Can you recover original data from a screenshot that has been 'blacked out'?

  • Is there a threat from screenshots with blacked out info? That is can someone take out that aftermarket addition so to speak?

    For instance

    I take a screenshot (using MS snipper) enter image description here


    Then I 'blur/blackout' some info enter image description here

    Is the picture above vulnerable to someone looking through its hex values for that extra green layer and just removing it, thus reconstructing the original image (or any other way to 'take off' my attempt of redacting info)?


    To make it more secure I always then open up the blurred out screen and then screen capture that. enter image description here

    Does the above screen of a screen add better security -there is no way to reconstruct missing data because nothing is "missing"?


    I have always been paranoid but after finding out a colleague does the same thing, I'd thought I'd ask.


    update So I compared pics one and two (from above) and looked at the hex values, the metadata had not changed at all and the only change was within the image data itself (results below). The results are specific to this particular editor and process. The possibility (likelihood) does exist for data to be recovered if using other tools. enter image description here

    I don't have a proper answer, more of a stimulus for an actual answer. If I remember correctly some image formats such as JPEG and PNG keep thumbnails of themselves. So depending on the format and view size, the original version of the image will be shown. Usually the quality is too low to actually read something there, but you get the drift. I believe they discuss the topic here: https://security.stackexchange.com/questions/116552/the-history-of-thumbnails-or-just-a-previous-thumbnail-is-embedded-in-an-image

  • Philipp

    Philipp Correct answer

    7 years ago

    Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost.

    However, the PNG format supports storage of an unlimited amount of metadata which is usually not displayed by image viewers. This feature is often used by image editors to add additional metadata to the image. One possible use-case is to store the undo-history of the image. This could mean that the previous version can be restored. To prevent this, make sure to set the exporting settings of your editor in a "export for web" mode which is supposed to strip all unnecessary data from the file. How to do this (and if it is even necessary) depends on the image editor.

    Another possible faux-pas is to use an image blurring method which isn't 100% effective. You could, for example, accidentally set the opacity of your brush to almost but not completely 100%, which would mean that the section isn't recognizable by the human eye but might be made readable again by enhancing the contrast of the section. Another mistake is to use a filter which is reversible. I remember a case of a child-pornographer who got caught because he blurred out his own face with the "twirl" filter in Photoshop not realizing that when the same filter is applied in reverse, the image is restored to almost the original.

    Interesting. Are there any documented cases of tools doing this? I would suspect they don't because that would rapidly add up to an immense amount of data.

    Exactly what I suspected but havent been able to prove (yet)! I want to find the time to analyze it but thought I'd ask here first to see if it's been done and already well documented...

    @Xander I had this with GIMP once. One image viewer (I think it was IrfanView) used to show an older version of one of my images because it was accidentally reading an old version GIMP saved as metadata. However, this was years ago and I didn't really research it further.

    The most common metadata case is when an image includes both a thumbnail/preview version and a full-sized version. Editors don't always update the thumbnail version.

    @Mark, that's a good point about the thumbnail data although the amount of 'readable' data that could be recovered from the thumbnail does largely depend on what you are trying to recover in the first place...

    @Philipp The mister swirl image is no longer available. Can you link to a picture with similar effect?

    I believe this article shows the mentioned image with the swirl effect: https://thelede.blogs.nytimes.com/2007/10/08/interpol-untwirls-a-suspected-pedophile/

License under CC-BY-SA with attribution


Content dated before 7/24/2021 11:53 AM

Tags used