Integrated model: Statistical features, memory analysis for scanner and printer forensics

Abstract

Printer and scanner can be used in illegal activities varying from corporate office violation to criminal activities and gathering printer artifacts in this regard can be very vital to held someone inculpatory or exculpatory. Every printer and scanner has its inherent properties and one of them is intrinsic signatures which are translated in printed/scanned documents as well. By inspecting these intrinsic properties in questioned document we can trace source printer. To identify signatures statistical techniques are used, images are filtered using averaging method, median filter and weiner filter to remove unnecessary noise content. Based upon noise content printers/scanners are identified. In addition memory content of printers and scanners can also be used for forensics investigation. Documents are queued in printer/scanner memory before printing/scanning and once printed/scanned, memory contents are still latched until another document is requested for printing/scanning. Integrating these two properties will achieve effective evidence in a scenario in which if a questioned document is modified and coarse area is disturbed, memory contents of printer/scanner will help finding the artifacts. This research proposes an integrated model for detecting printer and scanner from forensic artifacts.