Question

I have a directory of screen shots of some software in PNG format. I found that one was edited in PhotoShop, or a similar tool. I would like to identify additional PNGs in the directory that were also edited. If the editor were careless, is there any batch tool that could be used to see if the files were opened and saved from PhotoShop, e.g. by looking at the metadata or other details?

Was it helpful?

Solution

A heuristic (purely empirical, this is not documented by Adobe, hence it can change from version to version) is to look for a iCCP chunk with the name 'Photoshop ICC profile'.

A quick and dirty oneliner (linux or mingw):

$ head -c 256 file.png  | perl -e '$/=undef; print ((<> =~ /iCCPPhotoshop/)?
 "photoshop"  : "normal");'

Worked for me, but it's obviously not infalible. The head -c 256 takes into account that the chunk will be before the pixels data (and the palette if present), so as not to grep the entire image.

Bear also in mind that if the image was edited in Photoshop and afterwards edited by other editor or processor, the iCCP will probably not survive.

If you want to peek inside the PNG structure, there is this neat tool for Windows: http://entropymine.com/jason/tweakpng/

OTHER TIPS

There is a website called image edited that is a quick and easy process.

totneschap stole my answer shakes fist

however I remember from my forensic days in uni, checking the metadata of the image is the best way, you can use the image edited website or you can use http://fotoforensics.com/,

we used to have a tool which would tell us edited version, dates of edit etc however I am struggling with the name of it, if I can remember I will edit the post, but the websites seem like the best answer.

Try FotoForensics. It will tell you if the image is edited or not.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top