Image Forensics Failures

from PIL import Image
from PIL.ExifTags import TAGS
import numpy as np
from typing import Dict, List, Optional
from dataclasses import dataclass
from enum import Enum
import io

class ManipulationType(Enum):
    COPY_PASTE = "copy_paste"
    CLONE_STAMP = "clone_stamp"
    CONTENT_EDIT = "content_edit"
    COMPOSITE = "composite"
    RESAVE = "resave"
    UNKNOWN = "unknown"

@dataclass
class ForensicFinding:
    type: ManipulationType
    location: Optional[tuple]  # (x, y, width, height)
    confidence: float
    description: str
    evidence: str

class ImageForensicsAnalyzer:
    """Analyze images for manipulation indicators"""
    
    EDITING_SOFTWARE = [
        "photoshop", "gimp", "paint.net", "pixlr",
        "lightroom", "affinity", "corel", "photopea"
    ]
    
    def analyze_image(self, image_path: str) -> dict:
        """Perform comprehensive image forensics"""
        
        result = {
            "metadata_analysis": {},
            "compression_analysis": {},
            "ela_analysis": {},
            "clone_detection": {},
            "findings": [],
            "risk_score": 0.0
        }
        
        # Load image
        try:
            img = Image.open(image_path)
        except Exception as e:
            return {"error": str(e)}
        
        # EXIF/Metadata analysis
        metadata = self.analyze_metadata(img)
        result["metadata_analysis"] = metadata
        
        if metadata.get("editing_detected"):
            result["findings"].append(ForensicFinding(
                type=ManipulationType.CONTENT_EDIT,
                location=None,
                confidence=0.9,
                description="Editing software detected in metadata",
                evidence=metadata.get("software", "")
            ))
            result["risk_score"] += 0.3
        
        # Compression analysis (JPEG)
        if img.format == "JPEG":
            compression = self.analyze_compression(img, image_path)
            result["compression_analysis"] = compression
            
            if compression.get("quality_variance"):
                result["findings"].append(ForensicFinding(
                    type=ManipulationType.COPY_PASTE,
                    location=compression.get("variance_region"),
                    confidence=compression.get("confidence", 0.7),
                    description="JPEG quality inconsistency detected",
                    evidence=f"Quality variance: {compression['variance_value']}"
                ))
                result["risk_score"] += 0.35
        
        # Error Level Analysis
        ela_result = self.perform_ela(img)
        result["ela_analysis"] = ela_result
        
        if ela_result.get("manipulation_regions"):
            for region in ela_result["manipulation_regions"]:
                result["findings"].append(ForensicFinding(
                    type=ManipulationType.CONTENT_EDIT,
                    location=region["bbox"],
                    confidence=region["confidence"],
                    description="ELA detected potential manipulation",
                    evidence=f"Error level: {region['level']}"
                ))
            result["risk_score"] += 0.25
        
        # Clone detection
        clones = self.detect_clones(img)
        result["clone_detection"] = clones
        
        if clones.get("patterns"):
            result["findings"].append(ForensicFinding(
                type=ManipulationType.CLONE_STAMP,
                location=clones["patterns"][0]["location"],
                confidence=clones["confidence"],
                description="Clone stamp patterns detected",
                evidence=f"Pattern count: {len(clones['patterns'])}"
            ))
            result["risk_score"] += 0.35
        
        result["risk_score"] = min(result["risk_score"], 1.0)
        
        return result
    
    def analyze_metadata(self, img: Image) -> dict:
        """Analyze image EXIF and metadata"""
        
        result = {
            "software": None,
            "created": None,
            "modified": None,
            "editing_detected": False,
            "edit_history": []
        }
        
        # Extract EXIF
        exif_data = img._getexif() if hasattr(img, '_getexif') else None
        
        if exif_data:
            for tag_id, value in exif_data.items():
                tag = TAGS.get(tag_id, tag_id)
                
                if tag == "Software":
                    result["software"] = str(value)
                    # Check for editing software
                    if any(ed.lower() in str(value).lower() 
                           for ed in self.EDITING_SOFTWARE):
                        result["editing_detected"] = True
                
                elif tag == "DateTime":
                    result["created"] = str(value)
                
                elif tag == "DateTimeDigitized":
                    result["digitized"] = str(value)
        
        # Check for XMP data (Photoshop history)
        xmp = self.extract_xmp(img)
        if xmp:
            result["edit_history"] = xmp.get("history", [])
            if len(result["edit_history"]) > 1:
                result["editing_detected"] = True
        
        return result
    
    def analyze_compression(self, img: Image, path: str) -> dict:
        """Analyze JPEG compression for inconsistencies"""
        
        result = {
            "overall_quality": None,
            "quality_variance": False,
            "variance_region": None,
            "confidence": 0.0
        }
        
        # Estimate overall JPEG quality
        # Would use library like jpeglib for accurate analysis
        
        # Divide image into blocks and compare quantization
        width, height = img.size
        block_size = 64
        qualities = []
        
        for y in range(0, height - block_size, block_size):
            for x in range(0, width - block_size, block_size):
                region = img.crop((x, y, x + block_size, y + block_size))
                quality = self.estimate_jpeg_quality(region)
                qualities.append({
                    "x": x, "y": y,
                    "quality": quality
                })
        
        if qualities:
            avg_quality = np.mean([q["quality"] for q in qualities])
            result["overall_quality"] = avg_quality
            
            # Find outliers
            for q in qualities:
                if abs(q["quality"] - avg_quality) > 10:
                    result["quality_variance"] = True
                    result["variance_region"] = (
                        q["x"], q["y"], block_size, block_size
                    )
                    result["variance_value"] = abs(q["quality"] - avg_quality)
                    result["confidence"] = 0.8
                    break
        
        return result
    
    def perform_ela(self, img: Image) -> dict:
        """Perform Error Level Analysis"""
        
        result = {
            "manipulation_regions": [],
            "overall_consistency": True
        }
        
        # Save at lower quality
        buffer = io.BytesIO()
        img.save(buffer, format="JPEG", quality=90)
        buffer.seek(0)
        resaved = Image.open(buffer)
        
        # Compare original to resaved
        original_array = np.array(img.convert("RGB"))
        resaved_array = np.array(resaved.convert("RGB"))
        
        # Calculate error levels
        diff = np.abs(original_array.astype(int) - resaved_array.astype(int))
        error_level = np.mean(diff, axis=2)
        
        # Find high-error regions (potential edits)
        threshold = np.mean(error_level) + 2 * np.std(error_level)
        
        high_error = error_level > threshold
        
        # Find contiguous regions
        regions = self.find_regions(high_error)
        
        for region in regions:
            if region["size"] > 100:  # Minimum size
                result["manipulation_regions"].append({
                    "bbox": region["bbox"],
                    "level": region["avg_level"],
                    "confidence": min(region["avg_level"] / 100, 0.95)
                })
                result["overall_consistency"] = False
        
        return result
    
    def detect_clones(self, img: Image) -> dict:
        """Detect clone stamp or copy-paste regions"""
        
        result = {
            "patterns": [],
            "confidence": 0.0
        }
        
        # Convert to grayscale for pattern matching
        gray = np.array(img.convert("L"))
        
        # Use block-based matching
        block_size = 16
        blocks = {}
        
        height, width = gray.shape
        
        for y in range(0, height - block_size, 4):
            for x in range(0, width - block_size, 4):
                block = gray[y:y+block_size, x:x+block_size]
                block_hash = self.hash_block(block)
                
                if block_hash in blocks:
                    # Found duplicate block
                    orig = blocks[block_hash]
                    distance = np.sqrt((x - orig[0])**2 + (y - orig[1])**2)
                    
                    # Ignore adjacent blocks
                    if distance > block_size * 2:
                        result["patterns"].append({
                            "original": orig,
                            "clone": (x, y),
                            "location": (x, y, block_size, block_size),
                            "distance": distance
                        })
                else:
                    blocks[block_hash] = (x, y)
        
        if result["patterns"]:
            result["confidence"] = min(
                len(result["patterns"]) * 0.1 + 0.5, 
                0.95
            )
        
        return result
    
    def hash_block(self, block: np.ndarray) -> str:
        """Create hash for image block comparison"""
        
        # Simplify block and hash
        simplified = (block // 16).astype(np.uint8)
        return simplified.tobytes().hex()
    
    def estimate_jpeg_quality(self, region: Image) -> float:
        """Estimate JPEG quality of image region"""
        
        # Simplified quality estimation
        # Would use actual DCT coefficient analysis
        buffer = io.BytesIO()
        region.save(buffer, format="JPEG", quality=100)
        size_100 = buffer.tell()
        
        buffer = io.BytesIO()
        region.save(buffer, format="JPEG", quality=50)
        size_50 = buffer.tell()
        
        # Estimate based on compression ratio
        return 50 + (size_100 - region.size[0] * region.size[1]) / 100
    
    def find_regions(self, binary_mask: np.ndarray) -> List[dict]:
        """Find contiguous regions in binary mask"""
        
        # Would use connected component analysis
        regions = []
        # Placeholder - actual implementation would use scipy or cv2
        return regions
    
    def extract_xmp(self, img: Image) -> Optional[dict]:
        """Extract XMP metadata from image"""
        
        # Would parse XMP data for edit history
        return None