Tutorial: ICC+

How your computer renders colors directly impacts what an analyst sees. The image file (JPEG, PNG, etc.) stores one set of colors. However, these colors may be automatically shifted by the application and operating system that you use to view the picture.

Different monitors, printers, applications, and operating systems can generate slightly different colors. The easiest way to visualize this is to walk into an electronics store and look at the wall of TVs for sale. Even if every TV displays the same show, the colors will all be a little different. Blue on one TV will be vibrant, while the same blue on another TV may be dull or even a little purplish.

Applications can adjust for these color differences. The adjustment helps mitigate the visual differences between different displays. This way, blue on your screen will look like blue on my screen and even a similar blue when printed.

The most common adjustment method uses color profiles. These define different ways to shift the colors before displaying them. In addition, applications or operating systems may perform their own color adjustments.

Forensic Analysis

For forensic picture analysis, color profiles and automatic adjustments are typically not applied. This prevents alterations made by a color profile from altering data prior to analysis. However, an analyst must be aware that the post-analysis colors displayed by the monitor may be altered by a color management system on the analyst's computer. This color adjustment usually do not change the analysis results, but may make pictures appear visually different when seen side-by-side on different displays.

In general, pictures that come directly from a digital camera will not contain any applied color profiles. However, there are a few exceptions. (E.g., iPhones usually embed an iPhone-specific color profile.) In contrast, some applications (e.g., Adobe Photoshop) and services (e.g., Facebook) routinely apply color profiles to images prior to saving the image content.

Color profiles that are embedded in pictures explicitly modify colors: they may obscure, remove, or over emphasize minor differences. Applying a color profile could negatively impact the forensic analysis results. A picture saved by an application that applied a color profile will shift the color ranges and could be detected as an alteration.

ICC Color Profiles

There are different approaches for shifting a picture's color. The International Color Consortium (ICC) defined a color profile system that adjusts the rendered colors in order to minimize any variations. When used properly, colors will look as close as possible regardless of the display. An ICC Profile may be embedded in the image file as metadata, applied by an application, or associated with a monitor.

A color management system (CMS) interprets the ICC color profile. Different operating systems use different CMS implementations. For example:

• LittleCMS and Argyll CMS are both common for Linux, Android, and open source projects.
• Apple and Microsoft operating systems include proprietary CMS solutions. Users can use the CMS system to adjust the colors for their specific computer monitor. These operating systems apply color adjustments to the entire display, regardless of the application.
• Adobe includes a proprietary CMS that adjusts colors within the Adobe application. This applies to Photoshop, Lightroom, and other Adobe software packages..

Different CMS implementations (including different CMS versions), may render colors slightly differently.

Colors and Gamut

The electromagnetic (EM) spectrum contains a wide range of frequencies. Human eyes are sensitive to a narrow frequency range, called the visible spectrum Just outside of the visible spectrum are the color ranges used by infrared and ultraviolet. Graphing the visible spectrum results in a horseshoe-shaped region of colors.

While our eyes are sensitive to a range of colors, light-emitting devices (everything from light bulbs to computer monitors and TV screens) typically generate a slightly different range. Even non-emitting media, such as a printout on paper, only reflects certain wavelengths. The colors on glossy white paper often look different than the same colors on a matte canvas. The range of colors available from a device or media is the gamut.

Similar to how glasses correct your vision, color profiles correct the displayed colors. Color profiles are used by software to shift the color range. Different profiles map into different ranges.

• sRGB: The ICC's standard RGB profile (sRGB) encompasses a subset of the visible range. If no color profile is defined, then sRGB is typically used. However, the International Color Consortium is not the only standardized group that has defined a default RGB profile.
• Adobe RGB: Adobe created their own color profiles that span a wider range gamut than sRGB.
• ProPhoto RGB: This color profile was developed by Kodak and uses a very wide gamut that extends beyond the visible range.
• Display P3: Apple provides a standard called "Display P3" that is based on a standard for cinemas and theaters. Pictures from iPhones and iPads often include a "Display P3" color profile.
• Printers: Color printers by Brother, Canon, Epson, and many others each include their own color profiles. There is often a distinct color profile per printer model. (Epson has over 650 color profiles indended for their inkjet printer models and various paper types.)

There are literally hundreds of well-defined color profiles. In addition, users often calibrate their monitors, resulting in unique color profiles per computer setup.

Applying Profiles

The International Color Consortium standardized the method for representing different color profiles. The two common versions of the ICC Profile format are version 2 and version 4.

• Version 2 uses complex matrices with tone reproduction curves to transform the color space.
• Version 4 uses pre-computed look-up tables.

A single ICC Profile may contain multiple definitions, such as v2, v4, or both, and different rendering option. The rendering program can choose which definition to apply.

Color profiles are applied in pairs. The first profile converts the picture from RGB to a common color space, such as XYZ or L*a*b. The second profile converts the common color space for use with the output device (typically RGB for a monitor or CMYK for a color printer). If no profile is provided, then the standard RGB colorspace (sRGB) is used.

Any profile embedded in a JPEG, PNG, or other image file is treated as an input profile. Your operating system will supply the output profile for your computer monitor or printer.

Some profiles are intended as only-input profiles or only-output profiles, while others can be used as either input or outputs. For example, the color profile for the Epson Inkjet PM980C color printer is intended as an output profile, while the sRGB profile can be an input or output. Unfortunately, the ICC Profile format does not make a distinction between input and output usage. As a result, you may occasionally find applications that incorrectly attach an output profile to a JPEG or PNG. This would incorrectly apply the output profile as if it were an input profile, resulting in incorrect coloring.


Most applications will apply color profiles when they are present, and assume sRGB (no color changes) when they are undefined. However, some graphic applications, including Adobe Photoshop and Gimp, will give you conversion options:

• Discard: The existing color profile is removed and sRGB is used instead.
• Keep: The existing color profile is retained.
• Convert: Colors are remapped from the existing color profile to the graphic program's desired color space. This often has a side-effect of making bright colors appear brighter and dark colors appear darker.

Sample Profiles

When Adobe applications load a picture that does not have a color profile, Adobe automatically applies a color profile. The colors you see when using an Adobe product are slightly different than the same colors that everyone else sees. This difference can sometimes impact the interpretation. (Are you missing something because of Adobe's color alteration, or seeing something that doesn't really exist in the picture?)

Click on each of profile type to adjust the colors in the sample image. Each time, you should see the colors change a little. Original (no profile) Adobe Epson Inkjet PM980C, Perceptual Epson Inkjet PM980C, Relative Epson Inkjet PM980C, Saturation Epson Inkjet PM980C, Absolute Four of these sample color profiles are for an Epson Inkjet PM980C printer using glossy paper. While these printer profiles may look odd on the computer screen, they should look similar to the original picture when printed on the expected printer with the expected paper.

Other Color Management Options

In general, the ICC Profile version 2 (ICCv2) is the most common management format. Version 4 (ICCv4) is a distant second. However, ICC Profiles are not the only color management options. Moreover, ICC Profiles have multiple ways that they can be applied.

ICC Profile Intents

Because color ranges (the gamut) for one device may not map perfectly into another device, ICC Profiles typically include four different mapping options.

Intent Name	Purpose
Perceptual	If colors from one device do not map perfectly into another device, then the color space is shrunk to fit the available range. This may cause colors to shift a little, but it preserves the visual relationship between colors. This is typically used for monitors and video displays.
Relative	When colors from the source gamut do not map into the destination gamut, the white point (white intensity) is mapped from the source to destination device and the other colors are scaled accordingly. This mapping is common for printers.
Saturation	When colors from the source gamut do not map into the destination gamut, the relative saturation (color intensity) is retained. This mapping is best used for limited color images, such as clipart and logos.
Absolute	The white point and black points, which identify the intensities for the extreme white and black colors, are not adjusted. When colors from the source gamut do not map into the destination gamut, important colors for the output device are retained. For example, if a printer uses cyan, magenta, and yellow inks, then the color profile will attempt to maintain colors best suited for these specific ink colors. This rendering intent is typically used to emulate a commercial printing press.

Each of these rendering intents may display the picture differently on a computer monitor. By following the International Color Consortium standard, a picture can be properly colorized for rendering on the desired medium.

However, there's a problem: most users haven't read the ICC standards. Many users treat the ICC Profile as a quick way to adjust an image's colors. Just as they would arbitrarily apply color balancing or a gamma correction, they might flip through the available color profiles and rendering intents until they find one they like.

Similarly, some applications apply the color profile incorrectly. For example, Google has an Android programming library called 'Skia' that may be used by apps. Skia typically applies a color profile with the relative intent, even though relative is intended for printing and not displays.

The net result is that a picture may have an embedded color profile with the wrong selected intent. Even though the picture may have the intent set to 'relative', you cannot assume that the picture was intended for printing. Similarly, some pictures have profiles set for 'saturation', even though the image not clipart or a logo. An analyst cannot determine the human's purpose for applying the color profile based on the profile's rendering intent.

Microsoft ICC Extension

Microsoft developed their own proprietary ICC Profile extension. While very uncommon, this color profile management is only supported by some Microsoft applications.

Apple ICC Extension

Apple developed their own set of color corrections that extend the ICC Profile. When present, these ICC extensions are only used by some Apple applications.

Typically, the impact from Apple's ICC extensions will look very similar to ICCv2. However, Apple's color corrections often make the colors appear a little different.

PNG Color Corrections

The PNG file format supports definitions for gamma corrections, white point selection, and chromaticity (the three main components for any color normalization system). However, not every application supports PNG color corrections and some applications only provide partial support (e.g., supports gamma but not chromaticity). Moreover, there can be a prioritization conflict if the file contains both PNG color corrections and ICC Profile information.

BMP Color Corrections

The BMP bitmap file format includes a few different version.

• The original BMPv1, BMPv2, and BMPv3 formats did not support any color correction.
• Beginning with Windows 95 (BMPv4 and later; 1995), the BMP header introduced support for BMP-specific gamma and chromaticity correction values. While the BMP header includes space for defining these values, they are virtually never encounted.
• BMPv5 (circa 2005) added support for an embedded ICC Profile. While rarely present, it is more common than the BMP-specific color correction information.

Formats with Limited Options

Most modern image formats natively support the inclusion of an ICC color profile. This includes JPEG, JPEG2000, WebP, HEIC, and AVIF. PNG files support both ICC Profiles and PNG-specific color correction options. However, older file formats either partially support or do not support any color correction options.

• GIF: The GIF specification (1989) does not define support for any kind of color correction. However in 2007, an application extension block called "ICCRGBG1012" was defined by the International Color Consortium for stuffing an ICC Profile into a GIF image. The GIF support only permits RGB color profiles, and not CMYK or other color spaces. Very few applications support color profiles that are embedded in GIF images.
• PPM, PGM, XBM, etc.: Raw bitmap image formats do not provide any support for embedded color corrections.

Using the ICC+ Analyzer

The ICC+ analyzer lists information related to any ICC Profile that is embedded in the picture. (If a picture has no embedded ICC Profile, then no profile information is listed.) Below the text is the image as rendered under different conditions.

• If there is no embedded ICC Profile, then you will see two entries: No Profile and Adobe. The Adobe option shows how the picture appears when loaded into an Adobe product, such as Photoshop or Lightroom.
• If there is an embedded ICC Profile, then you will see how the picture appears under each of the ICC Profile's rendering options.
• If there are any format specific rendering options, then each is listed.

Moving your mouse over the small version will change the larger version on the right. Moving the mouse over the larger version will toggle between No Profile and the displayed profile's rendering.

Sample Analysis

Subtle Differences

The various color rendering are often subtle.

• Some profiles (typically with "sRGB" in the descriptions) are designed to not change any colors.
• Some profiles are not supposed to change any colors, but might alter a few colors by a small amount. For example, "sRGB IEC61966-2.1" is a common standard color profile. It doesn't change anything except for very bright cyan colors. (If your pictures doesn't have bright cyan colors, then there will be no change.
• Different profile settings may generate identical results. These are denoted noted as being the same as another profile setting.

Most adjustments impacts shadows, reds, and blues. If you don't see the difference, then take a very close look while toggling back and forth. Some devices, such as mobile devices and some laptops, have limited color ranges for their displays; subtle changes may not be visible due to the display.

Testing Color Profile Support

Some web browsers fully support ICC Profiles and adjust pictures that are displayed. Other browsers support ICC version 2 but not version 4, and many browsers do not support any color profiles. In addition, support for other color management systems, such as PNG color support and Microsoft's proprietary color correction information, are dependent on the specific application.

There are different custom pictures for testing ICC Profile support. The International Color Consortium provides a test photo that is divided into four JPEG pictures, each with a different ICC profile. The Little Color Management System provides an alternate test picture.

In each case, test pictures include a sample image as with a color profile that dramatically changes the colors based on the applied profile parameters. Rather than normalizing the color space, test profiles intentionally push colors to opposite ends of the spectrum. This allows a user to quickly determine if the application supports ICCv2, ICCv4, or no profile management.

FotoForensics uses a test picture that shows three colored eggs (courtesy of Hacker Factor). This one picture includes a variety of color profile settings, and not every setting is supported by every CMS library. Depending on the level of color profile support, the eggs will appear with different colors.

		This is the test picture. The colors you see right now are dependent on your viewing application's support. (Right now, that's your web browser.) Compare this image with the samples below to determine your web browser's level of support.
No profile		This is what the picture looks like when there is no color profile support. From front to back, the colors are cyan, reddish-orange, and green. This is typical for mobile devices and older Firefox (desktop versions 40 to 59) web browsers.
ICCv2		If your browser supports ICC Profile version 2 (ICCv2), then the colors from front to back are cyan, red, and blue. The background should be a very pale blue. This is how the picture appears on older Chrome (before version 70), older Firefox (before version 40), later Firefox (version 70 and later), and Safari (MacOS 10.14 and later) web browsers. Browsers that use a newer version of the ICCv2 rendering engine may show the picture with a white background.
ICCv4		Applications with ICC Profile version 4 support (ICCv4) will show a metallic purple, neon green, and a metallic blue. This includes some versions of the Opera web browser. Microsoft's Internet Explorer and Edge browsers also supports ICCv4, but will appear different with this test image (see PNG Gamma + Chromaticities).
Apple CMS			Apple provides their own color management system. Prior to MacOS 10.14, Apple's CMS was faulty; it did not properly render colors and did not support the full ICCv2 and ICCv4 standards. With the Safari web browser, the test image colors are cyan, red, and bluish purple eggs on a white background. Around MacOS 10.14, Apple revised their CMS system. The colors appear more like ICCv2 with the faint blue background.
Adobe 'kept' and Chrome			Adobe Photoshop permits users to keep the existing color profile, convert it to the Adobe color space, or discard the profile. Discarding will appear as the 'no profile' image: cyan, orange, and green. Selecting Adobe's 'keep' option will display a light pink background. The eggs will be dark purple, bright green, and either a dark blue or pale blue egg. The blue egg's color depends on your OS and Adobe software version. Chrome (versions 70 and later) also render colors using this method.
Adobe 'converted'			Using Adobe Photoshop and converting to the Adobe color space will show dark purple, yellowish-green, and faint blue. Visually, it is similar to Adobe 'kept', but the green egg is more yellowish and the dark end of the purple egg is darker. Depending on your OS and software version, the background may be pink or white.
Microsoft Extension		Microsoft applications typically support ICCv4, so the test image will normally display the metallic purple, green, and blue colors. However, Microsoft also supports their own proprietary ICC Profile extension (that is almost never encountered online). The test egg picture includes this proprietary extension. When viewed using Microsoft Photo Viewer, the eggs will appear yellow, blue, and green.
PNG Gamma-only		PNG files may include their own alternative method for adjusting the color. Some applications only support the PNG gamma correction. This will make the test picture appear cyan, orange, and light-green. This is how the test image appears under Apple's Quicktime player and Mobile Chrome for Android.
PNG Gamma + Chromaticities		Applications that support PNG gamma and chromaticities will display purple, green, and orange. This includes Microsoft's Internet Explorer. (If this picture were a JPEG or lacked the PNG corrections, then IE would apply the ICCv4 profile.)

This is not a comprehensive list of all possible color outcomes. The shades, intensities, and backgrounds can vary based on the CMS library and version. For example, the output from Little CMS 2.12 (Feb 2021) is a little different from version 2.3 (Dec 2011). In general, the primary egg colors should remain the same, even if the specific shadings vary a little.

This test image is one picture that uses an extreme color profile definition. In this extreme example, each color profile setting explicitly shoves colors in extreme directions. With most color profiles, any color differences will be minimal. However, the differences can be enough to make some colors a little more vivid and others less distinct. For this reason, the same pictures may look different based on the analyst's tools.

Most CMS libraries will fall back to the nearest supported format. For example, if the library supports ICCv4, then it will use ICCv4. Otherwise, it will try ICCv2. And if ICCv2 is not supported, then it will discard all color profile information. Microsoft is an extreme case; it will check in the following order: PNG Gamma + Chromaticities, Microsoft Extension, ICCv4, ICCv2, and none. The first supported color correction system that Microsoft matches will be used, and different Microsoft applications support different color profile methods.

Applied Color Profiles

Very few cameras attach color profiles by default. (The notable exceptions are iOS devices like the iPhone and iPad running iOS 7 or later, and some Android devices with HDR enabled.) In general, color profiles are created and applied by applications and explicitly denote a color alteration.

Some web services automatically apply color profiles. This includes Facebook and Corbis stock photos. Pictures downloaded from these web services will include the service's default color profile.

A few applications automatically apply color profiles. Adobe applies a color profile even when no color profile is stored with the file. A picture saved by an Adobe product will have a slight color shift even if no other intentional edits were performed. Similarly, Paint.net and Photo for the Mac apply color profiles.

While many graphical applications support ICC Profiles, most do not automatically apply or attach the profiles. In general, if a picture includes an ICC Profile, then it was either (A) from a mobile Apple device running iOS 7 or later, (B) an Android 6.x or later device with HDR enabled, or (C) applied by a graphical application.

Color Profiles and Forensics

For forensic analysis, FotoForensics intentionally renders images without applying any color profile in order to prevent additional alterations. Regardless of your web browser, the algorithms at FotoForensics will always evaluate the image without applying the color profile.

The ICC+ analyzer shows information about any attached color profile and applies the profile to the image. It also allows you to see what the picture will look like under other applications, such as Adobe products.

Image Rendering Quirks

With most image formats, there are a wide range of decoding libraries. Some of these libraries have interesting implementation differences. These library differences may not be limited to the picture's color; some differences may also alter the content.

Quirk: Apple and Parallel PNG Decoding

Apple provides their own PNG decoder that supports parallel decoding. While one processing thread decodes the first half of the picture, a second thread decodes the second half of the image. In order to perform this parallel decoding, Apple makes an assumption that the compressed stream can be cleanly split in half.

In December 2021, researcher David Buchanan realized that a PNG could be specially crafted such that it is not cleanly split in half. For this type of custom PNG file, single-threaded PNG libraries consistently display one image. However, Apple's PNG library uses two threads and renders a different image.

The following sample image was created by David Buchanan and demonstrates this decoding difference. Most PNG libraries will render the picture of an IBM PC, but Apple will render a picture of a Mac.

Single-threaded decoding

Apple parallel decoding

The horizontal lines in this sample are a side-effect of the compressed stream alteration. One or more of these lines will always be present when this steganographic technique is used.