, Matthew James. "Conditions for effective detection and identification of primary quantization of re-quantized JPEG images." ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering), 2008. 1-6. "The American Heritage? Dictionary of the English Language." Houghton Mifflin Company, 2004. Wallace, Gregory K. "The JPEG still picture compression standard." Commun. ACM (ACM) 34 (1991): 30-44. Wingate, Jim. The Perfect Dead Drop the use of cyberspace for covert communications. white paper. BackBone Security. 2005. 105 Appendix A: Publically available Steganographic programs Source 1:http://www.jjtc.com/Steganography/toolmatrix.htm Source2: http://www.topology.org/soft/steganography.html Source3: http://home.comcast.net/~ebm.md/stego/softwaredos.html BMPEmbed v1.54 Camouflage: Windows GUI, insertion based steganographic program uses the right click menu to hide/reveal data Contraband Hell Edition- a windows based edition of contraband that uses SHA1 encryption in the embedding process. Contraband ? a command line, 16 bit program embeds and extracts any file into 24 24Bit BMP files. Uses a ?scrambler? to embed the hidden file. Courier v1.0 Covert-TCP Cryptapix-an image file management, steganography, and encryption program for Windows Data Stash v1.1, v1.1a DC-Stego ? Written by Nikola Injac, a small, DOS-based steganography program that hides data in PCX image files. DCT-Steg Digital Picture Envelope Diskhide Dmagic v6.0 Data Privacy Tool -Strong encryption with optional BMP steganography EasyPrivacy Pro v2.1.1 EIKONAmark Empty Pic- a gif based steganography program Encrypt Pic v1.3 Encrypted Magic Folders EzStego F5 v0.9 FFEncode ? hides files in text files, by using Morse code of the NULL characters. Folder Guard v4.11, Ghost Host Gif-It-Up Gifshuffle Giovanni GzSteg-hides data in GZip files. compiled by Preston Wilson HD v3.0 Hidden v8.2 Hide and Seek 5- GUI based steganography program allows for hiding in GIF files. 106 Hide In Picture- program that lets you "hide" files inside bitmaps and GIFHide Unhide Hide v2.0 Hide4PGP v2.0 -command-line steganographic program for Windows, DOS, and OS/2 that hides data within BMP, WAV, and VOC files. Developed by Heinz Repp. Hide Drive Hideme InThePicture Invisible Encryption Invisible Files 2000 JK-PGS JPHS- Windows GUI, JPEG transform domain steganographic embedding routine Jsteg-Jpeg- indirectly hides data within JPG format. Files must be saved in the TGA (targa) format. JSTEGO- java solution to hide data in JPEG images. Algorithm contains Jsteg and F5. Magic Folders Mandelsteg- a creation based steganographic program producing images from input data. Mimic MP3Stego-command-line program that runs in DOS and hides information in MP3 files. Nicetext Outguess Paranoid PGE v2.0- this version does not include encryption. Allow hiding data inside most file types, except JPEG. PGM Stealth PJStgTST-Hides datafiles in the LSB of JPEG images. Modifies Transform Domain. S-Tools - hides files in BMP, GIF, and WAV files. Developed by Andy Brown. Safer v2.0 SandMark Scramdisk Scytale SecureEngine-JPEG steganography freeware program from Brother soft. http: //www. brothersoft.com / securengine-download-23496.html SGPO Smail- Windows based Steganography program that hides files inside .EXE and .DLL Files. Snow- text-based program by Matthew Kahn, that hides messages in text files by appending tabs and spaces. Snowdisk Spyder Stash Stealth- a simple filter for PGP which strips off all identifying header information 107 Steganos- Dos based steganography program by Fabian Hansmann. Hide data inside BMP,WAV and ASCII files. Steghide StegFS StegComm StegoWav-hides data in WAV files. Texto- a creation based steganography program that creates a text like document from the hidden file. Results are similar to what is seen in spam messages. Wnstorm- hides files inside PCX images using both steganography and encryption. 108 Appendix B: References for Sample Size Calculations. The equation is given from http://www.surveysystem.com/sample-size-formula.htm This calculator gives a recommended sample size of: 217 less than used in this study. Uses the following formula: Where Z is the Z value or confidence level of the study in our case 1.96 for 95% P = is the percentage of choice of selection (.5 or 50% is normal selection) C = confidence interval as a decimal. Normally >1 but <5. The following additional calculation is necessary to account for the finite dataset of 500. An additional validation of the sample sizes used in this study was conducted on an online calculator at http://www.raosoft.com/samplesize.html: This online calculator gives a recommended sample size of 218 which is less than the sample size used in the study. This website presents the following formula for its estimation of sample size. 109 Appendix C: Detail results for Test One all image Categories Test I: Image Quality Reduction to 80 % Program I: Gimp 2.6 This experiment is designed to quantify the effects of image manipulation on the quantity and location of zero variance minimal computer units located in the image. This test reduces the quality of each picture in the data set from 100 to 80. The resulting image size will be analysed to determine the change in the number and location of all ZVMCUs in the image. The GIMP image editing software will impart into the image its own implementation of the JPEG compression routine, its own Discrete Cosine Transform quantization tables, and Huffman coding tables. This experiment is vitally important to determine how differing photo editing software programs might change the location, values and quantity of the zero variance minimal computer units in an image that will be used to provide the landmarks for further processing. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 140 Total number of images with no ZVMCUs: 360 Percentage of images with ZVMCUs: 28 % Average number of ZVMCUs per image: 226 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 498 110 Total number of images with no ZVMCUs: 2 Percentage of Images with ZVMCUs: 99.6 Average number of ZVMCUs per image: 2229 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 206 Total number of images with no ZVMCUs: 294 Percentage of images with ZVMCUs: 41% Average number of ZVMCUs per image: 222 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 433 Total number of images with no ZVMCUs: 67 Percentage of Images with ZVMCUs: 86.6 Average number of ZVMCUs per image: 632 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 191 Total number of images with no ZVMCUs: 309 Percentage of images with ZVMCUs: 38.2% Average number of ZVMCUs per image: 111 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 387 111 Total number of images with no ZVMCUs: 113 Percentage of Images with ZVMCUs: 77.4% Average number of ZVMCUs per image: 226 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 1274 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 479 Total number of images with no ZVMCUs: 21 Percentage of Images with ZVMCUs: 96.2% Average number of ZVMCUs per image: 2558 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 348 Total number of images with no ZVMCUs: 152 Percentage of images with ZVMCUs: 69.0% Average number of ZVMCUs per image: 2415 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 436 112 Total number of images with no ZVMCUs: 64 Percentage of Images with ZVMCUs: 86.6% Average number of ZVMCUs per image: 3635 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 505 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 400 Total number of images with no ZVMCUs: 100 Percentage of Images with ZVMCUs: 80.0% Average number of ZVMCUs per image: 664 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 85 Total number of images with no ZVMCUs: 415 Percentage of images with ZVMCUs: 17.0% Average number of ZVMCUs per image: 3 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 111 113 Total number of images with no ZVMCUs: 389 Percentage of Images with ZVMCUs: 22.2% Average number of ZVMCUs per image: 4 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to image quality reduction: Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 22 Percentage of images with ZVMCUs: 94.9% Average number of ZVMCUs per image: 3110 Image Category statistics after image quality reduction Total number of images with at least 3 ZVMCUs: 428 Total number of images with no ZVMCUs: 2 Percentage of Images with ZVMCUs: 99.5% Average number of ZVMCUs per image: 3963 114 Appendix D: Detail results for Test Two all image Categories Test II: Image Rotation 180 degrees Program I: Gimp 2.6 This experiment is designed to quantify the effects of image manipulation on the quantity and location of zero variance minimal computer units located in the image. This test will change the baseline orientation of the image by 180 degrees. All other JPEG influencing factors are set as to minimize any further influence. The resulting image size will be analyzed to determine the change in the number and location of all ZVMCUs in the image. The GIMP image editing software will impart into the image its own implementation of the JPEG Compression routine, its own Discrete Cosine Transform quality tables, and Huffman coding tables. This experiment is vitally important to determine how differing photo editing software programs might change the location, values and quantity of the zero variance minimal computer units in an image that will be used to provide the landmarks for further processing. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 140 Total number of images with no ZVMCUs: 360 Percentage of images with ZVMCUs: 28 % Average number of ZVMCUs per image: 226 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 140 115 Total number of images with no ZVMCUs: 360 Percentage of Images with ZVMCUs: 28 % Average number of ZVMCUs per image: 274 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 206 Total number of images with no ZVMCUs: 294 Percentage of images with ZVMCUs: 41% Average number of ZVMCUs per image: 222 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 202 Total number of images with no ZVMCUs: 298 Percentage of Images with ZVMCUs: 40.4% Average number of ZVMCUs per image: 243 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 191 Total number of images with no ZVMCUs: 309 Percentage of images with ZVMCUs: 38.2% Average number of ZVMCUs per image: 111 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 179 116 Total number of images with no ZVMCUs: 321 Percentage of Images with ZVMCUs: 35.8% Average number of ZVMCUs per image: 103 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 1274 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 368 Total number of images with no ZVMCUs: 132 Percentage of Images with ZVMCUs: 73.9% Average number of ZVMCUs per image: 1264 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 348 Total number of images with no ZVMCUs: 152 Percentage of images with ZVMCUs: 69.0 Average number of ZVMCUs per image: 2415 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 0 117 Total number of images with no ZVMCUs: 0 Percentage of Images with ZVMCUs: 0 Average number of ZVMCUs per image: 0 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0 Average number of ZVMCUs per image: 505 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 320 Total number of images with no ZVMCUs: 180 Percentage of Images with ZVMCUs: 64.0% Average number of ZVMCUs per image: 476 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 85 Total number of images with no ZVMCUs: 415 Percentage of images with ZVMCUs: 17.0 Average number of ZVMCUs per image: 3 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 45 118 Total number of images with no ZVMCUs: 455 Percentage of Images with ZVMCUs: 9.0% Average number of ZVMCUs per image: 2 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to image rotation by 180 degrees: Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 22 Percentage of images with ZVMCUs: 94.9% Average number of ZVMCUs per image: 3110 Image Category statistics after image rotation by 180 degrees Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 22 Percentage of Images with ZVMCUs: 94.9% Average number of ZVMCUs per image: 3082 119 Appendix E: Detail results for Test Three all image Categories Test III: Image Size Reduction to 80% Program I: Gimp 2.6 Image Category I: 500 images with average size 2.2 MB This experiment is designed to quantify the effects of image manipulation on the quantity and location of zero variance minimal computer units located in the image. This experiment reduces the size of the image by 20% of original, while maintaining its aspect ratio. All other JPEG influencing factors are set as to minimize any further influence. The resulting image size will be analyzed to determine the change in the number and location of all ZVMCUs in the image. The GIMP image editing software will impart into the image its own implementation of the JPEG Compression routine, its own Discrete Cosine Transform quality tables, and Huffman coding tables. This experiment is vitally important to determine how differing photo editing software programs might change the location, values and quantity of the zero variance minimal computer units in an image that will be used to provide the landmarks for further processing. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 140 Total number of images with no ZVMCUs: 360 Percentage of images with ZVMCUs: 28 % Average number of ZVMCUs per image: 226 120 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 94 Total number of images with no ZVMCUs: 406 Percentage of Images with ZVMCUs: 18.8% Average number of ZVMCUs per image: 141 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 206 Total number of images with no ZVMCUs: 294 Percentage of images with ZVMCUs: 41% Average number of ZVMCUs per image: 222 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 157 Total number of images with no ZVMCUs: 343 Percentage of Images with ZVMCUs: 31.4% Average number of ZVMCUs per image: 119 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 191 Total number of images with no ZVMCUs: 309 Percentage of images with ZVMCUs: 38.2% 121 Average number of ZVMCUs per image: 111 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 101 Total number of images with no ZVMCUs: 399 Percentage of Images with ZVMCUs: 20.2% Average number of ZVMCUs per image: 36 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 1274 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 262 Total number of images with no ZVMCUs: 248 Percentage of Images with ZVMCUs: 52.3% Average number of ZVMCUs per image: 552 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 348 Total number of images with no ZVMCUs: 152 122 Percentage of images with ZVMCUs: 69.0% Average number of ZVMCUs per image: 2415 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 0 Total number of images with no ZVMCUs: 0 Percentage of Images with ZVMCUs: 0 Average number of ZVMCUs per image: 0 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 505 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 214 Total number of images with no ZVMCUs: 286 Percentage of Images with ZVMCUs: 42.8% Average number of ZVMCUs per image: 203 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 85 123 Total number of images with no ZVMCUs: 415 Percentage of images with ZVMCUs: 17.0% Average number of ZVMCUs per image: 3 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 36 Total number of images with no ZVMCUs: 464 Percentage of Images with ZVMCUs: 7.2% Average number of ZVMCUs per image: 1 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to size reduction by 20 %: Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 22 Percentage of images with ZVMCUs: 94.9% Average number of ZVMCUs per image: 3110 Image Category statistics after size reduction by 20 % Total number of images with at least 3 ZVMCUs: 325 Total number of images with no ZVMCUs: 105 Percentage of Images with ZVMCUs: 75.6% Average number of ZVMCUs per image: 1214 124 Appendix F: Detail results for Test Four all image Categories Test IV: Image Quality Reduction to 50 % Program I: Gimp 2.6 Image Category I: 500 images with average size 2.2 MB This experiment is designed to quantify the effects of the photo image editing software GIMP on the dataset of images. This test will reduce the quality of each picture in the data set from 100 to 50. This drastic reduction in quality helps to scale the finding from test 1 and should provide useful insight in to how and when ZVMCUs are created. The resulting image size will be smaller with significantly reduced quality. The quantization tables used in this test will have the largest divisors of the entire experimental test set, resulting in the greatest number of zero cosine coefficients. The expected results of this experiment are a vast increase in the numbers of ZVMCUs in the image and the dataset. This experiment is vitally important to determine how differing photo editing software programs might change the location, values and quantity of the zero variance minimal computer units in an image that will be used to provide the landmarks for further processing. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 140 Total number of images with no ZVMCUs: 360 Percentage of images with ZVMCUs: 28 % 125 Average number of ZVMCUs per image: 226 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 500 Total number of images with no ZVMCUs: 0 Percentage of Images with ZVMCUs: 100% Average number of ZVMCUs per image: 23603 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 206 Total number of images with no ZVMCUs: 294 Percentage of images with ZVMCUs: 41% Average number of ZVMCUs per image: 222 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 499 Total number of images with no ZVMCUs: 1 Percentage of Images with ZVMCUs: 99.8% Average number of ZVMCUs per image: 3924 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 191 Total number of images with no ZVMCUs: 309 Percentage of images with ZVMCUs: 38.2% 126 Average number of ZVMCUs per image: 111 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 486 Total number of images with no ZVMCUs: 14 Percentage of Images with ZVMCUs: 97.2% Average number of ZVMCUs per image: 785 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 1274 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 496 Total number of images with no ZVMCUs: 4 Percentage of Images with ZVMCUs: 99.6% Average number of ZVMCUs per image: 13103 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 348 Total number of images with no ZVMCUs: 152 127 Percentage of images with ZVMCUs: 69.0% Average number of ZVMCUs per image: 2415 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 495 Total number of images with no ZVMCUs: 5 Percentage of Images with ZVMCUs: 99.0% Average number of ZVMCUs per image: 8469 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 505 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 459 Total number of images with no ZVMCUs: 41 Percentage of Images with ZVMCUs: 91.8% Average number of ZVMCUs per image: 1509 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 85 128 Total number of images with no ZVMCUs: 415 Percentage of images with ZVMCUs: 17.0% Average number of ZVMCUs per image: 3 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 198 Total number of images with no ZVMCUs: 302 Percentage of Images with ZVMCUs: 39.7% Average number of ZVMCUs per image: 5 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to Quality reduction by 50%: Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 22 Percentage of images with ZVMCUs: 94.9% Average number of ZVMCUs per image: 3110 Image Category statistics after Quality reduction by 50% Total number of images with at least 3 ZVMCUs: 430 Total number of images with no ZVMCUs: 0 Percentage of Images with ZVMCUs: 100% Average number of ZVMCUs per image: 17389 129 Appendix G: Detail results for Test Five all image Categories Test V: Image Size Increase to 120% Program I: Gimp 2.6 Image Category I: 500 images with average size 2.2 MB This experiment is designed to quantify the effects of the photo image editing software GIMP on the dataset of images. This increases the size of an image by 20%. The resulting image size and resolution will be larger but with reduced visual quality. This manipulation forces the software program to employ a fresh set of Discrete Cosine Transform quantization tables, which should cause modifications in the number and location of ZVMCUs in the image. This experiment is vitally important to determine how differing photo editing software programs might change the location, values and quantity of the zero variance minimal computer units in an image that will be used to provide the landmarks for further processing. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to Size increase by 20%: Total number of images with at least 3 ZVMCUs: 140 Total number of images with no ZVMCUs: 360 Percentage of images with ZVMCUs: 28 % Average number of ZVMCUs per image: 226 Image Category statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 0 Total number of images with no ZVMCUs: 0 130 Percentage of Images with ZVMCUs: 0% Average number of ZVMCUs per image: 0 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to size increase by 20%: Total number of images with at least 3 ZVMCUs: 206 Total number of images with no ZVMCUs: 294 Percentage of images with ZVMCUs: 41% Average number of ZVMCUs per image: 222 Image Category statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 195 Total number of images with no ZVMCUs: 305 Percentage of Images with ZVMCUs: 39.0% Average number of ZVMCUs per image: 325 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to size increase by 20%: Total number of images with at least 3 ZVMCUs: 191 Total number of images with no ZVMCUs: 309 Percentage of images with ZVMCUs: 38.2% Average number of ZVMCUs per image: 111 131 Image Category statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 132 Total number of images with no ZVMCUs: 368 Percentage of Images with ZVMCUs: 26.4% Average number of ZVMCUs per image: 89 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to size increase by 20%: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 1274 Image Category statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 334 Total number of images with no ZVMCUs: 166 Percentage of Images with ZVMCUs: 67.1% Average number of ZVMCUs per image: 1375 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to size increase by 20%: Total number of images with at least 3 ZVMCUs: 348 Total number of images with no ZVMCUs: 152 Percentage of images with ZVMCUs: 69.0% 132 Average number of ZVMCUs per image: 2415 Image Category statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 260 Total number of images with no ZVMCUs: 240 Percentage of Images with ZVMCUs: 52.0% Average number of ZVMCUs per image: 2440 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to size increase by 20%: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 505 Image Category 1 statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 274 Total number of images with no ZVMCUs: 226 Percentage of Images with ZVMCUs: 54.8% Average number of ZVMCUs per image: 496 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to size increase by 20%: Total number of images with at least 3 ZVMCUs: 85 Total number of images with no ZVMCUs: 415 133 Percentage of images with ZVMCUs: 17.0% Average number of ZVMCUs per image: 3 Image Category statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 60 Total number of images with no ZVMCUs: 440 Percentage of Images with ZVMCUs: 12.0% Average number of ZVMCUs per image: 3 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to size increase by 20%: Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 22 Percentage of images with ZVMCUs: 94.9% Average number of ZVMCUs per image: 3110 Image Category statistics after size increase by 20% Total number of images with at least 3 ZVMCUs: 377 Total number of images with no ZVMCUs: 53 Percentage of Images with ZVMCUs: 87.7% Average number of ZVMCUs per image: 2929 134 Appendix H: Detail results for Test Six all image Categories Test VI: Test I image results Quality restoration to 100% Program I: Gimp 2.6 Image Category I: 500 images with average size 2.2 MB This experiment is designed to quantify the effects of the photo image editing software GIMP on the dataset of images. This test attempts to restore the quality of each picture in the data set from 80 back to 100. As a result of the change the program will process the image using its unique JPEG Compression routine, its own Discrete Cosine Transform quality tables, and Huffman coding tables. This experiment is vitally important because the default setting on most image editing software is 100% quality. Therefore, if a previously edited image is opened and saved in image editing software, this type of manipulation will occur without any further action by the user. This will also indicate if software programs might change the location, values and quantity of the zero variance minimal computer units in an image that will be used to provide the landmarks for further processing. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 498 Total number of images with no ZVMCUs: 2 Percentage of images with ZVMCUs: 99.6 % Average number of ZVMCUs per image: 2229 Image Category 1 statistics after Quality restoration to 100% 135 Total number of images with at least 3 ZVMCUs: 497 Total number of images with no ZVMCUs: 3 Percentage of Images with ZVMCUs: 99.6% Average number of ZVMCUs per image: 2237 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 433 Total number of images with no ZVMCUs: 67 Percentage of images with ZVMCUs: 86.6% Average number of ZVMCUs per image: 632 Image Category 2 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 433 Total number of images with no ZVMCUs: 167 Percentage of Images with ZVMCUs: 86.6% Average number of ZVMCUs per image: 633 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 387 Total number of images with no ZVMCUs: 113 Percentage of images with ZVMCUs: 77.4% Average number of ZVMCUs per image: 226 136 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 387 Total number of images with no ZVMCUs: 113 Percentage of Images with ZVMCUs: 77.4% Average number of ZVMCUs per image: 226 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 498 Total number of images with no ZVMCUs: 2 Percentage of images with ZVMCUs: 96.2% Average number of ZVMCUs per image: 2558 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 479 Total number of images with no ZVMCUs: 21 Percentage of Images with ZVMCUs: 96.2% Average number of ZVMCUs per image: 2559 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 436 Total number of images with no ZVMCUs: 64 Percentage of images with ZVMCUs: 87.2% 137 Average number of ZVMCUs per image: 3635 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 436 Total number of images with no ZVMCUs: 64 Percentage of Images with ZVMCUs: 87.2% Average number of ZVMCUs per image: 3635 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 400 Total number of images with no ZVMCUs: 100 Percentage of images with ZVMCUs: 80.0% Average number of ZVMCUs per image: 664 Image Category statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 400 Total number of images with no ZVMCUs: 100 Percentage of Images with ZVMCUs: 80.0% Average number of ZVMCUs per image: 664 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 110 Total number of images with no ZVMCUs: 390 138 Percentage of images with ZVMCUs: 22.0% Average number of ZVMCUs per image: 3 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 110 Total number of images with no ZVMCUs: 390 Percentage of Images with ZVMCUs: 22.0% Average number of ZVMCUs per image: 3 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 428 Total number of images with no ZVMCUs: 2 Percentage of images with ZVMCUs: 99.5% Average number of ZVMCUs per image: 3963 Image Category statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 428 Total number of images with no ZVMCUs: 2 Percentage of Images with ZVMCUs: 99.5% Average number of ZVMCUs per image: 3964 139 Appendix I: Detail results for Test Seven all image Categories Test VII: Test V image results Quality restoration to 100% Program I: Gimp 2.6 Image Category I: 500 images with average size 2.2 MB This experiment is designed to quantify the effects of the photo image editing software GIMP on the dataset of images. This test attempts to restore the quality of each picture in the data set from 50 back to 100. Due to the lossy compression used in the JPEG routine, it is not possible to restore the image to the original quality. However, the image editing software will use the high quality quantization tables as a result of the request to save the image at 100% quality. The use of these tables differ from the ones stored with the image may cause some changes in how the image is finally processed and stored. This experiment is fundamental to learning the effects of quality restoration attempts. This experiment provides indicators of software programs tendency to change the location, values and quantity of the zero variance minimal computer units in an image. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 500 Total number of images with no ZVMCUs: 0 Percentage of images with ZVMCUs: 100 % Average number of ZVMCUs per image: 23603 Image Category 1 statistics after Quality restoration to 100% 140 Total number of images with at least 3 ZVMCUs: 500 Total number of images with no ZVMCUs: 0 Percentage of Images with ZVMCUs: 100% Average number of ZVMCUs per image: 31527 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 499 Total number of images with no ZVMCUs: 1 Percentage of images with ZVMCUs: 99.8% Average number of ZVMCUs per image: 3924 Image Category 2 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 475 Total number of images with no ZVMCUs: 25 Percentage of Images with ZVMCUs: 95.0% Average number of ZVMCUs per image: 2166 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 486 Total number of images with no ZVMCUs: 14 Percentage of images with ZVMCUs: 97.2% Average number of ZVMCUs per image: 785 141 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 486 Total number of images with no ZVMCUs: 14 Percentage of Images with ZVMCUs: 97.2% Average number of ZVMCUs per image: 785 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 496 Total number of images with no ZVMCUs: 4 Percentage of images with ZVMCUs: 99.6% Average number of ZVMCUs per image: 13103 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 496 Total number of images with no ZVMCUs: 4 Percentage of Images with ZVMCUs: 99.6% Average number of ZVMCUs per image: 13103 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 495 Total number of images with no ZVMCUs: 5 Percentage of images with ZVMCUs: 99.0% 142 Average number of ZVMCUs per image: 8469 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 495 Total number of images with no ZVMCUs: 5 Percentage of Images with ZVMCUs: 99.0% Average number of ZVMCUs per image: 8469 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 459 Total number of images with no ZVMCUs: 41 Percentage of images with ZVMCUs: 91.8% Average number of ZVMCUs per image: 1509 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 459 Total number of images with no ZVMCUs: 41 Percentage of Images with ZVMCUs: 91.8% Average number of ZVMCUs per image: 1509 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 198 Total number of images with no ZVMCUs: 302 143 Percentage of images with ZVMCUs: 39.7% Average number of ZVMCUs per image: 5 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 198 Total number of images with no ZVMCUs: 302 Percentage of Images with ZVMCUs: 39.7% Average number of ZVMCUs per image: 5 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to Quality restoration to 100%: Total number of images with at least 3 ZVMCUs: 430 Total number of images with no ZVMCUs: 0 Percentage of images with ZVMCUs: 100% Average number of ZVMCUs per image: 17389 Image Category 1 statistics after Quality restoration to 100% Total number of images with at least 3 ZVMCUs: 430 Total number of images with no ZVMCUs: 0 Percentage of Images with ZVMCUs: 100% Average number of ZVMCUs per image: 17389 144 Appendix J: Detail results for Test Eight all image Categories Test 8: No manipulation Save As only Program V: Image Save.py This experiment is designed to quantify the effects of renaming and relocating an image on the quantity and location of zero variance minimal computer units located in the image. This test opens each image, renames the image and saves it to a new directory. The resulting image will be analysed to determine the change in the number and location of all ZVMCUs in the image. This experiment is vitally important due to the fact that it is the most common operation that will be performed on an image file. Image Category 1: 500 images average size 4.1 MB average resolution of 9.8 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 140 Total number of images with no ZVMCUs: 360 Percentage of images with ZVMCUs: 28 % Average number of ZVMCUs per image: 226 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 140 Total number of images with no ZVMCUs: 360 Percentage of Images with ZVMCUs: 28.0% Average number of ZVMCUs per image: 276 145 Image Category 2: 500 images average size of 856.9 KB average resolution of 1.9 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 206 Total number of images with no ZVMCUs: 294 Percentage of images with ZVMCUs: 41% Average number of ZVMCUs per image: 222 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 284 Total number of images with no ZVMCUs: 216 Percentage of Images with ZVMCUs: 56.8% Average number of ZVMCUs per image: 1031 Image Category 3: 500 images average size of 115.0 KB average resolution of .30 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 191 Total number of images with no ZVMCUs: 308 Percentage of images with ZVMCUs: 38.2% Average number of ZVMCUs per image: 111 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 92 Percentage of Images with ZVMCUs: 81.6% 146 Average number of ZVMCUs per image: 324 Image Category 4: 500 images average size of 2.97 MB average resolution of 6.3 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 1274 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 483 Total number of images with no ZVMCUs: 17 Percentage of Images with ZVMCUs: 96.6% Average number of ZVMCUs per image: 3946 Image Category 5: 500 images average size of 553.0 KB average resolution of 2.3 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 348 Total number of images with no ZVMCUs: 152 Percentage of images with ZVMCUs: 69.0% Average number of ZVMCUs per image: 2415 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 456 Total number of images with no ZVMCUs: 44 Percentage of Images with ZVMCUs: 91.2% 147 Average number of ZVMCUs per image: 4372 Image Category 6: 500 images average size of 133.6 KB average resolution of .49 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 375 Total number of images with no ZVMCUs: 125 Percentage of images with ZVMCUs: 75.0% Average number of ZVMCUs per image: 505 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 384 Total number of images with no ZVMCUs: 116 Percentage of Images with ZVMCUs: 76.8% Average number of ZVMCUs per image: 812 Image Category 7: 500 images average size of 3.045 KB average resolution of .04 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 85 Total number of images with no ZVMCUs: 415 Percentage of images with ZVMCUs: 17.0% Average number of ZVMCUs per image: 3 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 91 Total number of images with no ZVMCUs: 409 Percentage of Images with ZVMCUs: 18.2% Average number of ZVMCUs per image: 3 148 Image Category 8: 430 images average size of 701 KB average resolution of 4.5 MP Image Category statistics prior to Save As Only: Total number of images with at least 3 ZVMCUs: 408 Total number of images with no ZVMCUs: 22 Percentage of images with ZVMCUs: 94.9% Average number of ZVMCUs per image: 3110 Image Category statistics after Save As Only Total number of images with at least 3 ZVMCUs: 427 Total number of images with no ZVMCUs: 3 Percentage of Images with ZVMCUs: 99.3% Average number of ZVMCUs per image: 4280 149 Appendix K: Source code: Zero Variance Minimal Computer Unit Locator from PIL import Image from PIL import ImageFile from math import * import os ???This program searches a dataset called IMCATs (image categories)of JPEG images looking for zero variance Minimal computer units (MCUS) within each image. A ZV MCU is one were all 64 pixels in an 8X8 block are identical. This will be useful in finding Visually similar but digitally different JPEG images within a dataset.??? ''' 15 Jan 10 created color hash module: this module will find MCUs that are not Zero Variance but #which are close''' '''5 feb create3d the all values module that calculates the total number of ZVMCUs and their respective pixel values from all the ZVMCUs in the dataset''' '''ZVsums module accumulates the total times a particular pixel value occurs as an ZVMCU value in a data set. Thie data will be useful to understand the occurrence or lack of ZVMCUs in an image this module is called from the xxyz module and takes in as a parameter a tuple value that represents the pixel value of an ZVMCU this module returns the accumulated values in dictionary form''' allValues = {} def ZVsums(*zvvalues): #maintains a running tally of zvMCUs by color "allValues" #in the form of ((RGB), number) accumulated for entire database. if zvvalues in allValues: #increment count x = allValues[zvvalues] x = x +1 allValues[zvvalues] = x else: #add zvvalues to allvalues with count of one allValues[zvvalues]=1 150 return allValues def colorhash(pixels): # Creates a singlar number for comparison of similarity of MCU's # all values from a each color band are sumed, Each sum is then #incremented by one, to prevent multiplication by zero, The product of # all the sums is divided by the total number of individual values. #resulting in a nearly unique number value for a particular MCU. cr = sum ((r for (r,g,b) in pixels)) cg = sum ((g for (r,g,b) in pixels)) cb = sum ((b for (r,g,b) in pixels)) return ((cr+1) * (cg+1) * (cb+1) / (len(pixels)**3)) def zeroVarMcu (image,mcu_size,i,sets): # module called from main, takes in an image, the mcu size and image number #returns a vector of zero variance mcus to the main #calls the writeOut module to create a text file of values of zvmcus parts = [] ZVmcu = [] zvvalue=[] t = 0 #counter for number of zvmcus in an image w , h = image.size #control line for managing how much image is processed for y in range(0,h,mcu_size): for x in range(0,w,mcu_size): c = 0 num =0 mcu=image.crop((x,y,x +mcu_size,y+mcu_size))# MCU extraction values=list(mcu.getdata())# all 64 RGB values in mcu while c < 64: if values[0]==values[c]: #compares each value in the MCU to the next num=num+1 #if values are equal continue in vector c=c+1 #if values are not equal then not a ZVMCU if num == 64: # if num = 64 then all values are equal and it is a ZVMCU ZVmcu.append((x,y,x+mcu_size,y+mcu_size,mcu)) #Create a vector of ZVMCU zvvalue = values[0] t=t+1 writeOut(zvvalue,x,y,t,i,sets) ZVsums(zvvalue)# maintains a tally of ZVmcus by color 151 else: c = 64 return ZVmcu #********************* def equalparts(imagparts): print"eq parts" dupl = [] for i in range(len(imagparts)-1): acc1, x1,y1,im1 = imagparts[i] acc2,x2,y2,im2 =imagparts[i+1] if acc1==acc2==0: diff=0.0 else: diff = 100.0 * (1.0 -float(acc1)/acc2)# creates % of similarity col = 0.5 if diff > col: if imagparts[i] not in dupl: dupl.append(imagparts[i]) if imagparts[i+1] not in dupl: dupl.append(imagparts[i+1]) return dupl def markZVMcu(OrigIM,mcus): #this module blends markers onto the original image to show the location of the zvmcus #this module returns a marked up copy of the original image if mcus: marker = Image.new('RGB',mcus[0][4].size,(150,150,150)) for (x,y,z,t,im) in mcus: img = Image.blend(im,marker,1.5) OrigIM.paste(img,(x,y)) return OrigIM def createpath(path): #creates a file path for output of the data from various modules if not os.path.isdir(path): os.mkdir(path) 152 def writeOut(zvmcu,x,y,t,i,s): #called from zerovarmcu module #takes in zvmcu: the RGB value of the mcu #x,y: the coordinates of the mcu #t: the count of the mcu in the image #i: The count for the image being processed, used to create unique filename #s: The count for the dataset being processed, used to create unique filename #writes to a file the data calculated by various modules Writer=open('c:/zvmcu/2IMCat%s/C%s_image%i_RGBdetails.txt'%(s,s,i),'a')#writes to the 'zvmcu folder, creates a file for each # image in the dataset, each file contains ZVMCU number, Location, and value for every ZVMCU in the image. Writer.write('ZVMCU ' + `t`+' (' +`x` + ', ' + `y`+')' + `zvmcu` + '\n') Writer.close() def filedetails(w,h): #used to create a separate file of the meta/information about each image file. #takes in the attributes for the image to be recorded and creates a text file. Writer = open('c:/zvmcu/2IMCAT%s/IMSizeCat%s.txt'%(sets,sets),'a') Writer.write('image%i size='%num +`w`+ ' x ' + `h` + '\n') Writer.close() ## MAIN ====== MAIN ===== MAIN ===== MAIN if __name__ == "__main__": sets=1 while sets < 2: createpath('c:/zvmcu/2IMCat%s'%sets)#creates the folders for the storage of the image category processing # path = ('d:\zvmcu\IMtest%s'%sets)#creates userfriendly varible for newly created path num = 1 print "Image test %i"%sets+" is Processing" while num<501: im=Image.open ("c:/PhDfiles/THUMBDRIVE_COPY/Doctorate_files/Photo_database/IMCat%i/image% i.jpg" %(sets,num)) sizw = im.size[0] 153 sizh = im.size[1] filedetails(sizw,sizh) lsMcus=zeroVarMcu(im,8,num,sets) l=len(lsMcus) print "Cat%i Image %i" %(sets,num) Writer=open('c:/zvmcu/2IMCAT%s/ZVcountcat%s.txt'%(sets,sets),'a') Writer.write('image %s ZV MCUs = '%num + `l` + '\n') Writer.close() num=num+1 sets=sets+1 154 Appendix L: Source Code: ZVMCU results from math import * import os from PIL import Image from PIL import ImageFile import time import manipResultsTally '''this program will analyze the resulting images from the 7 separate manipulation test that were performed to change the JPEG compression routines and alter the DCT starting point for each image the intent its to determine how the manipulation changes the predetermined number of ZVMCUs that were discovered using the ZVMCUfinderOK program. by wallking through the results of each test and outputing the results to a folder/text file''' ''' added timer to time the run of each Image category, 18 Mar 09''' ''' zeroVarMCU module is used in 2 programs ZVMCUfinderOK and Results analysis''' def zeroVarMcu (image,mcu_size,i,sets,z): # module called from main, takes in an image, the mcu size and image number #returns a vector of zero variance mcus to the main #calls the writeOut module to create a text file of values of zvmcus # colors = [] ZVmcu = [] # maintains a vector of start and end coordinates of each ZVMCU found zvvalue=[]# maintains a vector of the RGB color of each ZVMCU found t = 0 #counter for number of zvmcus in an image w , h = image.size #control line for managing how much image is processed #w = 24 #h = 24 for y in range(0,h,mcu_size): for x in range(0,w,mcu_size): c = 0 num =0 mcu=image.crop((x,y,x +mcu_size,y+mcu_size))# MCU extraction values=list(mcu.getdata())# all 64 RGB values in mcu 155 while c < 64: if values[0]==values[c]: #compares each value in the MCU to the next num=num+1 #if values are equal continue in vector c=c+1 #if values are not equal then not a ZVMCU if num == 64: # if num = 64 then all values are equal and it is a ZVMCU ZVmcu.append((x,y,x+mcu_size,y+mcu_size,mcu)) #Create a vector of ZVMCU (sx,sy,ex,ey) coordinates zvvalue = values[0] #RGB values of the ZVMCUs one per-zvmcu t=t+1 else: c = 64 '''writer.open('c:/programResults/IMCAT7/program1/results/colors.txt') #change 'program number as programs process' writer.write('colors =' + `colors`) writer.close()''' return ZVmcu # ((sx,sy,ex,ey),(sx,sy,ex,ey),(sx,sy,ex,ey),(sx,sy,ex,ey)....) '''Write out module''' def writeDetails(rgb,x,y,t,i,s,z): #called from zerovarmcu module #takes in zvmcu: the RGB value of the mcu #x,y: the coordinates of the mcu #t: the count of the mcu in the image #i: The count for the image being processed, used to create unique filename #s: The count for the dataset being processed, used to create unique filename #z: the count for which test results #writes to a file the data calculated by various modules # image in the dataset, each file contains ZVMCU number, Location, and value for every ZVMCU in the image. #R,G,B = zvmcu #pixel = (R,G,B) #Writer.write(`R`) #for writing individual values not needed for now #Writer.write(`G`) #Writer.write(`B`) #writes to the 'zvmcu folder, creates a file for each Writer=open('c:/programresults/IMCAT%i/program1/results/test%s/dataset%s/image %i_detail.txt'%(IMCatnum,z,s,i),'a') Writer.write('ZVMCU ' + `t`+' (' +`x` + ', ' + `y`+')' + `rgb` + '\n') Writer.close() '''ZVsums module called from ZVMCU finder module''' allValues = {} 156 def ZVsums(*zvvalues): #maintains a running tally of zvMCUs by color "allValues" #in the form of ((RGB), number) accumulated for entire database. if zvvalues in allValues: #increment count x = allValues[zvvalues] x = x +1 allValues[zvvalues] = x else: #add zvvalues to allvalues with count of one allValues[zvvalues]=1 return allValues '''file detail module''' def filedetails(num,w,h): #used to create a separate file of the meta/information about each image file. #takes in the attributes for the image to be recorded and creates a text file. #Writer = open('c:/Georges/zvmcu2/IMCat1/Alltest1s.txt','a') Writer = open ('c:/programResults/IMCAT%i/program1/results/alldetails.txt' %IMCatnum,'a') Writer.write('image %i size='%num +`w`+ ' x ' + `h` + '\n') Writer.close() ## MAIN ====== MAIN ===== MAIN ===== MAIN ''' image category number between test runs. this number is input by the user at the start May also alter the number of test that are being analyzed, if the number exceeds 7.''' if __name__ == "__main__": IMCatnum = int(raw_input ( "Enter the Image Category you wish to process (1-8)")) test = int(raw_input ("Enter the testing start point (1-7)")) teststop = int(raw_input ("Enter testing stop point (2-8)")) start = time.time() print start #test = 6 #7 current tests while test < teststop: dataset = 1 # sets the number for the datasets of images to run (datasets 1-6) while dataset <7 : num = 1 #sets the image number for beginning of each dataset run. while num < 501: try: im = Image.open('c:/programResults/IMCAT%i/program1/test%u/dataset%u/image%u.jpg'%(I MCatnum,test,dataset,num)) # the image category is made as user input sizw = im.size[0] sizh = im.size[1] 157 filedetails(num,sizw,sizh)#calls the file detail module to record basic, size/resolution data about image lsMcus=zeroVarMcu(im,8,num,dataset,test)#calls the ZeroVarMCU module; returns tuple of image data l=len(lsMcus) Writer=open('c:/programResults/IMCAT%i/program1/results/test%s/dataset%s/ZVmcuC ount.txt'%(IMCatnum,test,dataset),'a') Writer.write('image %s ZV MCUs = '%num + `l` + '\n') Writer.close() print "DS%i Image %i" %(dataset,num) except IOError: pass num = num + 1 print 'dataset %s' %dataset dataset = dataset +1 test=test + 1 print 'test %s' %test finish= time.time() elapsed = finish - start minutes = elapsed/60 print 'this run took ', elapsed answer = raw_input("do you wish to run talley?") if answer == 'yes': manipResultsTally() else: print 'goodbye' 158 Appendix M: Source Code for ZVHashComparer.py from math import * import os import shutil import string import hashlib ''' 23 APRIL::Hashes and compares the ZVMCU/Coord pair of each image in each test folder to same image in other test folders. This program uses the MD5 hash values of the ZVMCU details found within an image file and creates a probability of image match, using the hash value of the ZVMCU value and coordinate pairs. The sister programs, ZVHasher and ZVHasherfalsepos are similar but working with different fils''' '''def LineHasher() opens the text files and reads the necessary lines to feed the hashlib module, creates a vector of message digest for each rgb-coordinate pair''' def TSHasher(cat,test,num): strhash="" hashV=0 try: file = open('C:/programResults/TestsetCoords/Cat%iRGB/TS%iRGB/image%i_detail.txt'%(cat,test,nu m)) while 1: hashvalue=[] line = file.readline() if not line: break if (line.find('0, 0, 0') >1 ): continue if (line.find('255, 255, 255')>1): continue size = len(line) breakup = string.split(line) x = 2 while x < 6: hashvalue.append(breakup[x]) x = x + 1 159 m = hashlib.md5() m.update(strhash.join(hashvalue)) hashV = m.hexdigest() tshash.append(hashV) except IOError: pass except IndexError: print "oops Black & White one" file.close() def TSAHasher(cat,test,num): strhash ="" hashV=0 try: file = open('C:/programResults/TestsetCoords/Cat%iRGB/TS%iRGB/image%i_detail.txt' %(cat,test,num)) while 1: hashvalue=[] line = file.readline() if not line: break if (line.find('0, 0, 0')> 1): continue if (line.find('255, 255, 255')>1): continue size = len(line) breakup = string.split(line) x = 2 while x < 6: hashvalue.append(breakup[x]) x = x + 1 m = hashlib.md5() m.update(strhash.join(hashvalue)) hashV = m.hexdigest() tsAhash.append(hashV) except IOError: pass except IndexError: print "oops Black & White one" file.close() def returnMatches(a,b): return list(set(a) & set(b)) 160 ''''def Hasher(I) takes in the text string read from the images detail text file, and returns the MD5 hash digest for that string''' def Hasher(value): m = hashlib.md5() m.update(value) tshash = m.hexdigest() return imhash ## MAIN ====== MAIN ===== MAIN ===== MAIN if __name__ == "__main__": #the folder is currently located in the \\programResults\Imcat#\test#\dataset#\zvmcuscount.txt file #cycle through the IMCat# folder 1-8: open the text file #extract the image# and ZVMCUs, then copy that information into a separate text file print "this program hashes the RGB Coordinate pair of each ZVMCU found in an image." print "The results are stored and compared with other images in the database" raw_input("press enter to continue") catagory = 1 while catagory < 9: num = 1 print "catagory%i" %catagory while num<501: test = 1 while test < 8: testA = test + 1 while testA < 8: #print "Cat %i Test %i im %i is Processing" %(catagory,test,num) match = [] tshash = [] tsAhash = [] TSHasher(catagory,test,num) TSAHasher(catagory,testA,num) match = returnMatches(tshash,tsAhash) tsA=len(tsAhash) ts=len(tshash) ma=len(match) Writer = open('c:/programResults/hashresults/AllTests/C%iHashNoLimits.txt'%(catagory),'a') Writer.write('Image %iTestSet%i= '%(num,test) + `ts` +'\t'+ 'TestSet%i= '%testA + `tsA`+'\t'+'\t' + 'Matches = '+`ma` + '\n') Writer.close() testA = testA +1 test = test + 1 num = num + 1 catagory = catagory +1 161 Appendix N: Source Code for Mover.py import os from PIL import Image from PIL import ImageFile '''this program is a specific program for test8. This program opens each image in every category then renames them and saves them to a new directory. Because of the JPEG compression routine is implemented when the image is saved to a new location, any MD5 or SHA1 hash is as a means for matching these images.''' ''' added timer to time the run of each Image category, 18 Mar 09''' ## MAIN ====== MAIN ===== MAIN ===== MAIN if __name__ == "__main__": IMCatnumstart = int(raw_input ( "Enter the Image Catagory start point you wish to process (1-8)")) IMCatnumstop = int(raw_input ("Enter the IM cat stop point (2-9)")) while IMCatnumstart1 ): satcount = satcount +1 continue if (line.find('255, 255, 255')>1): satcount = satcount +1 continue file.close() except IOError: pass except IndexError: print "oops Black & White one" file.close() 163 if satcount>sat: return -1 if satcount1 ): continue if (line.find('255, 255, 255')>1): continue''' size = len(line) breakup = string.split(line) x = 2 while x < 6: hashvalue.append(breakup[x]) x = x + 1 m = hashlib.md5() m.update(strhash.join(hashvalue)) hashV = m.hexdigest() tshash.append(hashV) except IOError: pass except IndexError: print "oops Black & White one" file.close() def TSAHasher(cat,test,num): strhash ="" hashV=0 try: file = open('C:/programResults/TestsetCoords/Cat%iRGB/TS%iRGB/image%i_detail.txt' %(cat,test,num)) while 1: hashvalue=[] line = file.readline() if not line: break '''if (line.find('0, 0, 0') >1 ): 164 continue if (line.find('255, 255, 255')>1): continue''' size = len(line) breakup = string.split(line) x = 2 while x < 6: hashvalue.append(breakup[x]) x = x + 1 m = hashlib.md5() m.update(strhash.join(hashvalue)) hashV = m.hexdigest() tsAhash.append(hashV) except IOError: pass except IndexError: print "oops Black & White one" file.close() def returnMatches(a,b): return list(set(a) & set(b)) '''opens the zvmcu details text files and extracts out the ZVMCU details of RGB & coordinate vaules stored by the ZVMCUfinder program. for each image this information is passed to the def Hasher() that will create a MD5 digest of the data pair. ''' ''''def Hasher(I) takes in the text string read from the images detail text file, and returns the MD5 hash digest for that string''' def Hasher(value): m = hashlib.md5() m.update(value) tshash = m.hexdigest() return imhash ## MAIN ====== MAIN ===== MAIN ===== MAIN False Positive Tester if __name__ == "__main__": print '''this program hashes the RGB Coordinate pair of each ZVMCU found in an image. The results are stored and compared with other images in the database. This program compares known dissimilar images attempting to produce false positives from the datasets. This version 10 May, has parameters that adjust the impact the RGB saturation points from the comparison test sets. Output is saved in a tab delimited text file "falsePosNoLimits"''' while 1: cat1=int(raw_input("enter first category number (1-8)")) cat2=int(raw_input("enter second category number (1-8)")) satpoint=int(raw_input("enter saturation cutoff in pixels (500-10000)")) 165 if (cat1 != cat2): break print "category numbers must be different" test = 1 while test < 8: num = 1 while num < 501: satrtn=SatTester(cat1,test,num,satpoint) satrtn2=SatTester(cat2,test,num,satpoint) if satrtn==1: if satrtn2==1: match=[] tshash=[] tsAhash=[] TSHasher (cat1,test,num) TSAHasher (cat2,test,num) match = returnMatches(tshash,tsAhash) tsA=len(tsAhash) ts=len(tshash) ma=len(match) Writer = open('C:/programResults/hashresults/AllTests/falseposSatTest%i%iS%i.txt'%(cat1,cat2,satpoint),'a') Writer.write('Cat%i Im%i Test%i='%(cat1,num,test)+'\t'+`ts`+'\t'+'Cat%i TS%i= '%(cat2,test)+'\t' +`tsA` + '\t'+'\t' + 'Matches = '+`ma` +'\n') Writer.close() num = num + 1 test = test +1 print "done" 166 Appendix P: MD5 Hash Results for Theory III Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image1 4ae3136a1cb3a6b 2087298aa952ed0 50 *image1 ba4b174ca85b1fb088 f405b81c0de5e2 48783c9e8381d754f5473 1029483d9af cc791f7ad34f36d74402e 2b73ab3e567 *image10 b323b00927affb5 8b1d49545e873fd 9 *image10 d057c35 7 a832edb 2246fad251f588b 99e39a 7dde029f0a4cf0 30f6890548b 351144182731735c296f 7a00001e9cd7 *image100 06d385a02a12321 752721b9ebd936b 0b *image100 03b1d1e8fa524bae77 faab17ef8c1705 4eb300bd9928348832b1 ad9af2ff901a 00813c352a42bfadc8315 127b42fe785 *image101 8f243e6a3c1fd793 897f5385dc33231 0 *image101 c2482f25f0f256790c de4b09ceddda63 d4fe84dc22555b0b919e3 a72c1414ef2 205383d1bb551c9520c5 81f594f724ef *image102 5cc943896f9eca27 2388f75911e2147 c *image102 9cb0e038ba8f51cb9b f7d3bb33014714 4b21dc2531a71e82aed65 1decd44b67a b0d204607315a955d81a 1c57dc1f2092 *image103 e9a7ed68c247cfb3 ab9c0d0764dc7b6 2 *image103 d3b860599fcc5eac81 d8ba815947fe98 6ca7d3ec0329e948f2dd2 2f75c964f7d 1ee8ed5e61179f3a1f86a 1b3c57be0b4 *image104 732e2dbedc21196 1151c7235bd2d7c 6c *image104 bd2ec1d249da9c6a86 3900da457fcb93 8d07b3437617298c7032 3ac5d7dd013a 90b87c89a3047d6b7a82 b6f61392fa17 *image105 5ce90c562278644 73c9df52e865ce93 a *image105 422236be86b2b9e49 36764311a19236f 5263956411fc3a1be6a6e bc9dd5ad0a4 cb8485b87da131c42ad6 b822976ff5e2 *image106 9cb0b1405fc3ec27 16369933ad6b93c 3 *image106 8abe408a70502cec20 e6fb11aa05b707 a2f16e0c5ccddc53cf0cad d8ada7c122 704e4d658c0f825694776 0fd175ce3ce *image107 29e2dab97497534 94c60a038e04cd4 eb *image107 33b5f08b81496ea19a 99c09f62684b7a abcffb86a50e9538755d5 6228eb66392 a8d7a18865701535d2be e9136147bfc2 *image108 b01d218e0fb44d7 352c381d62d36c1 4f *image108 5fb9078aa6e4654252 090382ea5789f2 ea784a379fe79da67515f 4640c1cf70c e6be70ba594c567718edd c0515ee28eb *image109 f887cbfd5aa60f9ff 038aea94c9d937f *image109 4cb4f3a08b8e918e99 63613c4a771493 eee0308237dc2166bc211 60739284a7a b47888e1cf27ae3078998 cd30c97ee3a *image11 3a69d4bf045058f5 855c6330138f079 6 *image11 329b053b80dedabe3 63fba0c94b6d2a5 c6b794ad43e24396ede48 a5833e1b3ca cbd101c4467c4138fc01d befb0e8dff2 *image110 c865d9247bbc19f dde0bcfec977c5b2 8 *image110 06cba52d21a400030 166a1f285ec53be 000d7d3a0346dbc1ffefe7 d951dd5a35 ce6a4fc24d04136ca0834 41d1092f5e5 *image111 16979a2d427c94d fa0e97e79efef03c 5 *image111 154e0840e93715848 52dbfa598ffe7b0 d2ba9db5bbd0ae05e7e29 eb9f98489fa c5afa2a62407b09ee8f81 50149c0264a *image112 eded70c034b8c0d 8a4eda42d4239d1 38 *image112 b791cdb206f559fa32 d1d8942d7555cc bba0e7fc3a8bc228c07a6 49ad297b2b3 85696b424591940baa90 6e99b7845537 *image113 fe97dbe7fb46e89d 079708544c315dd 2 *image113 ab55c4774b224fe558 442437d6c19160 48ed6bebd524aecb720b6 19a54b17f80 466029384aa2fe7180aa0 414b1db93a7 *image114 0a2c81e76901abef d45612bf263c2a6 d *image114 60337f9658cb940ca4 d76b1bc82ca807 d8612357eed90bc849e27 0796f76914a 8d2313c013f65e6ece08c d7a914d101c *image115 54db7033ebe7e0c 74f22d1190a9d1b 80 *image115 4b10be81fbf8df24f0a 598b2dafe0806 865188376f660032cb218 17f9ec9395e 282755c5ddb740905ba7 737bfbe93ce9 *image116 2afbe32db8d6d1c 49e1b1e42467feef 9 *image116 bdc9212e879ab1baf4 2f487db383914c 6af08f3a1a355199f2f408 5489b8368c edc359cdf64f920ad2409 5713e99bc60 *image117 e5a75f873eaa71c0 c75cf72e9906905 7 *image117 0511e81858cc47a27 6a47eb1fc2d1f2c d0ff6bbbb24770affdc894 e3b17e64e0 2aa787ff9d36ecb646882 c7341fcceb2 *image118 ebc09e60cb7192e 3e058370737327f 44 *image118 8fddc25321950b91a8 7aae1180c7ad98 2458b02330ceb56c8ae55 d3a7950de8d c672919a0a340017b210 6143ab246974 *image119 d0fdac19893d29ac 9719fe23fd403526 *image119 d52e59257a11e1986 e27f8bebf03efed 3a118f4679f53f1b4770a 6757d227c57 29b24e7d4821ddd03d71 ddbd20d6df6e *image12 cd04d0873a34fa9 66dc777d9f8785f4 6 *image12 53b0bc2b47aa544c9 720a5e4fd039622 930af8ee93b7e28360493 38f9f2aca5c cf3ac821886b64d3baf12 51084395bea *image120 6091f2bb2cef97cf 2e0a15bb1383021 9 *image120 091ef2b9b1cd956f6d 533bb51411f0e2 f10e1f8af4197a868210d 65ee7d2620c 5659940df088875793b4f 896e7aca3c5 *image121 4c23293dd3b9e0d 579c2326140bce1 80 *image121 678bbca7eb92b4d8fd 14f49b0dd04624 3f3fb6924ac82be4417cb 7729b86fee3 12e460363a41c201325b 0c99e5d7fb58 *image122 75c169edc6c8c3d 33138518ea08923 fb *image122 8cb54415f183c2bb40 2ef449a144a638 483b8e802700b7117e7a 82c2cd605914 56cf5d471dadda3239f1d 7dfa247e801 *image123 88e908a72ec0de6 cb4476be7ae0f3f2 5 *image123 1cfb41de7afdef2b92 2372e7515f8a9f d70d430d1fd45187e3773 d0190d21f4b 13d126a15e9df13f07824 38803245b73 *image124 8b15f51ee99296a 20636554dd3cba2 76 *image124 aba48304a0d27c8e3e 3d8aa5c0de2a74 8f86cc90c6984eecb8fc89 a19d48faff e97f5ed10de3e603ec2a8 35caed5070a *image125 97f0c1b167a080b 6c91f7a4debca7ba e *image125 63097c2324dccd83a d86a361c4b14971 89f973fe07f5f803772df0 78dbc73ac7 f49ebf08d35ed81e28cb9 02c70f9cc4d *image126 58f941ea5aa718a7 2552083a3d94587 5 *image126 40d3bd8bf7cb82c9fc 4855d4f90e704e 0e2b0e4d1430e4fac5503 e18ef5488c7 d8e49c7307f58354fbf07 d3c49179b01 *image127 32ebcc90942fa8e6 39138c2dcffbcdcf *image127 81fc4d4972aa92f168 9db467455310ca 989cf3171da8975c75f81 c39e6d0960a 63937f6a452a9e75fff329 f8348897e2 *image128 89b22cd373cc4a9 d883067ee141e7b 6a *image128 f6a5e911d573d11198 572e70df33b992 6a4a0f339338e632d2075 d73d800d440 56e44db2f1154046763bc 4ae41da83b9 *image129 c0b402ddacbfad18 ff3933fbddfbdc31 *image129 42ab0e4928420df2b7 185cc5c69cd54a 381054280c83ae2ebb90a 816d412a6a7 5e9017e7ae6f749879567 a442eeca543 *image13 0f9e791b37163b3 e6d702ffe0a2819c f *image13 4e52e462715c29aded 700dc414e7d6b4 73f870ad2fdf251bc703c 031daf8ba6c 6c06535c657ec61f30860 f762cfb5bec *image130 810cf3e3895de41 676629f990e5b7d eb *image130 718800bb8858ded97 807243cf404d4fd 871d85181960ca02b8eee 5ceeb775103 1a7329f5fd017fb0140fb de4763f08b7 *image131 20485cb4969aab6 d247dcc14395e96 67 *image131 b9c5f696bb0a9ec75e b37697dc518583 bd02e36235a13a75dc472 e814d1683ac 45aecc8cb6d3e6d6766df 18af81950d6 *image132 4e491b630649cc7 7820632987ce5c5 8d *image132 2ab7c41997ddee7b3 9ed5324fa211a0f 42a237cb598a8bb0abcfe 1feac9f69a0 7478ec963aa1b2edfa15b b02e2fcd5ab *image133 7f704a157f6d6c58 8fa6f37cf39044f5 *image133 05e80ea587c798223 7ae2d16e62a3431 d9f1a858a11fb91788f49 052d7d52a59 0d40497aad5768dd9ad5 38faf3c3846d *image134 84e25f43ab94840 ca419a963ded225 79 *image134 32c5a234e24fdd03d0 dde47d8234f873 9aa9eb03021dcc90794ba 9dcab75e673 ec0b58655d91c5050c41 8d1acb24959c *image135 3d70c117cc3bab2 ceae1edf5eb31a33 4 *image135 5b3b686472f2c3480f 17f241407a7807 6669a2b0fdf7d30009052 6e720d7f7dc 9ed96acf4f071be1a2f018 043279740b *image136 fb9951142fc51f4e 300d959e6122595 2 *image136 f1b3eaaa8454158307 0f052d529f8b71 1c7af28585c5c87f3f0cc1 bb1522bed2 1c0b435acbeb1f7887e1f 00ccd6e0553 *image137 642669aae76313c 1673203da69e544 45 *image137 a94b55d39bc0d1bed 8aaf964143db4f2 4c6fffd28db2b75998a71 7f6c3a8fab5 443a3f5585a7b141abbd3 1d0e5d0de71 *image138 0f205779870dae0 6cde113223362da 5e *image138 aa8e731a7a0a6a6725 00fffbb2f44714 84c6aee0d4887bf2e4ef9 27649c1dace ea7232abb2cfaf1b97a71 9ca88918800 *image139 7ff514d4020955b 42ce770eee8782d d4 *image139 417810c2e66aaf907b 35a3212e8c24cf 56c1390efcdee31a0ab19 1e9ad696ef6 1015f5634b24751c288f7 dcd9fef8e1f *image14 3e8897e3898a969 b2f94dd3ff51708d 0 *image14 5a52936f0bf8c1dad4 d85bdc6e865b94 a7cb22ee0fb5ebfe33d0ef a4ca382907 dd08376464c4703d80dd 97054cf6462d *image140 9ab9646177a2f84 a0b1c480fd5e2b6e 0 *image140 8d50c250373b42761 16b7ca0e61df3ad 76f14e70ca4b98b85799e 8a33585b1cd 3ff71c50056c724467b8f a46afecfbab *image141 424b7a4990bdb35 e89ee8a718d99a6 ca *image141 271a768e6494ed208f 43210eefc6fe28 030d657c043f265eee5ea 4f4aafbb451 06a8fbd0db59ca8815893 8f8d85d9db4 *image142 0ed6bd4dc8ebe8ef 5b5ce3cef2135dcd *image142 62a584e66d8dbf264e e1b1ab0ac5aa15 ed8e19b6a8368fc62d316 d4bb1434736 669f2d5e0b034cf54b674 f70060ae599 167 *image143 338f4ba84467e2d 5b048f384e64f88f d *image143 86985771da32681a0 10bd91e6a9b3062 a796b4d331dd32a336b7 a293b3df2fc8 1af3d6c9ebf8c5cb2f5502 00ea280602 *image144 43027b043c87d23 b4335a83275b854 09 *image144 b53c4d1b426878d72 42e5e838b31657c ca5e3db067a129cea0e35 4aaa1427d92 69df1a5b833bb94acfb85 ef3fd2efa2f *image145 0d4c7d9d206891f 80a026d262709d2 e7 *image145 c0c6f8005021361cb0 35c57dfe394043 4c858c8069e178b8181eb 7c9f2c210c0 a00ff140e3b5e2a019a32 205e719d2de *image146 cb1d618cc43992e c8c5798f92197fc6 c *image146 b0427478848793feb 161ad676bd83478 b900e47a58479247a47c1 c51d28ad9fc 61483d5c5982cb0e00f94 d670103c193 *image147 74d98f58cf81b78e aa37ec557b67b02 d *image147 b0f47dd78d0e697e2b c177d0e1bea5e2 258a50603022c2267967 0958fca3aa61 d0ba5fb9552acb9baac81 410300f492d *image148 6c74338f8ecc233b 1932319a6b581d8 c *image148 436635bee221dbb63 6073c3193204acc 4581d4d6c0cab47485ffb 5276eec3186 1b904093eccc722780fa4 1286b8c358f *image149 b3ecb7661f1124e 2857b85e1f799a1 92 *image149 740a0e09b6e3cface6 4af308a177c6b8 32557552c17ce9dd7963 42145bd34482 c426e9df2cd16dd727c78 9a299ba19c3 Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image15 d76ad4b4df22e8ec 6568cafe9a4c96e5 *image15 6b83417e9b175c558 071b7254dad4b34 fe48c85d8666a6fb368aa 5c278305adf 754dd0dcafb79afdf7cfc3 1b6e39f19b *image150 b 1 797cb 58414 8c0452771631108 9d *image150 f5d1 feed78e134fb1 194856b35470d1 9f11edc117e5e76e396dd 4805f9c932a 6e396 42750894b62829 e44733beca28 *image151 44391dbfffa0f688 24c1a349d2d152b 9 *image151 5ae59ff3daf6be3c6cb bddaab22fb266 e229899c9713bdf5ac762 96d6e19db17 01caad8918861ceb85e06 f56143877c2 *image152 dec93a471988766 2825c2ca616ea15f 8 *image152 3ae25bc0ae83e75757 e51f5b4ae58498 e6028072065cb09e47fec a9ea22fd96e ae7bf9d8915400ee315ce 4332b4fc215 *image153 1a29d683bd9fc97 e434e17d7f6a71c1 f *image153 d47bf4bfe6aadf22e2 802fd0b20339af 00b4e42a06653615525b 67c0de8ecb2b 79a67371bb6a16f33f874 2c0150d3d89 *image154 3f263a1b1870711f 9ac731e79a6da49 c *image154 e7934c2a793057b45 1fbcf180a4e6057 ef88ab265106ac5eaf2d5c ee6f874033 e4f56cadbd69ed70f4137 7332377a159 *image155 142ce5e97b29291 7285e7c43357e73 68 *image155 7eb833428c2c942d3 a57e591678f8067 064c18b9d2e4bd0c2dc21 9b9a4e88432 45179d525cccdd7cb8d5 6f808ff01891 *image156 cd56e4251e9d0a3 a3d7e2a7eabb597 e7 *image156 874b2bdc6e74beab6f 7c117648e8a792 bc7d8b8ad8e74697a02da 3390018083a a4d4ab4745a6e277c584f 2da35b4559c *image157 6be764ae0bf7b23f 53cbd639a9fccff3 *image157 01215ab7b327b7a72f 4a5a00897d7d96 0ac30a1ac8a82a171268c 460c1beb8ee 1c8aec90a8b001bafe7e8 e79d157ffa6 *image158 c8269d3fd0d022d b048750e35b9f94 cc *image158 b935d1e853918ca6d ed3fcb5260736ea e31fcfef6a03877ea4ed06 0a82d9cce7 3c57ee73af12b17636591 9888f3d46b0 *image159 11414f1e85dd57c d991580d81188b8 1f *image159 dbffbe28c4e1905373 70331176349fa3 48ec3cb589517fd595f84 ad28b903029 9bb25ec3589c7e333831 6ed9ee5b5061 *image16 4ee41678dc22029 04cc5de492e3c74 7e *image16 30f9613e1bdb85b9b 13069042484cb44 7594f599aaae3b4d1a330 2c4333d03aa c2f6adb6479b21bb5703d f287754df37 *image160 13c8cc0ab2d0613 d990dd0b0ccdad2 f7 *image160 574e5626441f9a88f2 81d196df71ab77 c83e47a7c18d841b1e9ec 9f96f25910c bdeefcf484da5ca814649 682e91bbe99 *image161 f12258d193f8aa68 46dbba4ff92007a2 *image161 676043b0c9a1eba4d 36083840666e17b 095a09b6d3237bc848c6 7096a4d2d118 f8c9177e32c62192920ba 353a4dea135 *image162 535dabf920107efb 4b15eed6e034636 f *image162 c20938c519fd9ff9fa7 c709544f33df5 38af709ff316393180950 0cd3e3a5cd5 c079927b5f0265de28fae 73d119aa408 *image163 a65840fa2b857dd 42658211d6dcbc2 74 *image163 ae0cf27e381a0c4a3e 9cec746ff953ad d272db3dc5443e7f1431b 6ca184b7e83 992d89e74516d60a75f7e eaa717346a2 *image164 bfe3f4897250e4e5 c77bca6cdde0f780 *image164 80885a681ce79a7d8a 46bde5e42b7e3a e9584fa47b8033e506ca3 53561b56912 dd4bdc6234ce6e3d16eb5 44eb184fce5 *image165 c32083a503a7897 735d72afe2bb251 55 *image165 d640468992b1a610a bc2fb3c73e2fa9a 671cd75fb042eef00438b b849d6e1813 9b20b6fd9641ada52018c 4c70807f10a *image166 c73f6e958abd620 21e2630772eae52 44 *image166 3833478da4d544bb6 3f2167a49550660 9752df79f9eef3dde76e2b c56b38b2fb c1700b6092b7a28e1888 4c6c7114dc19 *image167 0d028a515158d31 bc44d19764502db 60 *image167 680aa41e04009dc3cf d582e0f3bc2ec1 dd203d0d109808815cba 077ef8633893 6394ea49354e6ef942a6c b28b4a5f9f7 *image168 bd9382e87b4c182 02c5dcf042526a4 d4 *image168 f05e219dd99a6e1542 124222bfac7f1d 408f7f72d28b1c3554d5f 94a6566da8d 9aef66c5145a28f8b4b9e 1041e2b5ab3 *image169 4dfa5886f0100de4 c9a10a265bb2754 d *image169 089c578f59e2441a7c a0a5f76a8f14b5 edc2715c6794c44765a34 9fc17da4f17 b8a2d8f881b786230724a e9eca56803b *image17 b30dfcca6b54dfdb 3f263360eec5e672 *image17 5f7a52415d746790fa 6ae4847669d2a4 52a69852e1c60afe230e5 dfaddf39fd1 65537d1f9dfb40bb67874 31438bda0f1 *image170 637402d1bd53a74 3519f56ab498e7a 2b *image170 9f6e25e04ecfddcd10 6e4238b3cbae9c 88ba170a933d66901470f e029bc3c651 acc7efc1c538ca8046307 7251f43baa3 *image171 e1b5d83be10639f cb778719200ab1e 9a *image171 4b68bfa06e8ac7769e ffc143093987b5 1c85a7f4a67c472869613 b609b22f5a2 03b2a46376e692871558 824cb09556d7 *image172 996cbf023a9a491 70d4d18cfb55e6c 4b *image172 613fc88b3d81bf68d3 134c03c413560f 60e57c36c298af7ce9077 ee89b039652 d068adb6827b31603236 21ec9cfa0244 *image173 d91a88db2283a7b 8bd8d4854546336 24 *image173 a3b92238c9f79eb6f5 25f990fab9939d 70229f60060ac5999d317 615613ea1a9 8d5c0ce3e3468290be0be 626ef041bac *image174 4587299759d5528 71fb0c375fae3d16 b *image174 a6eed35585a10e2566 daafb8cd81dd69 79f95c094a42f48f551f63 db3be45718 c0277f4cb8a4c48fed771 165719130e7 *image175 0f30d6fa0d454776 e9bba1dc62b8efe2 *image175 1890971d719d349a7 ed2416758f052b7 0b7676f7daf977c672137 d46303d538e deff00b4ce9f85d988cefb d6d8869695 *image176 fa5178f041775eb2 a01ac59e9a6459b 6 *image176 cba3b89f2396932559 4af023236c3087 69aef0f860c677741ac87 d4f3dda25a4 9591197d6f973a4a08d9f e19b20aa97e *image177 6c8476486767613 6529aadba68b601 90 *image177 4f63f0543e00e65205 6b3a0c1dd4e224 ae0ad9afdb5b5655089bb 6564053e134 a2d5f4272a1e44b311030 e606ba01098 *image178 be74ab6003fd42e 40a66d81b847109 58 *image178 15ab75ae0c47d1582 3765573f4c269cc 9069fee624cb9c242d0d1 a3e807aa41b 0314a3581de146ebd9c1 91c30b3f5a96 *image179 bf0a186232836f30 2da0e0656e99c18 8 *image179 0531152e469e51052 c6416635ebbe82a e3a73a880da97403f987e 4a6508587ae 68ea277bb210fd6abcd28 b92879768f2 *image18 ef293c76350959e 5424f65018c7676 49 *image18 6331fcb4e15b03d490 d395515fdf9d2e 8940bab232c21bd8b819 536d4a86fb29 683547a72ac7075ab383 37deb9b006ff *image180 75778f7900ab125 67204b0806bb51f 1b *image180 bfa55d72536cbf02b5 a256a59885bab6 d81160b47123315270d3 c8b177db094c ee04b3f24fa036c0a56fa1 bcdba1a40e *image181 ec345cf235e2594c 577db3db24274cd 0 *image181 401cdb89a3551a4a9f 561d1df1a07489 b53504298f10a4a70759c 44f29c470e9 9d935bb634d43dfdf42df 10d4fcd58c0 *image182 c9fb12dea7ebfd20 b31574e02026000 7 *image182 97ade0742660b73fce 5cb288ca3b9f7b d49670ddaaf2f6096255f 650c3bda357 d0604e8c3e72ff5c8d706 3c6ca6d061c *image183 0785b9110c0db52 058a5a0b1e44c76 76 *image183 31142ba70f944f05cb 8d77a5148066a7 4956f43d335cade984924 d3ccfc688eb 2be0a896107779988d70 4c1a62b9b8e4 *image184 3105961bdc45a0d a8b81d5cea87703 0c *image184 893cbb72c40001831 7a1d1555a1109d0 d34b35aab54185af9f719 0fd7b70e9d7 d7871c25c53f21e801240 2033a075986 *image185 b660a71ab7f3931 3fef56b6a7ed7278 0 *image185 aa3c90193567ff01de 9e77f7c28a76ec 50f459880642da1776e8a 9b377fa8e80 beccedd560462fb6111a6 887531f5500 *image186 9e7481ce0c14f804 9b15f16477d1249 d *image186 8e9cc25ec25c41f105 c9f6021ecbe226 d72509c1534209323308 de25ef55809b 79024116850f08883734 4a3eb3838104 *image187 841ddd09f113f50 433341a4cfca414d 5 *image187 a87d818eac113d1f9d 74ffd9bb23e143 1704879c991d0c89db4d 3cd5acb4834c 11e05822bcb91a3f7f780 5624f7263a5 *image188 383bca307b8fc86 858d718607ff202 95 *image188 8ec02f99f821e95553 20a29b9fb482d9 6a63bbc3119eeed48d59d ae9ea836228 c3b677ec5f101b2afbaf06 ab93aa66ed *image189 acfef1bf260b924b ce8a2419bc6979fe *image189 e7c8361faa50644882 3e70d23e7fcbea 5aa3f84bcf8281115add4 d2acd0ed856 bdce5e054e53882fdd6ae 0b41fa75cbf *image19 d6fed7a356a54dfc 52336e3c7111e45 5 *image19 e7b3c6af04a5ceec6ef a63f48b59990a 7736253efdeff5b52fcac0 b46d86cb2d d03c92eb03487bffa46db 4037161cb13 *image190 7fff40dd81db7e92 f48bde228d2199e 1 *image190 c1750be291f9b57d78 fbc79b0b7bab24 d269eeac8722b4fa31097 c9e30e64467 3fe267bba4ef9ae58821b 760a7b6a85d *image191 9d140e8cf74ee5e6 29b07ce83cb0b63 5 *image191 35b6d82c21732907a 986cde8b659fa6d b07abc18aea738808712c 888b146abfe d2c0719b7413d0cc5de3 2aa4680c27bb *image192 2d5eda51d8f10a4 d20175a3d1002dd 6f *image192 9f16347d171574003 8c06550c8455031 feab71e3b81babcd769a1 cfba4640bc3 8af22ddcad27aea3a18ec 11425c932d5 *image193 2fc49a055eb5d26 b345eab90bc1d0b 2b *image193 1114fa447a7c503c7b 9be1540ebb78b8 afccfea4c3666ed933d550 594b1e081f 10e436391e21bbae8dcfc a6fea619ef8 *image194 dff85f993f1bdaf1a 855a1f94878834d *image194 9b1b9bc4d8879037b 24fadce00e08c53 5c9e905685106b5bb28e 4450eaac6058 c1beb0565d0bb0d17d2b 6d7520e58019 *image195 e5b7d53a4151838 27897de71da2ce3 b5 *image195 e8642981e16b4299f9 64fa9ede8af6a5 079cdc6c22e8201afdc3d d2c3d6f92ae 9eddc2b95306f185cafc7 68a6cbda03d 168 *image196 42c368d0b6eddfd 097b8b1c9562b6f 6a *image196 fcd04d56f6a69a50eaf a8cefb8017ff3 1c98b109c0d3fbfcf12a56 37ae538321 16359d0946cc1cf0024a2 9a008431fac *image197 e82ae18f72bced92 40a87060d30713a f *image197 49ff71a86463c32b68 ab9053a7694b42 ae59c50e73519b6c6b5f7 d06ae7598a1 b1ae1d28e15d3cb833f1f 0aa5de4dc97 *image198 ce25e43089a1e37 2570f3fb0725aca5 4 *image198 6279548cad160b871 923cb5e1866a499 0cc75563f47b1a172a10d 5c896c40714 34fedde6ae6c8b98dc805 95096f92eff *image199 470e2eb01b63518 83b4c6ba1666ba0 26 *image199 b5d44385ff92f73f25 28ddf41f16fc60 0bce2d237a40c3dfc688c a2453cdd448 b0ebd7efd4e1c1e9ba4f2 e867b89fa79 *image2 7df9c574e1f0578b 268ea033e839ec9 0 *image2 1b601e2f8d7127570 3385cb175a470f1 248c1971d198bd986801 57ac9cd4fe6e 1e2e6e383064e667256df 25320b7e891 *image20 9cbaff18529cbe5e b439107deb65c0c 7 *image20 f55db0d0990fa1701c efe0279c137710 41e8ddff1f4434693d099 99229c700a3 655b737d9b33225c6406 5f6502fdbb80 *image200 4223a63c0121ed1 5966a4f834cd4a8 7c *image200 704fa6f39884da07c1 54422330815d18 b80575e0add7d70bc683 09a0aadfcce8 a790424505987734e2b9 75d8d8e460bd Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image201 2d6c93acb084e44 afd9023ee3b134f7 8 *image201 8e62e0a0c088e79faf 8f13a5e0f7c241 5c0e5465def7478515942 a3b049f2dfb 996cb96c2a7e72afa9db7 a4bb9963938 *image202 3acafd5581491dd 6d1aea7194af00e9 0 *image202 34 1f79c002eea30d0 dfc4eee65f6213 77a3501c85ea519f6a892 a738f91dcfb 839c507488f1536526fc9 21b5c22e3b6 *image203 ae87ea57ce066b2 93ebbd39a4b5180 d7 *image203 6d3b7a7dc5aca17c2c 6a3219bfd451fd 8e79b63862cce5b4f0df5 43e93bf784d f178ef420284ceb5bd1e3 b08663263a9 *image204 19e14d16c783266 8f58cd4f78d57aca 4 *image204 b2a08fcec68f8e88b5 3ab6bb215e4e87 a92cd823fe596f5aaebdb 2bcfe121db8 62d7a374bab7232812d5 cfc549059ddf *image205 4912195c3e95dc0 0951d057d73f13d 7b *image205 5ed6a9ce6317ef82f2f 9ff6bf3aceb44 4a9337d1ba2425c979eac fe0bbad06f9 98f2e50772e38024018df 2eb84d1e710 *image206 49d43f4cea23863 4e7f96df397f68b4 9 *image206 f6a106bd88ad1e2f76 3b0ab6194fef14 9e2e5bc2fee10f1353f2a4 6471410ce7 a2413c01fcccc40763de7 c6eb3320fd6 *image207 f0418acbe8b50fca 160c4a0fc3561abb *image207 4f2aba09119aef33b3 0961af5f772b6e efc043fa08744838cabae4 3b06ecde24 49645a90ab86eef6acae1 35b36dd7b18 *image208 9fa6e4770f3f92a6 70e8a4f1c82214ee *image208 249fe31650918c0889 0a1d36206c0588 cbd5cf66bceba6c4fd1c53 2ca03da524 44ae429da69279ecf83f1 47412fa7004 *image209 7f3a7df1f936ef45 ce1b88f860c2b4fe *image209 52f18c43105f9a0c07 94492657ddadc6 6841069f55afe90851417 9a81750f7f3 3cae26e5e7f99a7a98c0a 45a64aaca7f *image21 1a4948636406e76 96086bdeeb05c14 58 *image21 cefb882f181d7069c0 678c5a9787a649 80d56c9b7ead77cfece31 2a9b6d31f5e b58aab26d2e7b4f9edefc 6852036d55b *image210 18cbd9a42fa0953 22542d708ca456c 0a *image210 1522d8dfb371e9112 1e685dce6548eca 25864e70832c4388141e 13c78e3bd09d 03ec014f0f2d56aadc778 9e9726ea747 *image211 adbb135fd439915 71d1fad74acd51a5 6 *image211 cf4c575efdd54d7767 7cca72d79f9fcb e12db54b13a2aad77d90d 9ec58752e10 ee3fd1d443a6e2ea23e4fa 3e1bbd3dfd *image212 0cd7d7fb5681e99f 8cf8882e3477ab8 5 *image212 7b2e7be9ecec967f7d d4f8da17fab8d8 0cfb553113b51d90e1723 3fc2c1666c1 e18eb00fa58212336350d 8d0ffc59ee8 *image213 6758856a447cbb8 d40cbe0638b4a5f 29 *image213 cfa8cdaa86fa795700 ddd400dd48e694 616e7d6fb27155e8dc87e c29102ab5f7 9b49615bcfabdf57e124c ab076dcb1dd *image214 0e6013137c3f5bb 29a0654aa3954c3 34 *image214 e535033e9e0cfbfe7e ed297a6f2139c7 bdf151c0e5e70938bf248 73b0c91c85f 3bfdc0a1ccdc07efd1fb4f 2c627fcaf7 *image215 c5284763ca1096a 994f5f1d87f8a427 b *image215 a3294c3231fe6bd1af 8391f7df8c4126 fdea86cc2ec0da7a08e14a 3c7563a222 aeb60715896160973fe45 ee5c2d53a72 *image216 d01534809fd4f12 b5fd6f77fa565084 0 *image216 a214dc4953f59cb6e2 aee204d595e463 4b6d8cacfab31919a8901 2cc3120bba5 ae52e0063d4d234b89a4 8ed08a36a841 *image217 a826d6cda4c6e7a bd3221beedd3613 26 *image217 c36b29ccf0c4efad0d 8ebef2cb7d45a2 373e1a55899f1dd20e254 c6eea50002b e5440cc675439f776341e 512c49181f1 *image218 c5bfae54dd203feb e64da405fedd7fdf *image218 f61a766c6d92a360b0 41f8ac2039b626 afd4229dd58faca5d9097 df99bee708f 1763d7431f2f16bdb169a 5ee57da27b1 *image219 b2fa353110b8788 3f0b57ad5520cdb 5c *image219 a4b4d01fed3a4ca1f3 bd6848b6a6f12f ad00bd47e847d017658c 3f289eda204c 8a256e1de65f9dc07a072 c53b68bddee *image22 393b492036cdcba 656680eed8ec688 4a *image22 a5fc79232e6d05f5b1 88f5683711413c 7d087aee51fbac9ee0f5fc fd69b8209e 0d6bb93cba551e716359 d05d269cc692 *image220 29d0d14ff558cd55 5cebc5e3bfb0fe86 *image220 ccf29f1ca53a0f8ed1d 5fe228aff6ea8 9c12041ad78627fca3ca3 982f883f2cf 84676450298d1fbe83d1 1d5f8c5f1579 *image221 383d710286c4a97 9a5ac2c5088eaaf8 7 *image221 6f4478add7e58341cc 631d3822721f13 6826ac596087cf8087ab9 c6a1239c6fb 41f6bb82ba6e186f389c6 c69d9daa51c *image222 a95237a1670e82b bcccb2b14bc9c01 44 *image222 c29d1ebd9e54536b0 6089d12f416e2bc 477f95ae7ce20a76eadae 0951e2fc576 d990d385b043bd207d69 d077c209c69d *image223 8aab56136d4794b b4fac86c5b17b71 08 *image223 bed5028d9389ad5f00 ecdf4546654a00 6bd0b856d53c9cb2f8588 502a542511d 388d328b4419ae7de6d4 b60c5d367be2 *image224 36298662e7a7554 e2de4642031a219 8e *image224 79e17858c3df0c13d7 5e41330ac50e5f f372d10cb7f06860c5a5c 62236d99cd7 063ce1467c6d595c0d5d 41b18cbaf9c0 *image225 3ca3c68543070ed 566d3cd4fa51119 c8 *image225 6ac2267b43e722e9a5 5827af95e9a70a 6c3e8101dc1e8f9504287 6c1fd0cab5c 44b817c298f9a7f676317 869246b0c85 *image226 87e0038e08edd86 acf16d8607d792f7 5 *image226 e7052c80f6ccd872f1 62a25ee7e01001 08c00fbad7ddbdfc00f2ae 0a5235dbeb 992e26d0f1edbc51c8f37 bac9ba0ffeb *image227 b7463882ed2faffd 5a5ac8d20548095 9 *image227 6dfdc791040541323e 16d99c54dafb43 fd902b34ec751d0b8f258 e8c26de3d0b 188cfc3f261074c58ab37 8c5c50fb997 *image228 84002731637f476 7036a527dc89985 78 *image228 14d751bc3c27cf9e6e 617e7cbfa83314 9ec4a78ef3ac696985f7f8 bed8db0525 b835abf658c8860e17f5e fdf8b7ca31b *image229 cfb8f97718ab3bc9 f30b1f74a93f4cf5 *image229 0f025a4b675428e1f1 58bdfacc864e8f d8ca081407b2115a7a68c 7a363bc757f d2597e070bf25515fdbd5 3d007c78c4a *image23 6cccd66368275f1 4fe4de79931a850e 9 *image23 c5f887bb95e5c6888b bb0c5aab6fad73 cb7fb0f2b8d63fcc5acff7 aa5cd540a0 7dcb3052a9c2f68538e6d 7af3a4f57ac *image230 78391b610a7d298 0e3b0ae2d9a7ef51 3 *image230 976140fb122f219d3a 88acbafdb22ce9 a5381c24486c8cacd2d6e ed1f74fb4c7 44b3ad7f4722b5606bf04 bd4f2d2113b *image231 134c907c6934914 a533f11a182ef3b7 4 *image231 1e45bfc4df8c806914 5aeb855f750766 b75b0cfc20022dfe33039 85bf9cd9276 f44c419f5387f5a3133ec 3d4af0ddae8 *image232 da718efe11b07eec f9e8c79c8b0f1c33 *image232 ab0a8e940deaf25316 9c092817c81ae0 d957c661462766c00149 0303a26f89a0 02573b8d736aad45148e c38daf25e36f *image233 067d61e7642e4eb 20ccd9b1449286f 70 *image233 c1fed87d5ce2acd431 e1759cba15cf7c 7f5e4d9de12e7bacedd50 b28f11ff848 e18c3dcc85553f711d5ca edbb4e0864c *image234 53fdf895b1a3e773 3e5ac5673837dd2 6 *image234 3f612fa54b866d1012 ebad0a59450e65 41f6edbb3fc1bd845f9c5 67568152340 921e079c21dc1f08151f4 52e56c25d03 *image235 de0c51a34afe699d dac7ff449a319665 *image235 46e58a870cef552fe9 8c0907543f8761 a69809f8ce7413304e619 f6b1b80e952 662e4759b7276b2c509e 05695fb84f35 *image236 c99a58168aebfbc3 1fc05479a764cd5 2 *image236 21d60e1315dfd688f7 5a781d28cab9ae 0f8712ef8e4ade3e35277 cbf5872f3dd 17be7269d4e74ad48091 10fb0deaae7b *image237 76163ac8635571e 2315d24a538f4c7 74 *image237 e97b7458872d0dbc8 edb8c6a522aa584 f24f62569773193a95c35 74f6af8c11c 9230b4d0665cba3e323a 5b413310fc43 *image238 62d71043203a6c1 bd26e89b9b66fdd 63 *image238 9ebc10a4b380b8286 444a83f12f6eea5 8a56ec98e869239afb363 0aaedfe5cd1 49e9c2895df2cf189d330 180024c044e *image239 4527e047fe568c8c d343e0e6cec6c87 d *image239 c454ac528f53a84488 1423999a314e6c fe86b3feb0fa2009a750fb c2cfe19577 5f6183968d4d8da61760 33b08d945bcb *image24 80d0d75fe5d3de8 e31e12c54135b43 6e *image24 eae040aeab1209be9d 30130993e3102e bfd4d7eb48cc2c7db5b42 86b4c95fc98 c59f557233cf614b5dedb 4d0b5be485f *image240 ddd8336e5685483 10297c7bc8cbd12 b7 *image240 57332016686871275 ea51141ac57a907 462f534d75332a12c5cba 5ca7012e5d0 4c2f1c240e316b5ebebfc ecec8b4a1f3 *image241 d69167a2f8072b1 12b5192eb47ab0ff 2 *image241 bf3bd7fb4bba57d6a7 eb8631066759a1 51492af13079962fb171b 03126147d9d 9327d44142be87a49abb ea831f1a0d1b *image242 5322a8868b70113 d1b567731076c93 70 *image242 0278b922cf9230a359 25a1a537a43155 dde5880b5cb4e7f784d5b 9b86156b146 7a8d8cd5cbf2d051c8475 882fbac32c7 *image243 4b8e76d2b318545 4fbd5c32c200dce8 2 *image243 f52ce7bf4196855723 f933bca3369804 2fd2a0a053f75983c2fdfd 391c20d25b aa91eb5254bf8dde5dfd3 0d25935e0a4 *image244 20d80f3571a7393 69d6ad79b70b47b 34 *image244 4709b0190996a4227 99df8ed68f0acf4 d78532bfce39ed6cf3eabe 3a84fb65ef b0b0ee0b8532881d058e a4ca2abd4a46 *image245 e91ef2b9f34350fa 2ae1ab03b36d39a 5 *image245 f0c5940ef7a3932175 c6111a770d8d64 72c0ab5fa7e83af573acc3 e08cb2a0c8 1dcc16a839b557980ffbb 909923fedba *image246 57c3623a1c580da 6f52b6d6e05c737 80 *image246 ea2a8e30a821455073 d199807e6a202c 6f8db7ef1adffd6be91708 2db260f9f2 08e299a5c77d0cbb6121 9ce63da1a71b *image247 0dee9357ce4f2a8b bb4ff4518e0b0b63 *image247 7de24f20ce3a04081d 7ccf64744c8119 98521a2f151068fe3ee82f 219be45291 ace1278ce287721aef0e8 487f9644713 169 *image248 e4c29dcdf10915f5 21da644da8a48f9e *image248 fdd6f70b2090ca9ced a3827caeaf0459 8762cfca2cd3dccc4826fd 17c400fc19 8991d34b67544e5525c9 a588e2c4ccd5 *image249 3acc454f9a4d8c89 1cba8864a5fb139 d *image249 0b81102d6f28e2f305 18753baf64c6ea 39f97f0a2403c59613827 2cc8ae9e186 3e3debe549ecd98d392b9 a8e6cb30759 *image25 385cb80cf413448 6a525a896a1ed1d 77 *image25 2efcf5db01a7f407cd 7864c03c8816bd bfe75cba86815f8fcd7754 5f9001ff53 f93fa079eba1de07cd93c 3d25bb419e0 *image250 d2938cc74634db5 f668f55d15db850 87 *image250 5fe51e88a96535991b 5ad1e171cad9f6 dc947fdbe7eda5954e885 6dfd0687728 b2aefc9628cd5e3d38edb c6fcceb0b98 *image251 0489e4acf612794c cd6d8b6e1e60e64f *image251 9ed717ef7ec697830b d369c46c2bc936 010426b677d3a1bedaf22 3257f639829 0a255239b154b02dbecb 8a9fa6e553ef *image252 73166c7fb3a88a0e f24fa2e6108f849f *image252 bbf5e50e5955dc49cd 17d7be09d8b5b4 4a4a62fdcc7df538eed83 94cfc9b79c8 78d83e77a1d44d11f92c3 0753b47c29e *image253 269833d49d81dde 49a0e1ebb22c8f29 f *image253 126c27ea2480049a6 3a0c35516cacea7 e6631918d07206144b9d 0c8ff32c2fb4 0bcd32d065e838a52a0cd 951831ce9a7 Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image254 5d3c87b995e97f6 685f159daa96f4fe 6 *image254 b7d162a5e109d6570 28b3761a90b1e05 ce5c9d625d31703a0cd12 9d36271f24b a2b77860580038bdc285 502c60b42fdd *image255 0 7607b0e589c3b bddd7545f6b941d 08 *image255 d5c b7626b0806f21 35dcb6c09bbc9ac 39dc3b 8a349f1188314a f562b4068ea 3024 606ebb31e744f9 642b663084b *image256 c174fc0ac86c0123 0d39b0ca3add99b 4 *image256 4c8d31f504964530f2 15eebf89c42da2 a4d7f818929f6223ec4d2 c53a1306437 b34c26313a97a3a0aa7d1 997d74ba8c9 *image257 7d208bba98e2a14 8de32fdc0e180b0 78 *image257 a6a940d704a5f10336 849d0683d66c13 bd3bdf4590043b398606 79b68e647269 913f2bf5a6d60f61ac3fcf b01276d208 *image258 386915949564076 8dc84a67e4f7d49f 1 *image258 1286f0151a13afa058 895271b6a01d1c 820f9d1d9f16293b04f72 8592d545646 be143e59059a341b7300 4e0f7f7cb907 *image259 c6976228b0c53c5 5f8dd45a8340763 bb *image259 8830be22e8b2937f4a 01ca47fd446779 f18e0113341810c4644d8 b38bb415985 fab5e38ffc33f17f649e7b 831ff1e9e0 *image26 2cfdea4f198850f5 9600cbf06090212 8 *image26 1cbac76766e5df33ed 504bbec6409227 2a2f48d09fece7e2b64dca 24d96b77db be2597560987a5fb3a969 b232d901712 *image260 6abb65d47af1eb9e 4ad18e2f17747c2f *image260 80fdcf65a16197c47c a9d09704833cfc 0f5a68ecf444b3400553d 8244ebb5f9b e23fe2cd1404c76902585 518bacb7c0a *image261 97010d9887b1f60 50ac45a9c361227 4a *image261 1e4bb75c8d6722d8e 497cee3dcdcc91c e4679b3e376757ba5e5fe 0f0da76578e 1d6351842feeb71a46de7 05a0dcae05c *image262 f37db8d6d29f345 51f5796a889adef5 2 *image262 dc7d4ec285eb292a20 161b46375a331e 5eb1c2280b99cbbb47aad 67248d9cb04 4c356e4c60bc12031f5fd aadf69fa19f *image263 1928ec1a75b3cdb 005294294e9de73 5a *image263 a7e3719fd63e8233ab 25c7826a9f3ad5 6ec26fb36f673f96439c4 70d8e9b0f53 dc95c24baa8fa3303db6a 978379b48ad *image264 e6df215ec9a78714 e57b8511bd54f44 6 *image264 e5b4bdbdeb9579d8fe 4862ad3265c4aa 9c4fb19f07c7429ff94385 e2b8dc4edf c22b1f75ed752bb74e020 dbdd4e37e36 *image265 aebb1ff62cb4f804 373bdd71d5c15a5 b *image265 9f1003410e896c2db5 07c2092b024df9 d921a6cd075ec4692cf91 0d148386052 db040644d0ef129eb93cd 87613d455b0 *image266 17ebc2652f3007f9 edfe511a82cd94fb *image266 5bb977caa6fe1d95b9 38d451e9a82cda 31ad1efc4b4c55ec0cb3d 4fc4a507185 126d4815a325f482e9d84 88f611a9052 *image267 a6139db52c6f22b 936cf44c6015db1 d3 *image267 d03c7a24ae8013f617 21b503d33de7a1 03f58150d21aa2e32fe86 36a9282e50e 87af73fcba07be6c95176 3007aa0b8fc *image268 3b1d631ec47f5f9d e146c0d424b8213 d *image268 5e2f38be33d9780b0f 88917359e51cfc 427d5712fb509ed6befc8 99616bfe47f 6b87dca52993894514a7 299329298874 *image269 047a61789126112 b2f711ec8085fc16 a *image269 ab88c6c580791c897a ad1923ae060336 483ace0be5c1d4f91f7c7a 4f497fbf69 97c73b94957d4789b5a1 777b1b357761 *image27 38b415292da1baa 5ede77784afa764d 4 *image27 13aeab268688a8f895 c1ff899b0238cd f371305545766405abe9a 14f96dabcf1 0ec7892ab148606e2e034 6f7c9de8e7a *image270 0f6efc904105b4b6 2f6389a4d09e2c3 3 *image270 fe30ab641a9a0fedc2 936b2c1a46e53b 1b929191438560b601c0 78c617e1bd5c bc18a6896fda8d18fefb6f 76aba64e55 *image271 e94435748e29ee8 74106eb9eb42890 85 *image271 9cfb538b2ff7174e4d 1e2ded63a6b8e1 78881e62b0e07a7ebaf38 fe6bf0ea375 e4de5106db11fc547faaf2 eb8ef8f421 *image272 cb94194bc571577 336c92629748fa7 1d *image272 eae61b86460f8398ad eef795783aa1fd 6835a573217e617dd613 2f1668c27357 531f63b3b32fbbbce995b 175e5a9d55d *image273 3f417cc08e30e799 df0a32b9d3a96aa1 *image273 f874dc954e3581009c 1bc8b0107ee87f e97d61874ca20e8f8e0a0 0e1d61c6be5 8177e5bce64773c6a6600 82ac19474b6 *image274 99c6a63b5106807 82a65c5699ffcb52 c *image274 a511b390d50155baa b7196c3c738dd1c fc457f3a30fa57c71b28e9 a0d9a5dc14 17038bf8ea8cdf09a7a96 e5b3164fd3f *image275 47eab3fea9ef2778 6a6f82635c263c8e *image275 de5bfbc21ed2c62323 a84fd9b8795d86 658d27dbaeb62f052b013 f0470298ba6 a926ca3f52bb90dcc8f7a 10211db4b95 *image276 d225147c9d1b1bf b45cf7f98ab5675f 1 *image276 e27b0ff56ac1bee1fe7 c56ac618e94b0 3df02373152a6a502edde c839f713364 004b69230c3e3f090ccdf c2fe32ed6ab *image277 08e6def89e7989c0 ce8bcdecbd4ff2d4 *image277 1eb3ab418b76e23c1 4b9381856879c7b e10551ac6563cdda659fc 6df9d738ca4 af9a326e09c113ae0b46d 41bf2e5d3f6 *image278 32a68aad0087312 d8a4f5d3c373f597 3 *image278 7a610096d917a0f82f 0a0393b17f8b21 744b4d2067d45407bdf1a 5ac81a7c63d 3ad2ac994c14736d123cf 2627d60321c *image279 e715b35c1caa1b5 a9d363bbc1e0bce a1 *image279 1d8b8e3fdfcdf51f822 c097cf48dc19d 0c3124fdf20c8611d6800 60940d6906b 4c179ffe42d3cef93416b d189838fc25 *image28 e9fda437b8a5cba0 f00b69481a28e38 b *image28 5654afe11768190dcc b8348ab13299c6 97ce06a31502591220df8 4254ac54694 352fd6632794c0a4abf65 b1d506649f8 *image280 d5ca85fcaed95a79 8db448703bd168f 8 *image280 5eafed06d559159839 09bd5000cecbd2 aee1b586f969ce8ba6e7ff eaf93d37ce bea020277e49a0cc7894d 7c96b2c79a6 *image281 3d070808a390200 81110aa934e0238 dc *image281 816ea4a241f15dfa88 0bddeb958fd86c b2987152d8b2b325080e e05d2bc21b11 a540ece665332020cdf8e 7672574b42f *image282 d674364171aae4d d3f796b598f0536 16 *image282 ae5da69836d8ebbd6 df9981512d3868b 8442ed6c2c4b55c31aa81 9849dabc20b 56ebb1c043f2666285586 842c8ed9aa8 *image283 d63287d24e7a915 87411640b238f90 3d *image283 14f376cb2fb20f7fdbe 41109d9d7f4e4 8359568115350d9bbf4a9 5a0bf40d1c2 592808d5cec7fa5e18e02 5adb4e3746a *image284 87cfcd51fe11355c f56d29677d56814 f *image284 cee700ddfa6498fcd2 db0aec2e4cf095 f05de0edaa9cb41abb9d8 9cee8413df4 dcc147f7d32aa68aa46da 8c39ae1ff9d *image285 5713f82c23cfa216 3a7fa0a27b54f821 *image285 7ac4f86cf640d8ecc7 4bc3a6a761fd84 a1cc09078db9fd3aaba90 5b187e3aa4c 2ea3b09496c0317b876c 16882e591620 *image286 a8559ff1db03b716 9aca73fcf2b2a29f *image286 5e57528c9c7e6040b b90e5e42e82ea0a a42535bee5d6d48a6af62 0e8b9c594e4 aeff7ad7e912e322fa1415 de3cefe283 *image287 2b5b20e87e03799 c1607af8a2154a32 3 *image287 f26a09091c9f7c5992 238003e4366ca7 99b56fdb92851d3e360be fabb95d704c 1102143ea3cdfa6e320f1 d4cf71c17ee *image288 ec5065b786f2ae06 b8364b45b165b4a 3 *image288 f1ec2b40296dc3b9a4 8db6d03842c203 03b80beeb5e47dbf00556 67278b4317d a2f05707cde8b238aa565 154007eace7 *image289 8d33c9becf2a4bc0 be4f72f6d6e8d050 *image289 c320fe6bffdbdbad83 eca732bf2fd70e 3744e4f04d81f1786ae9e a2cef2478c5 7b1a2dd4a101d7fe3628b 22e2647915a *image29 615c46989debcc6f cfa36bef2462f1bb *image29 4cb37c2bedaa1aa623 7cc62b703306cb 47797309981631b8154c 8cefe5212f51 a4cabdecd14bf9385dac5 9adf2169e18 *image290 1814d61054c1fe6 bfbaee80218388ec 4 *image290 ddf9221d70b30a2d3e 943196e194082b b66c5433cbb0ba71fb356 fd926dea900 52ff0ba5fb3b058b5c78fa f2a5a467be *image291 d25516608bfd4dc d43557e4fdb908a 80 *image291 e3a1330bebf003d3eb ebd8b7118c9fa3 a57f7f5297812296c6c2d 0d3191896cf 70e4a7054de435dce2700 ef9f459d67f *image292 7b7475b82a8bd83 a598c07aee7d8a2c 7 *image292 64327b1d382eb76f6e adfe6d9fe773b5 112a15de85e253efcee2f3 c4edc542e0 111478619d7131d73cea c815518375ac *image293 42ed1a4fac949346 9b4c15afca3ce6e6 *image293 185859cb4bdebf7ab3 9951ddb9fd6830 97e401ad6afadbf634fa54 0cfb8138a9 680b89aaf0fe977649c47 05bdf1f0729 *image294 780bab1f173fc83a 6f8551bee2bc403e *image294 c7e7ddfe29b99506c5 64544133124238 920f1695da3edbcbcc45b 45dcf2a3fb1 40a5738798eaf70a59ff5 9bd0c20a54e *image295 13df3448e4f18f24 fc7a07a46988f0fe *image295 501de8c5455c1e1e4d 376902f4c64643 be0614dad4eceaeab4c49 974bbb4763f 9e649d15e65ec96307dcb e22c1913f01 *image296 332e8144c57d327 f2200cca960b7fda 4 *image296 4243fcaeb2e6148e68 313bc6ab9a46c7 98369e8ff3d794d579b22 c74d76a3dfe d8aeac48f05316c170a24 66eb4b3f74d *image297 d214cbb4a1ccf4a5 05a2869ff2d5c5fe *image297 acecb1a4298491fb40 15f6b42390975c decfc85571391b7c2cac8 b3b6c5e1523 c12faa3cfa0359ad23da8 2cfea38f9cd *image298 2d95a3ae35de972 982d4bd5fc04888 a6 *image298 0f485bead32a83c2b0 74da26feef0e12 2a59b4f92172a312dd1c4 233ecfb276b ef773c9feeca3240097a4a b56eb985a5 *image299 9190a4735046553 9b85530991e880d 97 *image299 b5850c491b00046ee 7f2490e18ee7134 9ccc0428dedb3baa0c0a4 ca3bf1f61cd e03ef55f6b1d9acd11502 52d18bed2b5 *image3 98c78623c2e335a 4820c3f50c5cbe3e 0 *image3 9b5a29ff9bafdb95b8 a82626837be144 677246b55ab461dcb15b 8c42b7100f53 b74878e6fde5895d698f2 50ab073c38d 170 *image30 23c75548aa5148b 8a1acd8d07ddd18 c0 *image30 b28c0a5d115d52a19 b0fda15b31609cc 03720dcfeb3af73a33a68 d1ad8ba54de 2b9273eacdab576ce4305 37ee95de831 *image300 13f30871f5520f2e 5c0aff1d7150e79e *image300 1deba1ec4eb115be32 c42dc3d72bd02c 260b5c347b4c367a1ffe5 08cda3bb2db 924b8b29437ce90fcf3a0 1c1d744ecfa *image301 8f9ba7b492ee5e30 60a714feb6fc7b6e *image301 d9aed589b48a2756d b52cbbe4cd6eb07 2c90d87a4335133289d8 45266f977f22 b0775d019ccf1ef9feb70 2ba197d33ce *image302 021d564d5fbf44ee 5d699f122b54aee 3 *image302 f30b6a2cf8c3d915cfe 3eff8b758d564 f1579aeebc6037e52fda2c 245d5dec3f 89a8352e56d0668aaff12 d6cdb2c50bb *image303 24f420e72c6f5916 3a040565be484cc 6 *image303 c5cd78bfc2b45b4b35 88b7f1e5ba10a6 9cbbef9f28dd62dab56d6 985fa3aeb8d b05bb1b6f5654ec006af3 6e21b2198b9 *image304 b93df9f3072ace4f bac84f8224dfd53a *image304 6f205d0f6cca3ff883d 6902ffb51131c d2d06e610c15f5e7dff24 1a58f4b6999 daff94f08ec638293cb0e5 5f04b5c953 *image305 446f7b3dc96cfe0b ed514ffeadf87c8f *image305 5472dd7a915d85621 32f47722e3c7100 72c44cd842e540a6867c7 0ede638cd36 5ed3cfcd4c223889666d1 0fd148955e2 Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image306 3e81310686aab69 3964cb041550a9a 4d *image306 4d5a6333fb6111b2de b70c6581d83a93 d2ce5460378c57d533e95 e3614f1d4df 1ea4aa863a4e1eead97e0 b2de7b38750 *image307 8ed1ae1 92 b4f5 dfe9fe94530d6cbe 6 *image307 5c85b22ff71dafc0b5 33b8d0b6084c0a fbee50e7519200b4b7fe9 0005a464c8d 79ca08d3d7e55fa0e7de3 5f4b8a7011f *image308 41b043399c82d4a a8fc30ad54bf464b 8 *image308 8f27ecb8a85d9b2532 65aff9955b0e42 70e07cc92ef60eb527738 34764182a29 c19e7d094b7e0ddd860ce 40956be4d12 *image309 556cf2c2e14691f3 91dc0071c98e0eb 5 *image309 d46d9acc3f1ebbcb72 cfbe25e53cf357 78a026fc9198c8b0ffd46f 00a681842f 527be517d68b41202bac 218fc2663487 *image31 b12f4c03922ac8c2 923b9438a361a92 3 *image31 081e53efa2cd902647 160ca5e682c7e5 97afa0f16e058c72cf29f8 5ab5cb34a0 a859e190b34f5b3c43d31 13364f4ddcf *image310 34d7e9c02885591 002e7218cb75e91 a6 *image310 c79140ab46c6e7f0fc 85b23c0955fff1 9f6f91303e1dd21a5e137 3147e6b8f16 6444ef053206653087f43 9afb01d69d3 *image311 0cdc1f17cc024bdd fa7c08352d088da 8 *image311 748eb9c306ccef8dfb ae9ca47ad48a87 f7e6efdd9f5bdda6fd8239 1b2db5b8e3 e27ee498bbe9fcb24cee4 d435b866d9e *image312 c33c517bdfc0c0fe d1781cd1f0cc6c30 *image312 023095522a3e03cf2d 41b24dcb100196 e40e9039b443ccd7f0387 1d415778cfd 80187b3e29f36e8c7736c 05c5ed272f3 *image313 e27d1e9c10c781d 1b1dac4ab8f4131 d6 *image313 eb0838ca0fc1a9a134 f060c010abcc7b f976fe09a32f7398af0e92 2ebc15b411 79ac2d8fbe30ed8c58a24 639b7a08836 *image314 18d5c4df76ece5c3 b0221dcd5be2f16f *image314 01183ac1e1de45c76b 0637f4a049db19 7795699136548cd9b1fb6 fd233793f82 dfaa831f70ba83564301c e5f02e69d37 *image315 facc8fe742e79975 275f4df36fca0666 *image315 b70d4215e3cc33588 95c7ee7c0351042 555c389b946b7c555a38 2210fc254b4d 205b68e9fcce82c828f7d dee07580306 *image316 06f5f24d847a82f4 a115343191458a4 4 *image316 31c838fec2710360cd 9a32954665c44e 391d45268d62529ada48 7cc8785546ed bce2d7bc50ed897e25b42 7dafdb8bf59 *image317 fe1053954c8eb23 4529d71eeaf250fd e *image317 c7154003a6f91d8f95 92b8c4586ba63b dec5ee42699d67373239e 27923064fe8 8580d7eee05e179e34a7d 9f73dbdf197 *image318 136629c368c4006 1d92c62294584ce 0f *image318 870b8faabe99828421 c9c3dfe989c36e bbc0acc13ac03d81c5ef2 38816033ef0 47d223527931add5798d edb4cdbab2e7 *image319 9ecccfc4a7fbf9c43 3efa11d4d7fc982 *image319 a1bcfc732797863fce bd54ab3b8e4a15 52558c24769a06e7f6db7 4d2d3a899bc 57b592ad090a0e31cb25f 3ac0d2c942f *image32 a5d654cb557ef29c 8ea2c9bfd757f61b *image32 b0a60b7b3b0b5b256 4d97f9eebbd2c99 3ec96a01b975d0be081aa 292ca86897e 3fe819e5205db64d707a9 c7208575384 *image320 ae20687f0c4d070a 6a04201ba309c3c 5 *image320 40070214cfe17a5318 14491d14011b4f d650b208366f005e8a5e4 7c6c378be93 b699b89eca1ee55b99ced 659c0c8fd83 *image321 8991653df1c6380 9a308fca0fe61c15 e *image321 00737f3e44109fb73e 514e5bc4202963 c52cd5cbbcaa103468111 febd5bc9de2 c7ec80115f5dc3f38c2e1 843700dfbef *image322 94efbd221ca9d85 bd3f6214c9770fe2 d *image322 0fcf54f77240a05811 5b33769202929a 086549e31c2ce4c463567 09c96ca48c7 7150494184e49dc18f401 7568902831f *image323 8ff32f44d2d6c292 554c6b2bfa5b86c 5 *image323 6d16852debb81ad84 cf38ac3daf3c1ed 307471890d692a3d0f6fb 3909f1001ef 13727ca37fe5b26fe9602 0b5dbc55dc6 *image324 21fa927c75fe6db5 11b0eaadf800a324 *image324 ab61ca312ca61ca9da 0fa3a2c01a1fee 70711ece97b4a9a5be2d6 417c8b62485 469260a1ebb5f87583457 28daae08cbf *image325 727305361c3dcb9 dabfb42868dd275 ec *image325 5ba2c2eaa61bbfed5c 8c197279ad2e69 e9f4a49f979c9ad9d8751 40cc82f1526 54e190b1d77409cc819c b926562a08df *image326 9a28da94941e13c a574eb4b210b902 ed *image326 98ea9bd8094b4cfe35 1b10be454c338f 88b56fe6ce716eceaad26 714260f9b0a eb5822cce126f86331346 13acf1493db *image327 5381e5c3b1d2e9f 57a30fd052d24a9 d1 *image327 a0ffc6fcaeb6f5b4054 b1b1f61a92470 eadf51c4c6ab3b4feca906 c8515e6d03 b577877c4d39ae3b1aac4 ce091a07aa9 *image328 3af2ef2f64e17043 234c91f6ad0e99f0 *image328 74f6595929167fb8ad 597ac77d023f3b 8c1691051405ece5398db c7a294f29d8 137d30ff98872514b0cfc 2936703f94f *image329 5fb0b65dca40823 6af435a677fa8399 1 *image329 d5cb9ecfc8528a8d21 accb96a94d38c8 cf9dc73e8a7c4c3fb645f2 0ee236539c a3063634d91f5c0de529c 68690c7e059 *image33 2fb3739a0e13408 c0d208e29bd2c57 fd *image33 9dec369e41d8c1edf1 bee7b4547b5cfc d9afb322f9057fc07eae43 65a4eaa04c 40c4ab91a2b9839a6d62 24aedb885aa6 *image330 883561bdfa7b7aec 4f0867e346a8daf3 *image330 3bbb171520f2d437d b7d9701a0f8bbda f658080155032f9f7a1ca 63f00aca751 49b6e4c67a5ed82813c50 ef8da015c96 *image331 47e8e4459f54aff0 2587c12c74e57d5 a *image331 67e0f34dcfa2c7a177 e87fc70e4f2f3c 37409298220390da7541 d42d5420b60d 298df7e2ac5d8e72c12d9 d7c12bf2bf0 *image332 32efe890b9e0c975 aa9ec50dd3a90dd a *image332 6c0158c00cd0e6a490 ff511e4d70f5b3 bc43d373c5d9224383f3b 48554aba870 ef0fdceccff69234608920 baaebc9794 *image333 ded9bca1696c3bb eeac6fe459539897 8 *image333 9a0fcd437e99b08493 1514aa76d81903 2521630c0663f1de710e9 6d6fe800290 e451eec07efbcf254b2f3a 71ea90e81d *image334 1ec91dc27377936 a8a9a6bca5831c1e 8 *image334 17276af532cafa1538 a38774c1229e2b d039922e21509ff9ec823 1286878e7cb ab52d8dcff89dfa4598de 2fa694f6766 *image335 767b4e9f2177114 b5945c8f304324cf a *image335 2b02798513d04c23b fe783afcf24842d ea8f8009b2bfe916b01ae ebbfcf295ad f7582dacd1f1dfe871da6 b3a8199e8a8 *image336 2aa5d875816731f 57a9789bc5ff9fd4 d *image336 dc0c04cf07a99fcf1d7 ecee672a24a9e 72809f4d8ebd5dc560c6f dc91a4761b9 dca322e6839bdb9be037c eb507309b84 *image337 60bab6efc42cf2d0 84e4d67e39e5d0f 9 *image337 6e22ddaf34b59049d3 79c3aafed229b0 326ba302139665a1b0d6 4676744f5d64 cfa503c8bc9423043f39d db8c3511194 *image338 af376d6068be0ee5 db7f3a0a48ea952e *image338 1353f878ee574f2fe2 5a49e4b7bc7b63 0e84968f8316066f30d2e d01db3c6739 2b211b32a360c87ce632 0e6697244870 *image339 b35de4a2b49cb9f 42efdd4165b78a3 cc *image339 816b9adb5469ecfa08 e762975b816141 a8e558e75ba2070ee74e1 a9803559c3e bd6e3208fe509f8cb8714 fb3bcbc5857 *image34 8e0b0bac341f130 00dbce046f26b93 72 *image34 da4f3d466e003ab571 0b4e8974c57ef0 652b1e412d38045254e6 50472e5c7ce8 014e65bba4bd7e88907d 9e434292e2ce *image340 b6e3f1b9dc25238 52aed3811627ffb0 9 *image340 dac8456ceaab3300b2 7274a466277d31 0ef105c22fba665fda46c0 07b0959c77 13f774f76290d1e9b5064 657239a51df *image341 417e5c1cb949020 c8cb510f5bb5a41 64 *image341 049c5ddfefb5e97dc3 23a14cf692860a 8afb6bb2a71265bce2e73 e8ae62fd09f db39b1dbe73aa835ecd7e f04f4c4d13e *image342 553092e1a1f606ca 6b8cc7e9849f9a0c *image342 1432832a038c500d7 471ed4b71439776 94ee9e0ba801d1ce5521b 7bfa54fe3a2 ac58c113be0daaec60dd6 931fa00fadc *image343 01e1fab87a846d8 5b5e7e62487b0d1 22 *image343 62757077ce323c16a d1d9fd26ef5dc06 92c3ddcfea58d8729688e d94412f0369 b7b50cbfeab983252c271 76ecc0b3c0b *image344 43db0c76a6f4fbe0 a92f88fcffc42b5a *image344 f151ff560dd7bd9a68 97e176b1dabbcc f710d6279488ee27ba088 02d73f95eb1 25f5452ce0e46c7f0dfa1d 4432e4256d *image345 881873b6ec7a985 2e7a05ba4243d01 f1 *image345 7257cd07de81b3842f bd1a9c41ff1d7c b2e00ee48ff0a67cd259e 6c4678737dd ffcce629a1e32d9811a25 6e0014c50d9 *image346 1825ec2eb20012c 86682c020268fbcf d *image346 ad86740bd33cd2d26 66b20b2f2f71f8f 47d6331908a34e978961 5641a2a7b463 a8fd070506ff8b0b886a2 e51402685ab *image347 991f677854d937c bac708cdb86e085 d7 *image347 a7fa39d248c15a6a1b 0811620b85f136 cb937accc93ad25cdb2c7 e960ebe7cf8 fd77d8019066dd8ed746 5f9fe07366b9 *image348 9b5fc8535f1ecba7 954a234de6e901c 2 *image348 0a0c195d858436c8c 4dd3e0e33402552 8d71ce3d64b24b705090 c9f730ee46a9 cc81063980a34b54969a 7e548350b4d1 *image349 1afd594e9646cebb 7ce6487b7e85849 1 *image349 2b6a882bcb655c6d0 9c94333e12ab3b3 af3659ba312eb28e79a9f acd55bd8a89 9ab0e8ee427118ff0748f 59c80de3358 *image35 27a0cd60c2fd728 956dcf55ee57511c 6 *image35 d35222396a5d711e6 e98dffab95f3544 abb342dd059e99060766 419729b9e2fd a8e1ccbb6642f00a9d183 0528aac4749 *image350 96c54a6ee370688 68c10366bd9d627 60 *image350 b6ab938a13fb2fc704 a7c8179c040fe4 56c42763069bc904d2e8 7e4e5e141cf3 df8818733b00315483dd 166092a4c8e9 *image351 83fdfa01f81eb206 556269740829707 6 *image351 c0b701a703c653ceb1 f43a20c76ab823 6b0db7eb05b353f42256c e5694e1e0c0 adc0755f005e213671c88 bd1610f4422 171 *image352 25dd005c8b635c1 ca7a684cdb5c8ce1 b *image352 2f40e0f8ba7b9bf02f7 63e97a0d1b32e cdef84f27f4a9121dcd523 37f4316105 4aa23688865a0fe79086a 5e62a028a20 *image353 ae66cf4f2e004e2d 52e48006b1d692e 0 *image353 ae33988b9f826710d0 9740889176e4ae 660d657d2ef98645f5fed 670ed4113e2 d19e7fa0b54ad0bf7b47c 5851e92e5a6 *image354 af61f1f82b117415 0af5143a4c12dd8e *image354 5b67b754bd71778ab 206e05fd0b2e919 c491bee36b55645e3d263 2e0b4604528 e162c290966e03e3c8dc9 34c6dae72e0 *image355 9298603a10661ed d07125a5326d007 df *image355 56b95204df5e4f5a20 abf6f74b402c43 ef67f6c1660fbebb54352f 5d16ebbaf4 0a5e72f4a338ef7ece974 3bd3d0017fa *image356 89717540984c68a bdc23c331d443d5 b8 *image356 7d4204109096b2c32 975aace6e14a7fc 4d2ff06f9ed933c8a6ee09 b411bcacb9 b1c1325b5eb9d4dd29b0 e25e1fd59ae4 *image357 22e04e6566e0dac 150bb93d02d3927 9e *image357 72a0f3324780c9dd74 5796d39642aab6 537db16a0de83c2249e9f eaec0fb3007 9ed8e2e0516ccd77055b6 ccd2da8f2d2 *image358 a5cb65b8b0a102a 18a9821ae45f4a68 8 *image358 f0fc94c02e39172675 4884cd1bbb04ec 3aa19851f7a79ccd5d478 c91036ed9e9 64686b5bcf271f40d5a0d 9d2f2d2ef31 Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image359 e6f56d70640eb0d 7942728959dda3e 6d *image359 13a2870ab9b8c573f9 6a8111c526117c 42fe0ba372261947e1a00 a80b9e88794 31ae6ca706200aa8f003d 5c3cdddca35 *image36 ac 51 3b8cd7887 e94b185e983e371 4c *image36 421d30ea43 4fb239 302d1024b39be2 c 244536f11fad91b6ca0 09ac48d3ca6 3a5731c1780e5119580c 3f69ae0453c1 *image360 213db5d688d8c51 0480ca39494a396 86 *image360 79846146c92146834 5ed848e322e531d 0ba78377d7dfb6106760f 564d2880ac1 28e4e94e0b3ff310e1f89e b45eb8473f *image361 8961076a86fd22c 286102d2c09a660 b8 *image361 f0d6bb30ff0eda7c2d ccc365861dc64a c00330f317a62a408afff8 fc6804d899 2105bb36ecce368ecb47d 47aa62b4caf *image362 7cda57418398b1b 4a62b683b858529 15 *image362 0f34ce870464db496e e572451b6f3ce2 3cb116e8697bd5b61d16 e0cffa684257 4ab0d22196bca7a439d3f 5b9a7b71f44 *image363 4438e9bc4b12266 93c6fa15bc31181a 1 *image363 988466cfb38551d2b 56f58bde2854ac3 04395d4a3ef5dc1ac14cf 54f749a9c86 657f67bbf86482a51d002 fc2aba47a93 *image364 07d611ba6adaadf2 6c947fe14dd04de 7 *image364 bf36a81e262ec4b181 7f75a636b3833e 1e772b08f5798bf26f1b2 ac43dc2e3b9 69e73686a6e92c7b88eae 3802caf2659 *image365 028f6060fa7a51e5 1381ec3616a9938 6 *image365 ed4f2d10bc4eec3de3 1a55101696d3f7 1dd365503c0d0f6c2a9aa ac2813d50ca 2d7dd8067ea1092972c1 b9f7b1e0e79e *image366 7b699acafa7ad042 ee12241827d9ceaf *image366 4677cf566d0f052e04 32b2247ea3bc81 2aa7cd5fec6eff998baaae 7156467396 2034f64e473a4082cfda5 8f124b18199 *image367 63be8bd4e2c6555 736f2eaeb5c47d56 1 *image367 29bfca6585153e4e87 41644db88c50aa f6903c007bec03b1f1ace 162d9d8f350 bd0094c34e5152f178635 411a6b16fd5 *image368 8eb8adfbeca12821 53a6ee2e9e5b8c6 7 *image368 ac0483e680b45776c 20c5e876445edd9 3a3aa7368d00d365a34a8 3fbc8284763 a74d75435f74cb5fa318f 9585899ab94 *image369 c5e823376e214ba a219d0240adcf18 1b *image369 d4695269ba871876b 13c4a823157d127 1f9e5aa589ed621a01b22 0c444b9d981 04ff630e1f67bc49d0479 bec3c2d1fbb *image37 19122a16fb1748b 9ef397bef235fe31 a *image37 5362524f4caae6ca96 3142554ba2b18d 73448a879be479db5e0df 8242d510d30 41d316b3a48e96573835 b2b0c12372c1 *image370 d4cb3204c14bea3 03058c7ec287a7fa 5 *image370 c5b1ce3a86c170f9b8 f31d74e620ad0e edec4092238b2c4252545 f8451800cdf f7a003a877fbdf7072b11 a81804bb258 *image371 e60c8991e90326b 9c366cd74a3e9fde 2 *image371 02d577494b907a0acf 00ed72a94c3c74 87886ae77218a726fabbd 5ddf74179e6 c8de0d74675cee93f3b4b 4e2f953fda5 *image372 68057d713145534 fadaa7e918e9ddb4 a *image372 43941150ede89561e 7ff33ad715f6ba6 fffc17c5c2d23c050b7c47 71b7a1c22c 84b6d4c4f217273da2230 18165d11f8c *image373 337492275495a6d 05676df3c3b485c 53 *image373 5c5fb0dd57eff19048 393089aaa28069 9b8ec103839645f4dfbf4 812d313122c f946531538f827523c3ea d9030b47954 *image374 9baa6b2c69b1a13 4c89cd6381cbc2b 2f *image374 5d9c5b677fbf5ef1dd a01580854a69f5 651d7f1f59e883a0272e8 f2f1842b3a4 0af2cf99572a0e656b0bf 70dac3ef0ff *image375 dcd57e69bfd92b8 5cc2799a6c3d832 30 *image375 e99a4a691e2864540 badc14e63dfcbf6 7fd2bd9ea9505eaa2ca67 228c3768fd5 f9ad9ccb55d934b66c5ec a99376f2a62 *image376 092353b25380ac4 65395f137b3d561 48 *image376 28ba3ada1a700e469a 31c691c36b8a0c 47d1d17e70d9f4168ad30 64d569e7d9f 529659227fc407f767ac9 52b2475ce2e *image377 3c288992f967109 37a042a5e8d677f 9c *image377 91455d874cf3ea8494 3bc7a775bb0a8f 07b72ddcca72835b0468 69b82f2167cd 2b88a39bc0ef2371d66b8 b2f953d9642 *image378 ab3435fbb7adcf5a 223686bda63e828 0 *image378 085e230905f271e161 f5b5131bb977f3 501b81f68520065deadf2 ee22d3101e2 7ed8bd4c5b2952237226 81887a96e0d3 *image379 3050ad8b3f284eb 1b0e29dd1ea0ff6d 9 *image379 72892f950c9cbded64 7c7e0c444ec4f8 ea70f426708354fd2e29d 31d8ae5dce6 eac86789e06fe1b984c25 29a72617cac *image38 9cf0c8ae97233758 447161e7c8d57bb 4 *image38 19c9d0a8d60b1ce34 d4851086dda3398 be310e09cfdd749fd1ff63 703d81740c 08d21cb272589c6a9c4f9 a6ef85434ae *image380 39c4a6745f0e173 54d4c546d58e1cef e *image380 ce4a1d01f343b5a64c 67550c93adcf0c 0aa861ed96f3f3e53dab8 575d64598f0 8713f1794b101c5bfe088 359ef5f17b3 *image381 fd28b087747d962 652b3faaa8555dcc 0 *image381 992e5d45df954b2fb2 0e3422f3146ce3 9ccc2434ba4f488420955 2b2c2449fb1 8eecc8f3b43544144eb9d 897ddc3aa30 *image382 df59d9143e254aa 983e7f5ff66da3cc 2 *image382 05e9b76ca1e396cf2a 27319ecdf27f1c 022caafaf2129651babf26 24fabdd9ad 0657c00fc8a9beb973676 bb22ad0c61b *image383 4b02fb4eddc4ab3f 4dab57e2187765c 1 *image383 3845fb486ffb88a6d0 3c1a643dae08a3 e80f4926175082d3bd52d 253fc348472 f0d4add8fe552dd0fbf045 f5c975942a *image384 7571bd123a3e883 46c11061780a0f8 0f *image384 0469f9b82a59d1f275 47041968caeaf3 b6cb5b1fcad67704ed50e be6578acded a330e350f92bf0066c96e 049feea5775 *image385 24f28383d913cbe 7acb1202b8e9e17 4a *image385 f80173eb81204ae021 234a41ded716fe 7155b4168d1d41c50fb16 bbc2d11b141 dd645e4477f8ed1d8fac2 059c7cc7ab8 *image386 44cb078999c11be fdae27599ec937af b *image386 6e35b7e80fadf57f22 0bd10f55ea62fa 59b12a9209bd49424644 d287a3c24879 e141dc8fedeed0c6c54c8 be25c6fa9ae *image387 d1438afd5d92864 8407c0fab9feecd2 a *image387 46fa0e0d850841c75e b3300b0bb7c1d9 a2d5f794b75e03e597ce4 134b1e71a45 8e4ed36ad4fdd682b20ce 8173dbc67a7 *image388 4655bfb489031eb 8f65a3385d45249 8e *image388 ff98dab7a5acf536ee1 b8f9fa380385e 7186751d316ab9d7cd4ea da319b88500 2fc1c501b0e93154de695 84bb4cacbcb *image389 e714dde374874cb 31cf54f45d4219be f *image389 38f3b8111cb8173c10 dc8f31e6103ac1 a437e23262d582293239 12a0804335b8 1687afd3d7650b7ad7b90 08f0adce42d *image39 a4145d1e66aea8b 47cad6b106742db 3e *image39 30eb430e008b36347 6c9cb80a27bd9c5 b31b8a1b045f28b1d518a 4037a53ab5a 347c54462745a2909400 90a03fe98ec4 *image390 19b9a619c22681e 66ab85eb4acf1ac3 4 *image390 a64db2d2f19b1d62de 80200e6902cb39 5cd53820c094fea080174 4bcb5f55caf 785025a2b13b3219b18c 2137cc9e425a *image391 a4145d0c1f0a19fc ec7365beb55bcb8 9 *image391 357e885398e5bbb0c 01a72f462b6d1f9 6db948581c1de5bff6629 dd1530b7f96 6bbe2781f3cbc9849e055 5c2074be54c *image392 c9295ab7b6c034f 46e7b179f6ee32b 43 *image392 2fe0ed3add127e207e b148ed1ec3c3c5 ef5926790f559434543cb b72961f09f9 4b6c6564234428a53348 a1df9258beab *image393 2957232991ede25 d86e9ca7d83ee5ae c *image393 7c8468a382b6dff053 6197e1630a919d ca0619f5cb14f7da6e689 20c74e32c73 08b47f117f8f338bb9a87 e4092497332 *image394 cfd6bb884516688 53a8e52bdca73e2 c7 *image394 c1fcd8b4db12a25bf5 f9e45aa77a4426 17dd318d5018d73e2669f ba18a0a179d cf5b78e3fd8aa704f341a3 3dad7749d3 *image395 f64a73a77d1863d 2785ac69f5b41c3 8c *image395 79520efe9c6c8d4b87 02e666507b58d0 0d74764eebaef6ecd8c8c 0c1430a3614 952f95f746e8c590b51e1 d25fa454ebe *image396 ec74d3d03989672 1f29480388020cd 5e *image396 5d2f7f207190617785 d7c629656ad038 a44f0e8d7db2808c361ee 6472a199a6b 090711b104a5f8e393eab ba6bb31fb15 *image397 7952241f87917fb 75284fb121b0a0e cb *image397 2851131565b66738a 211af234df9c757 f0a8830f0b11f1c8c61b4 339773e393a 4d7a400d42f506f0f8ca0 e37d9853ab0 *image398 ce55becb04e1652 adc6ade21448e27 9e *image398 7317d1f81fb7e25261 018be3d0f062cc c41621b69ac16407ec034 f438600128b 5fb2e9b4aaec9de216caa 24a7118dd42 *image399 b169d750bc15274 500fb74f920156d 0d *image399 681473a6b1b1bc17d ac79ab265fbf6fb 428d8fa13e8c15c121f2b ddf37d9c418 15a3152df937ffaf3fa3b5 e6f8b92776 *image4 f8c0d4bc7208a97 52df160e1dd7873 71 *image4 25506f35a4ffbdbc07 be41745d330603 f3bf175fc3e4f33989a734 1f6dff2601 c6a1f9fff25ede427d2251 b9fe64350f *image40 926e1f0f451bb562 b38bb6e12510180 5 *image40 640c910e8d280556b aa3d1917cf131c7 41dffe3c65f470e5bc1101 e586bd3c2f 744dba6f1bad80363c5f5 0edbd78498a *image400 6dc48f2c35f92266 0be19e8b7cad675 8 *image400 d646c9b573bb368edf 98ffde79854824 91fa79699739d05874d60 909c741d49a 0e3f30e789c18683f1947 5e910eff427 *image401 e2b11c329f2e942 058419b54b3e5ad d2 *image401 97951083906d1d53e 90bcde0aeaa6b91 7cc3e2370241b3da68c91 cdab1e080d0 fade5129947b0fcfd8a1fc 4c8641ab6e *image402 7c35556bab1a376 cc7b748426c79d7 07 *image402 2a01e4152f84eed8e8 af6719d92005e6 a2a20e6f7e1e1e5c59f147 ba6976db21 04d4725781a16896d460 1b6ba5b285d1 *image403 26097651ef9fbdf1 ca3f40830cc7fb29 *image403 cbb05d9e8148db07ef 2eb223bc1ffd51 6269bb12ad755c5630b6f 479f8a719bd cf6ff68f18d5e387008b0c 80814e4309 172 *image404 9b4e135a8c68a0f6 b674dc856765c48 f *image404 f96253cc773e7531f2 fb42a46b47f51a f989b2bc5db183f3bd488 0943af8ffd9 9de032487651964fd2a64 6bc88cfdd49 *image405 c6d0b136a5b12ff9 80bc6cfebd17727 b *image405 5c87993d17e1c455e 3ce2f00b3045096 f54b34b4f52fec0ab08d2f dac4dbf639 886279c62e02baaf267af 52dacd69778 *image406 b20b7d81b5e8734 a653f6ae3f04e26a a *image406 bacbdb1a34ce1e89a7 f9864a30eb2ec1 989a216e416832d15091 c7c4a160afc0 b0c984e7d1bc8e0af9238 6e63df218bd *image407 9f54c65ca25fd379 4e96f0a3305fa388 *image407 4952d303ae05b9ff0a 774d7022c10884 8adb107a842c5ed001696 905d7809dc7 dfd42b84568d30c8b293 3c1ae2a62c96 *image408 8b3063a572a08ea d20a77e4cad3878 de *image408 115f65836c8931a802 433bc2b01d7187 e5641ec4bcbf2277f4a31 a5557174777 0c8107252bcaf47180477 bcbd7ba986d *image409 08bebbe7edb5b25 0f20638a07d6e2e 2f *image409 0c07e169b903101f67 80ef6e20aa000a 36ab94608e0ea7ecbc669 2dca64ca77c e84d483749a0dfe387b06 af75f5421a5 *image41 dcf3929521ed0bfa a75395b5c16cf95 6 *image41 324366abad91badfa1 fdd0b869874db0 6ecb089618abe1d0bedc7 5ea8f19f64e e17519a80fe573685daa9 4a7b4ce3322 Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image410 de3577e569d027e d38d9b2d27d1d4a 3c *image410 f03c0045a773b87a74 a811a77d60114c baa6798bc71b06b451bc3 f36eefcf70f af5bcc939b4ecd2c353ad 3188b5fce3c *image411 5e635e6fa7 80b 200b5aaf4bbe68f9 c *image411 d994fe11b8a5db2d49 59164fc1a2d194 2eed9499fffe43250fc443 edef104e69 67dc87c7770bc498c7b7 d0976429858a *image412 15a22c7d76e9d87 4c4895d8d186247 f9 *image412 eff7d1a17278546ab9 c285d8bec0a1e7 74f04c48570a5e9bb8df1 27692595bed bd86efd0ae1124838df72 1ec61df2e48 *image413 fadd3fdceb9e3f69f 70cbf3a20695cb3 *image413 5ab01507692998d17 341e86d1b07843d c2caa46abd38c7d4d772c 32e587d72f9 22ce5eab3dac4bad01f5d 252ce86b4bc *image414 10f5ac29e0cd89a2 533fd55991335fba *image414 d44300e5bfa64adc9b 3728f35552220a dac7b3d21a15d7da8da15 0a5d154303e 207ae4eae6530d21591d1 5767bb1a9d3 *image415 463429ee243aeb8 5b4038a98d7ed8e e8 *image415 6422d3561cc550b9e 589c95eeda93046 6ee211bc677569611687a 300c68b2409 04ab44491fa6a9273715c c6cff3f38db *image416 267a1d1371b6985 c56a974b8e6f9b3f 8 *image416 42ff2a6b24c52007c7 e71216ebcb5d59 54b195cafa2b9cb6746dc acbe80c6a69 e9be04b331f2f7ccc2742 0dc72303a52 *image417 a03791b0406a2f7 c22429a12a67cd0 de *image417 08b50dbf70ef5620af 89b5dc365771bd 792655a614da2f67dd4c2 f5c8572e4c2 d0abaae8265c56c5bf70b 8ae039b1ac0 *image418 06a44622fbe8310 6dcc69fc197b36e5 f *image418 3d0eeefdab8c7efaafe ad47b719d3f55 729576f0c622168d8cda6 9b1a61b3526 7c772b624578899f4b38 5cadf6ec0ac4 *image419 435fb76e21b6126f 1d67172935c296b 4 *image419 357cc8a2824919f92d ea3f81a2c95bc2 eba58a885d7480afba4cc 25f6af1e9a9 077708cd7d4727273dc5 0b6fa9b53cdc *image42 4df5d6b9bbadbbf3 84f741d931a35c9 b *image42 a2d28596f3cd87479b 812b5942612594 ec935c16bef3b413967b7 b49a5d3a357 c11ac6a6dd3500dd6b37 0ed1ae0077f7 *image420 5ddae01eb605f58 5568ee6f98c104d 86 *image420 23cbf64ad017d2893d 2b333231433ddf 3db8b2af07f8e6cbaeb1ca 5d225f9e34 563b919c0f4754171122 214bfd1b69b5 *image421 824a7d12cc4e4fb3 87c9af537d174e8 d *image421 3f13af5974d3faf8630 f813446168158 383fa2be0d77a15f01843 91c21f4cbfb 30091b7cd3b5c7013aad 0923548c067e *image422 ba5b78b10213a84 38b4c3ec809c3c6 de *image422 5fb5e0606b7088fb8f f83860a3f2a706 63d454849f85c0bfa0e7fc 442ce74db2 fc8669baddf510d13a1e3 5371cfe5a40 *image423 b8a324d291be22a fd99197784e9589 29 *image423 c52c425c54cac024dc c3c220271055b8 62f47a1f80efa03ac31f7d 6aa6db7d6a c83b29f2998811f156c2e b4c57006d37 *image424 47b8ef927e8cc754 2f9066f5df355a75 *image424 6b1bbd8621c8542b5 edbf23e77152d3c 0d71f7781fa304ab264b2 483ee3ec6b1 8745ac4919f98f851c713 146db25284c *image425 43272035cae0a33 e63dbbd2a1ce907 93 *image425 2e52b585a96e11bc5f fe088f221f1b0a b4bc51f5e8e82174a8575 8a747c41464 2b2cce1f5128696e3be76 8b21496e909 *image426 6a2ac0655c763ae 3d26a78f166056b 9a *image426 6f55008f68e76cf40b 9a298fe5e2f7c9 6fc0f2d3bd000832400fe 85c4bb51161 c1eea09e3f76ac4acb3a8 1126bb087b6 *image427 6c53939f0bd2b6d dbddb3dc77fabb5 37 *image427 21fd0803158e01f029 6495defd2d2feb ca37c2ff46eca14378ffdc ef94bfe45b 8a89c2830486c072db8ae 80aba7052a5 *image428 2a3b1a7d3108151 9f8528f5234fa7e7 1 *image428 62d20304bcf25428f4 df20c3fe96cc24 45f41b8adb558b306b9ef 0bc72908d6c 8c97c656ed756d92afaa1 fdf4b9b0135 *image429 6baa203e0489fee0 68e78ee7f223d22 9 *image429 b17298625abe0c056f 2df43c23eea950 55179bdb69fb16630fa45 3200803e0ca ac2e34e8d8e241de96647 f06d0e29033 *image43 e901ef2e0888245 5f9f7ee4f9b12f4e 7 *image43 b18328d0a1c0fca3ce b44d0736b53084 e6af92608ad0c4042529e 84e488e39bd 7e4b8191d55b6999176a 0fd6c2d8dfe7 *image430 10d12220ad71b84 49fbb294bd38a8b 11 *image430 fedb44ce4c98ac26f9 618af3bb564cb1 79cd1d185f6976c4a4d75 ef0ec4f27c2 b3d787235a75fbc3df71f 2d0f8490873 *image431 456e2d1e398db87 a8f7e795a7e3094e 1 *image431 62e6d392863355323 302f38269cf15e2 ce753175debafc25130df ed64a05d29c 7924f07da24d09461020e 91120ed287c *image432 eafcb1a9d6d3143d f12c6feeb9489252 *image432 29bbf23c5d643ff864 3cc79be530a123 ff856d2fd96437d4c3599 1dc6bebbced cd59cbb8887387394da9f e1d829d27e8 *image433 d1901604d930aec 084fe557a883b75 b1 *image433 581985c253dc17b1b eb5621800d5acae 9691c9396ce46b03838b 4f4db82ee4a9 9ef059495e9a86520214c 62ec25f6db1 *image434 763e4c8ee866b6d ece3d1f2186a88bf 9 *image434 f8d772f763ff2a43ff4 ce716ad2260e6 8f7975c0b64ff75401625 5b961fa536d 94a3249413385ac61a1d 589169fb7b41 *image435 52d5e67ff7c19272 5990c265d1b03c7 1 *image435 6506a196610694fe35 1d8a981addb58b 7f8d5982955566b9fe527 3f09b016fb4 8fc390c93b4c476b4e445 54ec2c890cc *image436 cd87ee4ce14f7cd7 93337b7617189f8 9 *image436 f0a9003cba6cc12803 ab49700cfe5955 dc608f898febc73af2bf3c b920a93976 991e99e6d084e3ceafc9ef 7309c6e4e8 *image437 9154190d0336455 6a9fb94b0f297522 a *image437 820a8105a0ccbf7a26 0891e7f4769b26 44444d9c8b329566fd42b 04e7f9cb506 16a5f97b8bb9a812d0ba5 9b93899809f *image438 646378f0ac620c8 939bd68b720ca98 29 *image438 29192f94780a2c3e32 870f9312b51054 51f6a03a28bf50d2d3423 d6eb045f43c e8a6d5e1f8281fffaf4c83 06324ae629 *image439 dfc506b19c168e5 678cbd684b3da43 d0 *image439 39f137746668e19df3 9a0bf5a9430502 ee6c3f620937dc1fe81bfe 83b6e9a0bc b3d7fc8eeac3631f1c1c9a 2617cd53c4 *image44 84ed7f92aa65ae8f 23e0fd4bb0d60f1c *image44 7b7d02cc87b610519 b008edf871aee9c f1522e75381b7ffc373a2f 111b52ba7c bddc286b661c88b3252a 20c8a356d417 *image440 85d4741023d96d1 cf45ce91b337162 5d *image440 f868921e8aa3779708 fcdfd7a998aed6 cf7f50c33029e2f447f0a1 e3bfe7267b 36605f1176afd42c12666 1404b847e04 *image441 9208ea5c18b9bd5 87d1bc9c6ac68a6f c *image441 7dbf4390bfd4f2d420 fb4c21059fcd48 86c5a29aa1786a3c9842c 8d7df6b87e4 9e651ded87fafbb32c987 fec47e3a0b5 *image442 2fb89ed376f03ce9 ea6f1592fc5f9e9b *image442 6d0e9e7bc05d70fa44 ae03342b66b240 6e19384bb0ca2f3f59ba5 b673caee9e4 509619853719e197edb4f 6f1827ec686 *image443 dcb9e8e7072091f dd753c18bf78828 b3 *image443 503a1eb5f27c9d0631 6f6996b05ceebc 2435ba5ad89b960b0659 d508912523ce b1ffec54e11384bf6159d 1d562e357c4 *image444 0d7b0d102ea02d2 ff5419b4ef98c715 f *image444 1b3123ac069127211 35218d8ee476d61 d7ce4249cb3fbc5dda8a5 42435f617e1 288e5c70b928b0a45970 9649eaac90b1 *image445 d9bf0ff6fe2ec385 748a93003b1fa7d a *image445 d2d3b12b266880703 d17ba8bc721fc9e 3e3d3f913a22cc1d821cb d590b19f410 853666c5de1dcbb69f533 b605b60ec0d *image446 187beda7d708edf 2c5602617caa24e cd *image446 fba124c8fba534aaeb 7de278b08a35c1 eface66dc28be9305a731 0afadd3fb9e 840877a0fcdc54877d16b 43eee9f67d4 *image447 d6ab721c014c518 8a66027b1229788 aa *image447 2c2fbea6c012e28a48 c3dc4da63e9a37 78f7230cd233f94eed420 dc8af6378fa 63433f7a095317633976 dc0f1192dad0 *image448 62db226b03d5f9b fbc3f9993690cdd4 5 *image448 e2d31ff71dcb90ba66 767316c2401212 93809acab522d9e577235 dcd0cdaf527 85896c75ec84b6e8b371 846019e79e9e *image449 1a262f814351869 6d57808b56b25bd a2 *image449 ad60de0bb56163939 c6ee32ee63101af b62c6bc5180319b77d97 2ffab6edc50d ae174cf971ff56c4757cb0 206d09646c *image45 478a031eeb7c3cf4 de4002350096f24 4 *image45 64b80407eb8c67d4a 939f6050fb7a3c6 4171c4476773ec3b78e88 c40dbd530ee eec7ecc4c21ab883d5c57 f544549c44a *image450 772bad4dfc7ba42 d334218d322f4a0 2f *image450 04a6f15f0c3b83d853 84503452c2f48c 313a8f261fba959a6f06a6 ef39a59d6d 6bc5093ed188f60bfbcaf 01df99231ba *image451 85c34491ea7f532 599a02ba1cb2646 ae *image451 f56b13dcfb20513baa a08da49ffde6b5 0043c7928d447ed33b17 533c9f6b792f 52bfec2a529f0a9dae37df ea43093644 *image452 73ce59007a9c42d b4cafee5b8db20e2 3 *image452 305b4b8517d10dd23 6119eb7755f7a2d c4afabe4863cf5c0a0a0dc 21ae163c0e 27022fa1d2bf20751bfb9 58b8a98fee0 *image453 6e5d7ba2f0b1195 447a68cef590d29 5e *image453 13e1b90abe1c3411f4 9b6dcdadb917ad 8c3b97565a212c65fadc2 60b82f347a5 ac7512337c5997bab4dcc 23e3d7a49b7 *image454 8488b718e840c34 78914e2937229ab 9a *image454 7731adbeda2223507 0fc6b11420576ad 0d936589b12fe1a7e66ae 4dd6e65050d ae3c60d699a5ebd55bb28 5f8e668f999 *image455 0592492d4070ab8 528cd858fb26c8a 80 *image455 0c5137caaf451f0145 2951ca44d5d777 19708cb27422585e7b6d bfa08ecbc3ce e457b23f7ba0b1f3dfbcc d570d6a25fa *image456 330caeefb4c5af84 d5f051f7eb939f4f *image456 e9966ab45bcdc11aa7 d14d34c6098d15 770904e364bdb3c8133f9 93538e134fb 88b6ca267b1919e70319 448adac35575 173 *image457 72401ab28308f50 d39c223dcd0e3c7 b3 *image457 aa00c2c9eb13e52799 ee4422b5393490 7df76a9a245fad03df33a6 80096713ce c5942588a9df9a1151957 11ea30d7b52 *image458 9810b6c4fa0f57a4 947ae186f966359 2 *image458 0d8638c588dc74db8 7a1d9b0ce9c3285 b6c5d464e9e7e65a6cdd7 eaf136e22cb 99c6985aaadc4cdb1d9c5 13b5af659f7 *image459 d289181edf23657 32ab0a6b82942af 58 *image459 35d1774615b8bc686 b50407005b9027e 727deb060592ec3b5c8a5 c63e2b26441 af027d3ea8554aceeefc30 383d68aa3b *image46 b0ec86ee73028a0 19aee9c66d3ab47 4b *image46 50f62bee2adfc81b1f 82e347e79612d1 ef295f1bef2814b326c74c b669ca4358 063ba15259982fc87629a 9dfa293b111 *image460 a6219ed722ebcdd a9b5c632e854771 7c *image460 294c0d1a1af9ac433a 73d3a793ee62d0 d2de54c5971d14fce8fe4 7847aa34665 0bab9d93ffd50ee3eeab2 acca9ea536e *image461 c29c1657be184c8 3ec7377a74599bff 9 *image461 fa260321e20bf1ee07 1190dba0929df5 7d5fc7ae8293872e2bc26 3f55132e9c9 346ff7048ce9db7de4e1b 4d6e7235ada *image462 c9b37521ee713a7 c3c024eaebff3bfd a *image462 8e4ab521e6582d5f2c c06ce3442ea6d9 2b982d01ba337d2e6644 e1a88c63c30b cad8713d2ee34e455aaad 762928de34a Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image463 89312f1f0e3347d3 6b97a52c14d0633 d *image463 586a6f4ee95f5bcd2c 927861385e94a4 0c1c1baac0e9f38767bc3 d51670a1408 a13c94ff6e72cb0563fe53 441ec47e97 *image464 542c ee7fd4925f0 f10fb319c5ba7015 *image464 3ce240df814c43597f 22bddd92326d21 0b9c12eb9 9f1ed148550 0447290e0cc ac0d05e9c95f72d072e16 c3b269f893b *image465 8adac3463bd3bd7 1b3f7818dbe623c 46 *image465 200eb98b3d1ae9024 9bfcde3c5c87602 abd14405bc6b3a93abeea b3655301042 5c999c5d0d44a1077eabc 1d357518243 *image466 11b406ebd578084 3f4ab99e275c32a6 e *image466 7c66bd81333dc4dffa a8b78baa718e99 94143b686a52b19e3181 3216e835870c cb9dac68929479b340a9 95d53055ecb1 *image467 1148b967552e236 58208540df6cd31 27 *image467 a67200d8722135f29 63c2df33ac77aee 73739cb00a46aa5814751 7e23fc05600 054d2a07dc6f102542984 ff862b48f46 *image468 f31dc935f151900c 01368cf0d8529c5 1 *image468 957131c39b8d1e197 b94b82802516c91 cfdfd727e317cdab4349c b2d31cb8286 903d4175d1db934c3200 41b4dc51b853 *image469 253993d9a1b31be 61ec35ce7aeb6a4a b *image469 63868aa3f9792596e2 057aa7c0fe6145 9d82e73e7cb053bea046c c7d5aeaa423 0d3956c71de7b8443911f 1a269bf4c8d *image47 2d0826a33c6f3ae4 e1ee89ea391ce4f3 *image47 0235abaa1d778c200 3516e8f11e8e841 9e5afe00043cc93fb2482 57ea6ed3512 a7ef87b271693da02a2a4 52d6a6ce2a1 *image470 d905980df0e052a 117b77df03c3ab2 e7 *image470 e2cb758292982c3b2 305deacda57d7f7 6d90e64ccab94d1d9cc71 66fdec0b6db c670c40ca56ca4200338f 8ad74b248dc *image471 c8239080bdf15d4 68698b7c9710cbd df *image471 db6b1af20a1762d150 093cb00941079a b734c6059405496a5f8b2 6afe200bc29 b07e1bdabe867941cbbcc 4538d816170 *image472 ea34146992cad38 a87cf4c6c81a6b17 e *image472 f5432fc55b7d3f834fe a4794c315d25d 9ab65feee63a024083815 cfaa33a13e8 74ad27b4c5acf9a412786 49c7cbcace0 *image473 65799851bb1df3a 81eeee8884918e4 98 *image473 55d78f4e1e8633c56a 65a2b396e4489c 0ccdbd54be3690b7a733f c0433792694 723c6c02d4cc0b3cdb7c1 6383c99b308 *image474 f8e3a920218aba95 22318ec5014709a d *image474 2bcd965161f4da35ed 5994b393b29725 d5720109c22b6f6df40bc c7c2517f780 7d9d29de9394ea6f9f058 59b0c214cc0 *image475 b80e57a00899a49 480e20fbae0a4c3e b *image475 75bcf46240665c0849 6b817fa505fa96 e31cc0e9df10e4ff47bd9e 9a351b77f4 60cefddc7f3c378f44e4d7 3933d2c4d2 *image476 74d35f08f6cb2a3e d3f053989cc43c4 0 *image476 f758470518a454b54 d02cdf97d6f2b9d cf17c665c356fa3fa3edef 7f7068be19 fb086be0cfe63066cea76 6666cd68e78 *image477 781a6fad434f62f9 ce5b16aacc4fe516 *image477 27465e13767a2e6f46 52f9027962d4f7 257a5098efdabc478c796 1696cbdf406 ede2e92216795b5372b7 af0664aa29c7 *image478 5c9ea7da5505a16 51b8e2c272e10d4 57 *image478 09337ca87dcd62dc7 3f954b37893ee0f 1b334ca572757beb6591 7ed19a421fd9 537ca1d5379a50f167d7e 611f3e5232d *image479 f38e829fb7ba5d0e c90d46e5dc4f402 9 *image479 d5db046bcfe1b40221 29ca96d99ce82b 86235e29174b0bee8999e 6441059c9b8 db3534bab0b2f46468d7c 14b74e12222 *image48 e9d8f8a75cfd290f ec697e9b46a8277 2 *image48 74ad17fd3b44510d3 082b60f2d4242b3 d74323b6bcb12d9346f56 a5b26d49c4f 3d231a1146d5f26e802f2 f13d8ce2ff2 *image480 d8339fb7eef919a3 d23356932e58cb1 d *image480 c2cb91cd65712bdf45 e731d903018c1d 4293a8e76bfca07333d69 def6e3a556b d69818bbf50db165b258 d8bee964f478 *image481 f0a93f2c97455a4e 1b90f563ab3e89c b *image481 6251a752712699806 cff6a4e7141b76f 16d17405f9b78bc88f3c6 8a79128da57 a063ffdce3506b7b4ed2b 0ca065cc9e8 *image482 70b6d5f646720c8f 2fd0f6a919c3f3a9 *image482 6a22c17781ec44a022 84389c8a876eda 3e03f03432f5f3604c1af3 bdef85c652 3234cf3fecee00bd33bb0 7ab59ff5e40 *image483 826d0a41d8c6883 54808c326e2bcd1 e5 *image483 a4af9ee2e277951d6e b4649197b35b5e 3d45a6b1f22ea05319fcbf 88f5e4dd5a fec588f95371056f99525 d4808da1e35 *image484 5f691d97c20db4bf 08e4ec1f26f53b67 *image484 e269fff43a4b264586 dbc33835ad5292 aeb3cdb3b445e8a8b836c baf4de6fef3 3ae493bde3b9d3ad3538 2d642a2ad82d *image485 2818717bca16308 16ff3bfdc1ac663d 1 *image485 c9d0f4d41fabfa17de 8aaa28fe02678d 6f968b7cc4be999b1b19f 6effd415e4c 7ba6d1e56976f36d890a0 e47c9e66ab4 *image486 b6f1e4e7e474a5ce f301b364378064a c *image486 66bcfd415b6d3375ca de8d4180007a0d 3d044397e393dfa08ee01 b7859d3407f 48e271ae5e7f9335306d4 b60d119061b *image487 aa84e6a6fe540e63 40dd36996832d67 2 *image487 019ab9f75a7358371c 43f614048d564c 46dde5e6827a6c8483cb1 8d6c90533fd b2ebb6126e5a21a84df29 931a6e8bb0a *image488 35435d991a6fa75 a153760395a65b8 09 *image488 e57d8fe3f900dec761 bcb60f25d8122a d4da9b43baf59c4b32d39 92627ef1797 aec21fa7f36ce6e30e5ffa 1b587e333c *image489 c16271a8814beab b847c5223562d2d 82 *image489 d0348dcbacf69a4702 1bc4f6d3d8cb08 eae2be2cc69755e882826 3fde5523b90 25b0e1dd0ce8fabfdf7c94 0cc45dec6a *image49 768147bd15b50b6 9cc427762f03b17 41 *image49 c21b7bf2d33d3501eb 7ecfd3f84e8024 1c9dcb68ae72826e8cb7c 2322f4c3728 4292ab59eaeb63953b11f 4b8896e2c2d *image490 69ab7a36a328425 10336f77982860b 3c *image490 6f4ca361e71137bfbc ab8af3b9d662d2 f27fbeab59049a08bca6d 975f3092492 b41cc7327d34a468716a 0f11ef673eb1 *image491 999906837e27ba3 e6fe31cc84c5f2ca 8 *image491 eb23be24bec2a46fc5 a42e5cd85b9d83 7c708053c63c75f87849c 2aef6300373 ec464a9a3921c1e2395fa 31ce951cff4 *image492 adbbdcd8fbc99fad c9f711187ff469b1 *image492 309c5f7790c5e3f62e db6ec723a62020 520820410c2f973e2114f 525be8b5b02 d491fdc219060836e8a58 878690b0c96 *image493 5986b99382d3be3 e30e7d86c96cad8 8c *image493 2b472570fba492df5e aa6f4083e51c78 0e8bdfdbe497fea49a954 3b483a9bf02 565b08cae13ed9566d2ef de469cd3291 *image494 06395110aaecd19 87c5476b095801d 2e *image494 93136270a721879cf3 8b66f998c0ccb5 5a14357f0cef5055392c2 75e8bc7f7d7 38745451d165121e0e1d 0985983f4450 *image495 828226a844110c4 e77c243118e1487 4f *image495 bb2308795dc31b417 af730c84210428a 1a0346e1101da0ea17503 524feaea048 aa0819db8593926b4778 96f1e6dee823 *image496 69808dd136f73c6 eee1f659f0fc8a9d b *image496 790a4dadb95ef0f632 d22f8e46d18666 9071e362c223278881f17 9a86930b774 d6a77025f32b6cacf7a03 ea3be6c77f2 *image497 6784ed00a8f15a1 7e348e1ad49487a 02 *image497 7a24f20c7fb4369af1 4ba1ff18275145 354763578dc8e868b774 c807ff862541 e23a687bd45e6c26c56fa bc64f268ad8 *image498 f13c6b5a5e85ba96 887ec74f9ab1b96c *image498 d253fc72da01d9f64a a48d300527120e 7a2a04b83fbbb7eef4b40 a3081672072 b74c18105bcd61bced2ac 4323d6c1c11 *image499 80504d05ab0ac0b 94400a938371135 81 *image499 a8a646cadacc809b29 fbcc194e2f64b3 35b41997fec75c0fad8f1a 206de9c06e 403ad556790a465cb3a6 57f6bd8f9a2f *image5 b07381cc513c0a7 1083790b835f3c2 8a *image5 9815898359f12a086 577fe9dd10f8e98 49c9a4397d07a98b01cb8 852222f8d03 85881b437585454cba02 80eb0ab37f73 *image50 f84fa815d730e655 fac15323928b203 2 *image50 16b81da211e0dcd0a 6be9c2d6010cb55 38572ebff7e888543f274 a03e0993ed6 7bf0fe4ff267de4ee62f0a 32159fa505 *image500 887cea8a7cf66d6d 1c36b5b19489a52 f *image500 081127da6c30541eec 38fd1938d2bef1 68e16a4dbff116dffd2f13 5258c2e66c 2927bf5009a6ed0a7b8a9 c5d2ca3cbff *image51 d1fa42864ea1537 95db7b8a4de4c59 0c *image51 b28f88e98a67586fbc 12561b932005eb e20284cd47e8a06c2c9c3 a65e5746c38 0bc395459b820f5198f83 23f839f937f *image52 496387111987e66 4f26bcb93357d52 34 *image52 5dab1bdfda60cca3bd ffa9abdb11cb44 371142a5ba5d7c623b11e e2742530b85 42af3111e82d74a0d6be2 fd05d1c706c *image53 dfb4716389e1d9b c5b7b804985d1f0 09 *image53 6c73d8f530b4bf5b26 e0a62683161640 99c1802eba26fd1a49eb4 87a4786def9 a5b9c705c5beddf5a387d 07f8f083817 *image54 514b58f6776e301 6c4dbb05b159b0f bd *image54 b0046d605dcf0a8b4d 71bb5d250e8652 840c0ba9a5a734e90e744 5461a7d5122 df44d7966ce24e32a33f0 0e1168da3e6 *image55 90c6cb0979720a7 04b3f9665685ebe bd *image55 81f71fc1ef63167c31 c20ee45fbde492 ac13d013ea32bcaaacbe4 e4ac981dd9c 6773ae1d755708b9b466 309bfde0a194 *image56 b631e33e6c76de9 d48ab6f6b9800c5 18 *image56 f13b835801251e8aa4 19e2ea3e5cbee2 539fbcef4437d9f92a2ce9 b0a4b6892e 7e94c044e4095aaf19b95 1d1f1212f14 *image57 e8190db7bb9a7a5 b93ab50613ed521 1c *image57 5212f930118bca42d4 1e441e3ce91027 1ec10e683642afb0068d4 4e737d96d93 bfcef5d0f7b74ac32638e7 9fa07750d4 *image58 e39bdbcb98ed2e6 294014e667edf9b d5 *image58 29cb5b9b7d980171e e896700bb1fc7b3 1e28c4d3ac4e24336b7f6 738c72774ca 7b35ce52e004f83368b99 b858e1a3672 174 *image59 b1b282a847b7813 fe040243dedffaca e *image59 8fd0337302ad1358d bd676d0005a3c3b 77cda55403440c3ca4a44 3b9f1fb8ded d001ab9425922fb79d12 9960141b03ce *image6 c3fe3aa6455c6233 57ec20bf1fd33d08 *image6 19d076ffd7f3718dbf b19220fa51ea97 25d07b02600e775607ec 415306e11fbb a34870dee29969167941 c09314251808 *image60 1089b97b6393884 e0edfe176cd28156 7 *image60 63c8a7c8c71cdcbbe6 21195ace5028cf cc1c3bafeee3bca250547 4ed65eeb613 8892ba3729511aa10428 74b5e8b3862c *image61 efeb1ad49ca91807 bb00d7ae98505c0 1 *image61 7416987832d19dadd 16ba996545e3496 81b5e5ca1f53df419d118 0baee6d876f 4d2a8d8246a7c5bcedbfa 24b605095aa *image62 0191844301dd3fe 070dd606ffa2ba2d a *image62 2858ebfde9c90a757f 795c73d467e78d 5dddd5c8061916978baa 638051adf1ab 17a0d453a7da2d7fb9d57 5f3e161cef9 *image63 591859c1c42efb4 263af2cc85ebcf25 e *image63 fbb8503ba2ff6b5ab1 4e21ddeda9c7cd eee8272022336840c8054 4e2c67f6580 cfe614d7653e2511b7b44 b804fcd823a *image64 c3de8091cfe83130 cb623158102fcd8 5 *image64 abb8afe5424298fd86 410d1da668fbd0 7620687c386c1854b207 449d5139e141 679be1e74e9b6529be2fa b620a5f7a44 Image # Baseline MD5 Image # IRFANVIEW PhotoScape Photoshop *image65 fcd038c568f2e72e b40a6aaec305aad7 *image65 59921327e7da513e8f 393d65ac17d46a eb1cb79dfcfedefdada39c aa89d68ede 98949b8d2ff23ad1c6d95 a7b790e7af8 *image66 efbc67f6dc4b8c9b 8dab6d89af13508 c *image66 dfcf1e8489da 48805 2d147f850b5bd2 d5de21f1ff9615bba6242 704195f7a40 8fca7544ae5e643dba68a 4053c04b341 *image67 65baa703e86cd8a 67cef046fbb703a5 6 *image67 49d7fbb75356fde244 575478f6ebbb4d ef7c2fa80cb710e6bc39a7 0e29a6ba95 5017802c944aac2937e2d d4706619489 *image68 187efea557e2c7e3 a062c951084f1d0 d *image68 4e37a55cb989690e0 de82b2c9591a64f 33c2a14e1ed2ad03c3ddf 09b5cf1fe6b c1dcc3bbfbb875adb4453 3e16fa6c0b9 *image69 05608741cf2d605 5b998cd9d5e1931 ea *image69 61b0b6bc6d59b1cdd 1b2547b1674b14d 6e358a9d1af423383ff92 8b25b0db27c 3963cd932410c12d4967 93936d0d950b *image7 1df5814be07b08f1 958758e636156ba 0 *image7 eac7eb758f7e54d2fff 2403d78a3e23d adb2fb2f66fb10740e514f 205f048886 3fb4e493cf9fcb95b1108 063923aafe6 *image70 b7ed9e36fa8fc6e7 b23ceb094d8f18d 2 *image70 afa371813b0386a04b c12b55567946b2 12d58ca99721c81ce6e09 25a9ee154d9 894e25fced538f92ffc7ab b9c1831aff *image71 bd4443a88ed2819 4f9a4607e02d7b1 ab *image71 e397e9c274ffe42afd5 4dc4c867c1a7d 8ad5f05e1e88fbfc9edc37 7e83d5d178 3b07bfc4d313f835cfd26 9ed44c7af51 *image72 d6b0aea8dc008a8 63dc5a38edba00f6 8 *image72 85c281494dccfd0e9a 2098aa78de6aba c43406a09d23c77ef7208 13025badfaf 9b5f64d5019409f4c7d5f d8b747c2d63 *image73 eaffc9b469c41ceb a11e520e9c385b3f *image73 178f6a71a59460af2b 4cc7f9b0159686 5d6ab541a6aba20d0d99f 4c290d73f1c 9063cd3dc26fc39a56d5d 23010bd1fd7 *image74 114c8ac83e5308c 47efbbfc4c6e43fb d *image74 8c5e4b57cb0dd947d d0cbb38ec33912d 309b6207e18abd7f57afef 72f4b0fe62 c926dc5b9119a9fa9e945 d8189de489c *image75 e992965b8320744 da94af15b7edaa88 8 *image75 bfac54029f0627c67f 87c1434de177a3 b2070edd71026514f51ce 4ceae8ee0d6 2036e4edc62be5a5f9de5 3dd9dd5c184 *image76 8e924959a0c2e87 7f2f9adf24caa041 7 *image76 38573f32152c29fd73 8d73ff54c1078d 4f6b30fd9e15f60de03cef f26bd7d91e 27680eb9214b15fe7ecfb 55eb7419b5c *image77 4f674e947c4b2b2 1f36ebcad78484ea 4 *image77 800a775cd306f0da1a c4305f528b0c94 511f20aeebfe8198e9f7fc 7980c56597 dad8406392bcccb66685 bbc570fc056b *image78 ccc91437a16ea7d 0f09c0b81b68332f b *image78 b1c058f09f97c81566 93f03bc285324c 39c6e0717b944a17a950e 2f4e5013e75 a8e274f6864767fc2c32a 51bee9b0433 *image79 043b55c53602e7d 39c8722d28ba5f5f c *image79 8695e474582c383b4 355e4f59439e566 3ce292772b6ce775a9de1 142eaecc2f5 d05728895e8184cc3eb9c fd79d85eb6f *image8 7c28343558256f4 ba8720254f7faa0d 8 *image8 2341eb6bc37888553 27c337f56862de6 7457c231357879066520 3819bde92801 7395cc49ce39fd70d2c90 9dd9658d26e *image80 2cf2c06bc14d730 0260ce6ab60f48f9 1 *image80 2b5aa7e5af7a647a5e 36a48615042926 806b946cf96a862a8ae38 5b525f78bd4 f3b2b93e243928895083e 9ca9347d690 *image81 62fe2969635c96fa a58f4c016bc4c488 *image81 b918a6e8596a442b7 5795a5f8c407606 cfb550375a57de0388b35 c72e60ffe82 fe7e9b65f719dd0d7c548 55e0b3804fa *image82 328a1339af154ea0 81332e570afb51e 0 *image82 afcff3ec6cda2e6180f 2c2c50ebbcd6b 908a23910c37f748e9a46 3e668122d01 4a025c5d1b51289884f88 8d987e12c3e *image83 4c38bdcf1b5dcb1 26e6c6840e9787e aa *image83 e3758eb3fa91c59bc5 b4c77426421010 6b8dbe07abaf0d752c065 aaaa04277fe aa7dc942aece2b76df468 1a8a2152a69 *image84 fc0858851f9a0ea8 86f1b1d204d16f7a *image84 f568c9ed56f247daa7 06807b083e7fd9 cf0a204075a08b55fd3e3 700da68b052 36a451d1faac6a514b90c e8fbe46a090 *image85 b0bc9789ebbb12d 7f5ddf47ca060a12 e *image85 585bc42b674b92b7a 7d3a2c3e3698c73 6326c1735ef7f8274b794 6be5cd00a58 420cc156556c1c1ca0f48 a8236be1672 *image86 6fba21afb60ed78a a0d976b98a9866b d *image86 4af9ffb0ea0bf1132cc e7b123ca0edeb e1da9e6976a38464c97cf 76e1a4facc1 747c1b9687bbf6d693aa8 258e91f92a2 *image87 d14cda0ca9b7c1fd 3b2f621f58a2856d *image87 bc9b36c7ec4853db2 70c5a2b5d617cb9 95f6551d8dec657a9ac87 bfc205d54e0 472e526dc1453ac30ac33 d35e1e949cd *image88 b288b6046ad6a77 5cfd9341897483a af *image88 9ba06a149541c196aa 6054c05a3f6ef6 4e6ff98ba3bec32579d34 749735db2d6 4b441a30774bc487167e ce170b86c1ff *image89 52b72aa56ab0e23 a99f26c9c370353 0f *image89 13ade436dc673d248 1c86742152362a2 bca0900cd2d046e8d18e9 0b843165a50 7ffe8328a9c5e7da89006 c74992445c5 *image9 a4e5f4e5a4f4487b b990c516556a567 0 *image9 5acb21c013fc8c43e5 8c796eecba4df3 e6f0d177bdcd2fe12bd15 874c9626d50 91079b35acdd70349baa 62a1f4ae484e *image90 7728234acdcc208 e4ef68ea044a1974 0 *image90 534acddda0d447ee2d 523db3dd77c53f e63e92458a376ae5ca8c6 ce433ffb1bb eae658fe61d57baff12f8c 50757bd79e *image91 f6a72ae9921bc749 fb1471129374bb4 8 *image91 9cf48c5468ba5ce76f a3d0ad5e1e7a62 503197f9493a38c5778f0 02ddf248f4a 7dc4d4afcd7fd2e8d1bfb 5a709638ae0 *image92 a6e8b82a686537b b3cd6d650d1caa3 af *image92 3e0277b6f925d93c8f e582be51a97723 04ef453cd6e398c10a176 dcb9dc8b173 8c6f6cf7f3fb05fa8ab323 8b573b25a5 *image93 49353f35adcf016f 433d81cbdeccc1c 1 *image93 8c523273cbea9857ab b1aa8523e1d2a5 cf403ac02e02553d305cd 37ad0ae0c25 8b8dd0172d7455519d31 1f8810025d55 *image94 cb8dad232f53811 d0194b206c90767 f8 *image94 20a22b3ea7d6f2a711 585671e58818a3 61d4ff35a962beaba84c9 4b67550963b 66a6a2527744566aeb5ab 8cf7fbc2f8d *image95 892856c129bd06a 109f5f8d095e6dd0 6 *image95 292116cf4e4f65f5e7 95c7b453cef37d de60db581c0834a7adade 62e1b62a244 e34a63881a513f58715e7 93721765341 *image96 dcb173d8e74839e de4d0ef6441a595 30 *image96 9003db99b398a64d5 b8309bf51989abc 0264682695e212a5830f4 54abb75be6d 9563edc4f90f112426f19 9c9b88f2517 *image97 4197242c9263c36 40db523595e3066 76 *image97 eee8cae9842a83947e 74527623ba29cc c024998cbb649b0b9ebfa f610cc66d44 1c695a540b829d24ca7ac dd5a15436c9 *image98 75f59b8133b3cb8f b3f338b30c8ded1 b *image98 72eb5457d9a765775 4d6d21c1bd3e809 8d438ce57b983ecacac5e 7ef6adf4079 391beb9064621d346168 b198ce5b6022 *image99 e9a2fa450573cc60 2ad1337b2e61cd3 d *image99 3d8f9b4d394c8fb5bf 6f20f9027d95c5 7f5203b212014bccdfaf8 90e7d8c7f67 0368e93d6bdea251ab1fe ee6ba16ccec 175 Appendix Q: Wald-Wolfowitz Runs test Details James MacCaffrey tells us that ?you cannot ever state with certainty that a given pattern was generated randomly; you can only test to see if there is statistical evidence that the pattern was not generated randomly?. (McCaffrey 2006) According to the NIST handbook on Statistics the runs test is to be used in determining the null hypotheses H0 that the sequence of numbers is the result of a random process. (Filliben and Heckert 2010) A run (R) is a set of values that are either all above or below the mean value of the dataset. In the execution of the Runs Test; positive runs are consecutive numbers above the mean and negative runs are consecutive numbers below the mean. From proceedings paper, (Kohler, et al. 2008), the calculations of the runs test are such: The error rate for the algorithm is calculated as shown above where R is a random variable that equals the runs of a random series of numbers either above or below the mean and N is the number of observations in the series. The Variance of R is computed as shown in the next formula, 176 With the error rate and the variance computed, the Z test value is determined by subtracting the error rate from the observed number of runs above and below the mean divided by the square root of the variance of R. According to Kolher et al. and the NIST handbook at a ?5% significance level, a z-score with an absolute value greater than 1.96 indicates non-randomness?. (Kohler, et al. 2008) (Filliben and Heckert 2010) 177 Appendix R: Chi-Squared Critical Values Courtesy of the NIST Statistics handbook (Filliben and Heckert 2010) Critical values of CHI^2 distribution with degrees of freedom Probability of exceeding the critical value 0.10 0.05 0.025 0.01 0.001 1 2.706 3.841 5.024 6.635 10.828 2 4.605 5.991 7.378 9.210 13.816 3 6.251 7.815 9.348 11.345 16.266 4 7.779 9.488 11.143 13.277 18.467 5 9.236 11.070 12.833 15.086 20.515 6 10.645 12.592 14.449 16.812 22.458 7 12.017 14.067 16.013 18.475 24.322 8 13.362 15.507 17.535 20.090 26.125 9 14.684 16.919 19.023 21.666 27.877 10 15.987 18.307 20.483 23.209 29.588 11 17.275 19.675 21.920 24.725 31.264 12 18.549 21.026 23.337 26.217 32.910 13 19.812 22.362 24.736 27.688 34.528 14 21.064 23.685 26.119 29.141 36.123 15 22.307 24.996 27.488 30.578 37.697 16 23.542 26.296 28.845 32.000 39.252 17 24.769 27.587 30.191 33.409 40.790 18 25.989 28.869 31.526 34.805 42.312 19 27.204 30.144 32.852 36.191 43.820 20 28.412 31.410 34.170 37.566 45.315 21 29.615 32.671 35.479 38.932 46.797 22 30.813 33.924 36.781 40.289 48.268 23 32.007 35.172 38.076 41.638 49.728 24 33.196 36.415 39.364 42.980 51.179 25 34.382 37.652 40.646 44.314 52.620 26 35.563 38.885 41.923 45.642 54.052 27 36.741 40.113 43.195 46.963 55.476 28 37.916 41.337 44.461 48.278 56.892 29 39.087 42.557 45.722 49.588 58.301 30 40.256 43.773 46.979 50.892 59.703 31 41.422 44.985 48.232 52.191 61.098 32 42.585 46.194 49.480 53.486 62.487 33 43.745 47.400 50.725 54.776 63.870 34 44.903 48.602 51.966 56.061 65.247 35 46.059 49.802 53.203 57.342 66.619 36 47.212 50.998 54.437 58.619 67.985 37 48.363 52.192 55.668 59.893 69.347 38 49.513 53.384 56.896 61.162 70.703 39 50.660 54.572 58.120 62.428 72.055 178 40 51.805 55.758 59.342 63.691 73.402 41 52.949 56.942 60.561 64.950 74.745 42 54.090 58.124 61.777 66.206 76.084 43 55.230 59.304 62.990 67.459 77.419 44 56.369 60.481 64.201 68.710 78.750 45 57.505 61.656 65.410 69.957 80.077 46 58.641 62.830 66.617 71.201 81.400 179 47 59.774 64.001 67.821 72.443 82.720 48 60.907 65.171 69.023 73.683 84.037 49 62.038 66.339 70.222 74.919 85.351 50 63.167 67.505 71.420 76.154 86.661 51 64.295 68.669 72.616 77.386 87.968 52 65.422 69.832 73.810 78.616 89.272 53 66.548 70.993 75.002 79.843 90.573 54 67.673 72.153 76.192 81.069 91.872 55 68.796 73.311 77.380 82.292 93.168 56 69.919 74.468 78.567 83.513 94.461 57 71.040 75.624 79.752 84.733 95.751 58 72.160 76.778 80.936 85.950 97.039 59 73.279 77.931 82.117 87.166 98.324 60 74.397 79.082 83.298 88.379 99.607 61 75.514 80.232 84.476 89.591 100.888 62 76.630 81.381 85.654 90.802 102.166 63 77.745 82.529 86.830 92.010 103.442 64 78.860 83.675 88.004 93.217 104.716 65 79.973 84.821 89.177 94.422 105.988 66 81.085 85.965 90.349 95.626 107.258 67 82.197 87.108 91.519 96.828 108.526 68 83.308 88.250 92.689 98.028 109.791 69 84.418 89.391 93.856 99.228 111.055 70 85.527 90.531 95.023 100.425 112.317 71 86.635 91.670 96.189 101.621 113.577 72 87.743 92.808 97.353 102.816 114.835 73 88.850 93.945 98.516 104.010 116.092 74 89.956 95.081 99.678 105.202 117.346 75 91.061 96.217 100.839 106.393 118.599 76 92.166 97.351 101.999 107.583 119.850 77 93.270 98.484 103.158 108.771 121.100 78 94.374 99.617 104.316 109.958 122.348 79 95.476 100.749 105.473 111.144 123.594 80 96.578 101.879 106.629 112.329 124.839 81 97.680 103.010 107.783 113.512 126.083 82 98.780 104.139 108.937 114.695 127.324 83 99.880 105.267 110.090 115.876 128.565 84 100.980 106.395 111.242 117.057 129.804 85 102.079 107.522 112.393 118.236 131.041 86 103.177 108.648 113.544 119.414 132.277 87 104.275 109.773 114.693 120.591 133.512 88 105.372 110.898 115.841 121.767 134.746 89 106.469 112.022 116.989 122.942 135.978 90 107.565 113.145 118.136 124.116 137.208 91 108.661 114.268 119.282 125.289 138.438 92 109.756 115.390 120.427 126.462 139.666 93 110.850 116.511 121.571 127.633 140.893 94 111.944 117.632 122.715 128.803 142.119 95 113.038 118.752 123.858 129.973 143.344 96 114.131 119.871 125.000 131.141 144.567 180 97 115.223 120.990 126.141 132.309 145.789 98 116.315 122.108 127.282 133.476 147.010 99 117.407 123.225 128.422 134.642 148.230 100 118.498 124.342 129.561 135.807 149.449 100 118.498 124.342 129.561 135.807 149.449 181 Appendix S: Frequency Tables for ZVMCUs