Forensic Image Processing

Brian Beezley

Mu-43 Hall of Famer
Jan 27, 2012
San Marcos, California
Last Wednesday I was watching coverage of the Poinsettia fire in Carlsbad on TV. A helicopter TV reporter suddenly showed a new plume of smoke coming from the San Marcos area, where I live. At the time the Santa Ana winds were really strong and the temperature was in the 90s. I thought, "Uh-oh." I went outside to see where the fire was located, but I didn't see anything from the general direction indicated on TV. I went around to the other side of the house and watched the Carlsbad fire for a couple minutes, which was easily visible from my hilltop location. As I was coming back inside I looked up and there was a big plume of smoke coming from the Coronado Hills on the east side of town. I ran inside and got my E-PL2 and 40-150mm lens. Over the next 14 minutes I snapped 11 photos of what came to be known as the Cocos fire. I wasn't particularly methodical about shooting. I figured I would toss out most of the images.

After I looked at the photos I realized that I had caught the fire in its very first moments, probably just a few minutes after it began. The images showed rapid progression from a small blaze in part of an acre to a large conflagration that covered several hillsides. I was amazed how rapidly the fire spread in the strong gusty winds. Later that day it occurred to me that perhaps my images might be useful to fire investigators. So the next morning I sent one full-frame image together with the crop below to city hall, which forwarded it to the fire department.

Subscribe to see EXIF info for this image (if available)

I had processed this image in my usual way, starting with Olympus Viewer 3 (for the colors) and then feeding a 16-bit uncompressed TIFF to Image Analyzer for resizing and sharpening.

A couple days later I got an e-mail from city hall saying that the image had been extremely helpful and that the fire inspectors wondered if I had any more. I told them about the 11 photos. They wanted full-resolution images so they could pan around for items of interest. I figured it might be a good idea to try to maximize image detail.

What commenced over several days was many hours of experimentation and revision. I wound up using Raw Therapee exclusively. It has a number of advanced image-processing features that I found helpful. Unlike most programs, it represents images using 32-bit floating-point numbers, not 8- or 16-bit integers. This minimizes processing artifacts due to data quantization.

I settled on the Amaze demosaicing algorithm. I used both automatic and manual chromatic aberration compensation. I wanted to be able to exactly overlay or switch between images to graphically show the fire progression. I had taken the photos hand-held and a direct comparison showed various amounts of image tilt, which made direct comparison difficult. I used RT to correct the tilt in all images. This made a big difference in being able to overlay them. My camera had been set on aperture priority. As smoke obscured parts of the sky it changed the exposure time from 1/1250 down to 1/640 second with various points between. This caused individual objects to vary in exposure even though the overall image looked good. I used a nifty feature in RT that displays the luminance value at the image point under the mouse. I picked a smoke-free spot in the sky just above a landmark along the ridge and equalized the luminance value for all images. That made a big improvement. I set contrast and lightness the same for all images.

The camera had been set for automatic white balance. This yielded reasonable color, but the color temperature varied somewhat among the images. I thought this might mislead fire inspectors. I bet they can derive a lot of information from flame color. I set the color temperature to 6145 K for all images, which was the value for the first image. With contrast boosted the flame color became unnaturally intense so I backed off color saturation. Olympus Viewer 3 had yielded realistic orange flames, but they were too red in RT. I found a vibrance control that made their color more realistic. I did a lot of experimenting with both Unsharp Mask and RL Deconvolution for image sharpening and finally settled on the former. It was more effective and had fewer artifacts than I expected.

One of the most impressive features I stumbled across in RT was Contrast by Detail Levels. This local-contrast enhancement feature really brought out detail, even more so than conventional sharpening.

I learned a lot from this exercise, particularly when things didn't work. I'm going to experiment with a wider variety of processing options in the future.

Subscribe to see EXIF info for this image (if available)

This is the final result (final, that is, until I discover yet another useful processing feature). I thought the first image I had sent was good, but this one shows much more detail in a direct A/B comparison, particularly in the vegetation, which I thought would be of interest. The mottling in the lighter-colored smoke is an artifact of the sharpening and local-contrast enhancement. It's not something I would normally tolerate, but I thought it was a reasonable trade-off for greatly increased detail, which I figured was important for forensic purposes.

A couple hours ago I delivered all the images in person on a thumb drive. I had created full-resolution JPEGs using 100% JPEG quality and best-quality subsampling. Each image was 11-14 MB, about the size of the original ORF file. 150 MB of images total. The city e-mail system wouldn't let me send even one image. But city hall is only a couple miles away so I just bopped on over.

Subscribe to see EXIF info for this image (if available)

Late yesterday I was comparing sequential aligned images (yes, I was looking for a furtive human figure in the vegetation, and no, I didn't find one) when I noticed a white object in one image that disappeared in the next. I cropped and sequenced three images, shown above as an animated GIF. This is in the extreme upper-right corner of the full-resolution field and is not visible in the crops shown above. The image with the white object is the first I took after I spotted the fire. I took the second image 5 seconds later and the third 28 seconds after that. The white object is on an unnamed dirt road on a ridge south of the fire origin. These images use slightly different processing because the image character in this corner is somewhat different. I tried all nine of the available demosaicing algorithms. I noticed some differences but finally decided to stick with Amaze.

Subscribe to see EXIF info for this image (if available)

This shot from Google Street View shows the road junction at Washingtonia Dr as of a couple years ago. The fire origin is just over the first visible ridge. An overhead Google Earth view from a few months ago also shows the rocks. It is not somewhere people are supposed to go. It looks to me as if the white object moved along the dirt road up to the street in the second image 5 seconds later. Calculated speed is about 12 mph. The object is not visible 28 seconds later in the third image. The dirt road junction is fan-shaped and it appears that the vehicle, if that's what it is, is turning left onto Washingtonia in the second image. That would be in the direction of Cocos Dr and the fire origin. I suspect the white object is a fire vehicle that had been observing the blaze from the dirt road. The fire inspector I showed the animation to will check. Other possibilities did not allow me much sleep last night. The reason I showed up at city hall right after it opened at 7:30 a.m. this morning was to make sure the fire inspectors had this image as soon as possible.

I asked the fire inspector how the fire engine in my first photo (it's located just outside the crops above) had been able to respond so quickly from the valley floor. He said he'd show me using one of my photos. He pointed to some wispy smoke above the ridge. Fire engines were already on the ridge responding to another fire on the far side. This must have been what the TV helicopter had spotted. So the Cocos fire had at least two origins. He said the cause of the fire was suspicious. I figured this was probably a great understatement. I didn't press him on details.



Mu-43 All-Pro
Nov 16, 2012
Real Name
I expect that they'll be asking for your RAW files next. If the investigation turns into anything, they'll need someone who can testify as an expert witness to say that the white object is really there, not an artifact of some sort. Let's hope the expert does as well as you've done!

Mind-boggling to think that a person could have started the fire deliberately.


Mu-43 Regular
May 9, 2014
I actually do a lot of this in my line of work and second the desire for the raw files. Im a LE detective but do alot of digital forensics too. It's amazing how few people on the job can't do this type of work. I could then make those changes in line with the what is needed for the invesigation. In the end though I take whatever I can get.

Sent from my SM-T520 using Tapatalk

barry13 Editor
Mar 7, 2014
Southern California
Real Name

For Chain-of-Custody purposes:

You need to create SHA or MD5 (SHA is better) checksums of all the RAW files, print the filenames and checksums and date/time of capture on a piece of paper, and sign & date it and put it in a safe place with a copy of the RAW files.
The FD or DA may need it if there is an arson investigation.

Links on this page may be to our affiliates. Sales through affiliate links may benefit this site.
Mu-43 is a fan site and not associated with Olympus, Panasonic, or other manufacturers mentioned on this site.
Forum post reactions by Twemoji:
Forum GIFs powered by GIPHY:
Copyright © Amin Forums, LLC
Top Bottom