The determination of identity and uniqueness of color laser printouts of Ricoh^® brand by Adobe^® Creative Cloud Photoshop^® 2018

Abstract

Background

Printer forensics is a sub-branch of digital forensic science encompassing the identification of the source of any printout by different means. Over the world, still today, there is no digital forensic lab able to identify the source of the color laser printer seized in forgery crimes by a certain scientific method. Therefore, the determination for the identity and uniqueness of color laser printouts have become one of the most challenging recently investigated in digital forensic labs.

Method

In the present study, one type of the most common brand of color laser printers called Ricoh® was selected. Three defined steps, printing, scanning, and extracting, were applied to measure and calculate the obtained data for achieving our target. Adobe Creative Cloud Photoshop 2018 was used as a forensic tool for image processing.

Results

In our study, 400 color laser printout samples from 93 Ricoh® color laser printers with different serial numbers were investigated. The study results successfully present the basic coded dot matrix pattern (CDMP) that characterizes and corresponds to the Ricoh® color laser machines with a 100% accuracy ratio.

Conclusion

The determination of identity and uniqueness of color laser printouts of Ricoh® brand was achieved with a high accuracy ratio (100%). Adobe Creative Cloud Photoshop 2018 was a versatile software applied as a steganalysis tool for extracting the steganography information embedded in all undertaken color laser printouts.

Background

Identification of the source of color laser printouts is a serious dilemma in digital forensic science, hindering forensic document examination. With the increasing use of color laser printers, the crime of forgery increased too. To prevent or combat the increasing rate of forgery using color laser printers, we need to identify their sources. All over the world, the strategies of forensic identification of printers are divided into two categories (Tweedy 2001; Mace 2010). The first one is called a passive technique. This technique aims to use the imperfections resulting from optical, electrical, or mechanical defects in the machines (intrinsic signatures). But this technique is not satisfactory for inspection and did not provide the results with the acceptable ratio for all cases (Mace 2010).

The other technique is the active technique that aims to track extrinsic features embedded in the color laser printouts (Mace 2010). The form of the active technique appears as yellow dots. Moreover, these yellow dots are called Counterfeit Protection System (CPS) codes, Machine Identification codes (MIC; van Beusekom et al. 2013) and coded dot matrix pattern (CDMP; Salim and Abdalla 2018). The dots are very tiny in size and cannot be seen with the naked eye (van Beusekom et al. 2013; Tsai and Liu 2013). By tracking these yellow dots, the obtained data could be given vital and conclusive information about the color laser machines such as the serial number, model, and in some cases the time and date of the printing processes. However, identification of color laser printers nowadays receives a great deal of attention via different techniques, such as halftone texture analysis (Kim and Lee 2014), and analysis of noisy features (Choi et al. 2013; Choi et al. 2009) etc. However, identification of color laser printers nowadays receives a great deal of attention via different techniques, such as halftone texture analysis (Kim and Lee 2014), and analysis of noisy features (Choi et al. 2013), and geometrical distortion analysis (Jain and Joshi 2017; Wu et al. 2009). All these approaches depend on the intrinsic signatures that can differentiate between different brands and models with good results but failed to distinguish between the same models of color laser printers.

By comparison, the results obtained between both passive and active techniques in case of color laser printouts; we found the active technique presented precise results, so we used a candidate active technique for the current study to identify the source of color laser printouts with precise clear evidence.

In our forensic approach in the present study, we apply Adobe^® Creative Cloud Photoshop^® 2018 in the RGB mode as a non-destructive and indirect forensic tool. Four hundred color laser printouts from 93 Ricoh® color laser printers with the same and different model were investigated. The target scope of this study aims to determine the source of the color laser machine corresponding to the Ricoh^® brand from its color laser printout studied based on their identity and uniqueness.

Materials and methods

We have implemented defined steps in our work encompassing printing, scanning, extracting, classification, and identification as represented in Fig. 1.

Fig. 1

The five defined steps for determination the identity and uniqueness of the candidate color laser printouts

Printing

Four hundred color laser printouts were printed from 93 color laser machines of Ricoh^® brand onto A4 white papers. All color laser printouts contained both text and images. Variant models of multifunction printers and lone printers’ candidate are given in Table 1.

Table 1 Color laser Ricoh^® printer models’ candidate for the study

Our color laser printouts were collected by authors from different printing offices in Egypt within 4 years (2014 to 2018). Each collection occurred with an interval of 3 months for each printer. For multifunction printers (Table 1), there were collections every day for a long one month.

Scanning

A flatbed scanner of Cano Scan^® LIDE 100 (see Fig. 2) was used as a primary steganalysis tool for scanning all color laser printouts selected at a resolution of 1200 dot per inch (DPI).

Fig. 2

A flatbed scanner of Cano Scan^® LIDE 100 attached with a computer system

At this step, we have obtained raster images based on pixels (soft copy). Therefore, all image details are presented in the form of machine language as a bitmap for each color laser printout. All scanned images were saved in the form of an image with an extension of the .jpg file.

Extracting

Adobe Creative Cloud Photoshop 2018 was utilized in this vital step as a second Steganalysis tool. We tracked all passive security (steganography) features embedded in all candidate scanned color laser printouts. The RGB mode was used for separating the scanned images into three channels. And the geometry arrangement of the RGB color pattern represented with cylindrical-coordinate via Hue, saturation, and lightness (HSL) was adopted as illustrated in the previous work (Salim and Abdalla 2018), and these procedures are included in details in the video Additional file 1.

Additional file 1: The proposed forensic procedures implemented to extract the coded dots matrix embedded in the color laser printout sample of Ricoh^® brand by Adobe^® Photoshop^® CC 2018. (MP4 14900 kb)

Classification

In this step, we have implemented two sub-steps in our procedure represented, measurements and calculations, respectively. The measurements were performed by using Adobe Creative Cloud Photoshop 2018 (Fig. 3). All calculations are computed based on the Binary-Coded Decimal (BCD) and will be published elsewhere beyond the scope of this journal.

Fig. 3

The measurement of the length of the basic coded dot matrix pattern in the RGB mode of color laser printout of laser Ricoh^® SP 420 sample

Identification

This step is the target of all defined steps. After completing the classification step, we could obtain the precise patterns of the coded dot matrix that corresponds to each color laser machine of Ricoh^® brand undertaken in our study. From this step, we could determine the identity and uniqueness for all color laser printouts investigated. More and more we could distinguish between two color laser printouts from the same model and brand of Ricoh^® brand with different serial numbers.

Results and discussion

Four hundred color laser printout samples from 93 color laser printers and multifunction printers with the same and the different models as shown in Table 1 were investigated. After completing both the printing and scanning steps, we have unveiled the steganography form existing in all the color laser printouts undertaken in our study at the extracting step. Therefore, we figured out that all characteristic tracking dots were spread all over the printout samples in a specific coded of dot matrix patterns. Configurations, distributions, and the spatial distance measurements of these tracking dots were determined by the Adobe^® Photoshop^® CC 2018. We were able to track and extract successfully the yellow tracking dots printed in all color laser printout samples. The configuration and the distribution of the tracking yellow dots extracted from color laser printout samples of Ricoh^® brand are characterized by the following aspects:

• 1. All embedded tracking yellow dots onto the paper sheets were aligned in a uniform of horizontal rows and vertical columns patterns.

• 2. The basic coded dot matrix pattern repeated regularly is composed of seven columns with eight rows of a defined coded dot matrix pattern.

• 3. Basic coded dot matrix grouped vertically in 18 rows; each one of them contained 12 repeated basic coded dot matrix patterns.

• 4. Basic coded dot matrix grouped horizontally of 12 columns; each one of them contained 18 repeated basic coded dot matrix patterns.

• 5. On the upper left corner of the coded dot matrix pattern, there are two constant and adjacent dots, which are separated from another repeated one.

• 6. There is a unique distribution of the yellow tracking dots inside the coded dot matrix pattern for each color laser printer or multifunction printer investigated.

The defined configuration of the coded dot matrix patterns for color laser printers of Ricoh^® brand and their different distributions can be shown clearly in Figs. 4, 5, and 6 in both RGB and CMYK modes as viz.

Fig. 4

The RGB mode of the regular repeated basic coded dot matrix model in black color of Ricoh^® MP C 4500 sample

Fig. 5

The RGB mode of the regular repeated basic coded dot matrix pattern in black color of Ricoh^® SP C 430DN sample

Fig. 6

The CMYK mode of the active yellow dots spread and grouped as the regular grid pattern in the horizontal rows and the vertical columns of Ricoh^® SP C 410 DN sample

Figure 4 exhibited the regular repeated basic coded dot matrix model between four constant separated dots, two of them at the upper left corner of the coded dot matrix model from the first row and the other two at the right lower of the last row and marked with two red ovals.

Furthermore, Fig. 5 represented two basic coded dot matrix patterns surrounded by red squares and separated from another one by two neighboring dots as starting dots for the basic pattern and marked with green ovals.

Moreover, Fig. 6 exhibits the CMYK mode for the yellow tracking dots that are grouped in the defined shape composed of seven columns and eight rows as given inside each blue rectangle. In addition, two of the starting dots are presented inside each red circle that separated each basic pattern. By comparison, in each basic coded dot matrix pattern in Figs. 4, 5, and 6, we could discriminate the difference in the distribution inside them but all contained the defined configuration of the coded dot matrix pattern composed of seven columns and eight rows.

To facilitate our illustration, we simulated the defined configuration of the regular repeated basic coded dot matrix pattern presented in one model of the color laser printouts of Ricoh^® brand as an example to simplify and illustrate the following measurements as depicted in Figs. 7 and 8.

Fig. 7

The simulated CMYK mode of the coded dot matrix model in a yellow color of color laser Ricoh^® SP C 420 DN sample

Fig. 8

The simulated RGB mode of the coded dot matrix model in a black color of color laser Ricoh^® SP C 420 DN sample

We measured all the spatial spaces surrounding the basic repeated coded dot matrix model embedded onto each color laser printout studied from all directions. The non-destructive and indirect tool of Adobe^® Photoshop^® CC 2018 was used with a custom preset after the calibration (Fig. 3). We found all color laser printouts studied had constant spatial distance measurements that can be summarized and given as viz:

• 1. The spatial distance between two adjacent dots inside the basic coded dot matrix model = 0.1 cm.

• 2. The width of the basic coded dot matrix model = 0.6 cm.

• 3. The length of the basic coded dot matrix model = 0.7 cm.

• 4. The horizontal spacial distance between two adjacent basic repeated coded dot matrix models in each row = 1 cm.

• 5. The vertical distance between two adjacent basic repeated coded dot matrix models in each column = 0.9 cm.

These measurements can be visualized in Fig. 9.

Fig. 9

The constant five measurements carried out on the basic repeated coded dot matrix model of the color laser printer of Ricoh^® brand

Furthermore, we printed from the same and the different models of color laser machines of Ricoh^® brand on interval times (every day, every month, and every year) but we found that each color laser printout sample did not change its unique distribution of the tracking yellow dots inside the basic coded dot matrix model. So, this means each colored laser machine of Ricoh^® brand contains the coded constant information about the machine serial number and the model type only but did not contain information about the date nor the time of the printing processes.

Conclusion

We could successfully track, extract, and measure the spatial distances of the security feature embedded in all color laser printouts of Ricoh^® brand studied via the conclusive preset of Adobe^® Photoshop^® CC 2018 in an excellent yield reaching 100. The security feature embedded in all printout samples existed in the form of nano-sized yellow tracking dots spread and grouped in a regular grid of dot pattern on all over the printout samples as regular horizontal rows and vertical columns constantly of both repetitions and spatial distances. The basic unit of the tracking dots repeated regularly is composed of seven columns with eight rows in a defined model of a coded dot matrix pattern. We figured out that each color laser printer or multifunction printer studied had its unique distribution of the tracking dots inside the coded dot matrix pattern that represented only the serial number of the machine with no information about the date or the time of the printing processes.