Digital video forensics: Testing and authentication of video evidence.

Video is powerful evidence. But it is also vulnerable to content modifications. A video forensic analyst uses tools and techniques to test for these modifications. The term for this  integrity verification process is called multimedia authentication. This is a crucial step to having the video considered as acceptable evidence and should only be performed by an certified Audio Video Forensic Analyst. This will ensure the necessary testing is performed correctly using industry standards and best practices. Interpretation of the test results is crucial and requires many years of experience working with multimedia files.

Multimedia Authentication Report Example

File Authentication: Establishing trustworthiness of digital video.

If surveillance video is to be used as evidence it is crucial the content displayed is a factual representation of the events depicted at the time of the recording. Subtle changes, whether accidental or deliberate, can have a significant impact on how the footage is interpreted. A Certified Forensic Video Analyst is often relied upon by the trier of fact that content of a video is authentic.

During authentication testing the video forensic analyst seeks the answer to two questions:
Was the video captured by the device claimed?
Does the video still portray its original content?

Imaging Ballistics: Exploiting hardware imperfections.

Through science it is possible to determine if a given camera recorded the images being scrutinized. This is important when the source of the video or picture is the evidence itself.  This pertains to scenarios where the ownership of the acquisition device is incriminating.

Source Camera Identification is the term for the techniques used to identify the acquisition device. These include metadata and hex data analysis and exploiting unique hardware imperfections. Metadata and hex data provides insight to device identification. But since it is susceptible to manipulation their information is not reliable.

The same way a forensic scientist can link bullets to a specific gun a video forensic analyst can match images to a specific camera. One of the ways is by Photo Response Non-Uniformity (PRNU) noise. PRNU is a specific type of noise introduced by the cameras imaging sensor. This noise pattern is unique to each sensor. This pattern is invisible to the eye. But to the video expert It is the digital fingerprint of the camera found hidden in every image that the camera captured.

Unintentional Video Modifications

Modifications to digital video is easy to do. Often these modifications are unintentional. These changes to the original file can alter the perception of the content. Changes can be introduced when trans-coding  video from one format to another. Usually this is so the video will play using the installed software on a given computer. The most common unintentional modification is frame rate conversion errors.  Frame rate, expressed in frames per second (FPS), is the frequency at which consecutive individual frames appear when viewed.  A change to frame rate can have a dramatic effect of content perception.

In a recent case hidden nanny-cam footage was the evidence against a caregiver. The video was converted from its native format for easier playback. During the conversion the frame rate was changed from the original FPS. The frame rate change made the actions of the caregivers appear to be quicker and thus much more violent. Based on the video the caregiver was charged with criminal abuse of a minor. A Video Forensic Analyst reviewed the footage and discovered the frame rate discrepancy. His analysis of the frame rate conversion was instrumental in the caregivers exoneration.

Deliberate Video Modifications.

Deliberate modifications are malicious changes to content. The remaining images depicted are no longer a factual representation of the event. These modifications to content can be subtle. For example cropping the edges of a video to exclude persons or objects. Another example are edits to the video's timeline. These edits can exclude content or alter the order in which events occurred. A Certified Audio Video Analyst can determine if the video is authentic.

Tampering Detection and Media Authentication.

Digital media tampering is the deliberate alteration of content. It's purpose is to conceal an object, person or the circumstances conveyed by the imagery. Today powerful editing software is available to everyone. Content manipulation is an easy endeavor for a motivated individual.

Dr. Edmond Locard was a French criminologist and a pioneer in forensic science.  He formulated the basic principle of forensic science: "Every contact leaves a trace".  This became known as Locard's exchange principle. Altered video leaves behind trace evidence. This basic principle of trace evidence is the forensic video analyst best friend.

Digital fingerprints left behind.

Forensic video experts have established peer approved procedures for testing digital media files.The Multimedia Authentication Testing Guideline (MAT) outlines these specific tests. The forensic expert uses these tests to reveal the changes to a media file since its creation. By design it reveals the digital fingerprints left behind in an altered video. The MAT guideline result in a high probability modifications will not go undetected.

Tamper Detection . Revealing the hidden trace evidence.

Oswald - Ruby shooting | Original Image / ELA Results

The image on the left is a very famous scan of a digital photo. It captured the moment Jack Ruby fatally shot Lee Harvey Oswald.  The image below is an altered version of the image that has been floating around the Internet for some time. The manipulation  may go unnoticed to anyone not familiar with this famous image. However the forensic analyst can reveal the trace evidence left behind.

Oswald - Ruby shooting | Tampered Image / ELA Results

Error Level Analysis (ELA)

Error Level Analysis (ELA)  detects certain anomalies in a digital file. The two photos show the tested image and the ELA results. The original unaltered image's ELA pattern has a uniform appearance. In the altered image there are regions of bright pixels. These bright pixels coincide with the areas of manipulation. To a forensic analyst these pixel patterns indicate a strong probability of tampering . More testing would confirm that hypothesis.

Video Error Level Analysis (VELA)

Error Level Analysis testing applies to video files as well. The procedure is Video Error Level Analysis or VELA. Both ELA and VELA testing leverages lossy codec compression. Lossy compression produces quantization errors. These errors should be uniform across a saved image. But the altered area has been saved one time less than the original image. This results in differences that reveal the changes to content.

The Forensic Video Analyst toolbox: The software used by forensic video experts.

In a modern video forensic lab the analyst has access to many programs. Some software is specifically designed for forensic video enhancement and analysis. Programs such as Amped 5 or Cognitech are  found in many video forensic labs. Depending on the procedure required the analyst may also use commercially available software. These include Adobe Premier Pro and DaVinci Resolve. These programs offer many filters helpful to video enhancement. However these programs do not have any built in auditing reporting. It is crucial the Forensic Video Analyst document the entire enhancement process. These include the applied filters and their specific settings used during the enhancement procedure.

VideoCleaner is a powerful forensic video enhancement program. It includes dozens of filters to clarify both image and video files. VideoCleaner can test for evidence of image tampering and deliberate manipulation. The program is peer reviewed, open source and has built n auditing capabilities for repeatable results.

No matter which software and procedure are utilized It is vital the forensic video analyst be sure his methodology only increases the view-ability of details that have been captured in the original recording. A soft touch is the term a forensic analyst uses to describe the correct approach in forensic video enhancement.

The Audio-Video Forensic Analyst and digital evidence.

Audio and video are powerful evidence. The legal classification of video and audio is demonstrative evidence. It is compelling and often can be the deciding factor in a case. The courts determine the admissibility of evidence and the specifics can vary. However, there are certain criteria used in all jurisdictions.

To have your audio or video entered as evidence the court must know the origin of the file. It must know the file is genuine. It must know that the audio or video file has not been altered to misrepresent the content depicted.  The legal term for determining these factors is file authentication.  

An Audio-Video Forensic Analyst (AVFA) can authenticate your digital evidence.

Audio-video forensic analyst and expert testimony.

An AVFA is often called upon for expert testimony. In addition to authentication the AVFA provides media enhancement, testing and measurement analysis. During any of these procedures it is vital the analyst maintains the integrity of the file. Enhancements should only improve acuity so it is easier for the trier of fact to understand. Testing and measurement analysis must be established in proven science. The analyst must explain his findings in a way that is easy to understand by both the jury and the judge.

One of the the most important parts of the analyst job is to listen to the hiring attorney. It is vital the analyst has a clear understanding of the attorneys expectations. An attorney is an expert at law and is relying upon our expertise in audio-video enhancement. The analyst must ask for clarification on any aspect of his role that is unclear. Knowing what to ask the attorney comes from experience and reduces unforeseen surprises. Communication between the attorney and the AVFA are key to favorable trial outcomes.  

Although every file is unique there are factors common to all audio-video forensic enhancements.

• Maintain and document a chain of custody of the files.
• Make a duplicate of the file to be analyzed so the original is preserved.
• Review the file and establish what enhancements if any are required.
• Use a soft approach to only enhance what is required to reveal the details.
• Use peer reviewed software and procedures to perform the enhancements.
• Document  the enhancements that were applied so the results are repeatable.
• Document the methodology used to determine what procedures were necessary.
• Be able to convey in an easily understandable manner what was done and why.

Expert services include:

• Video and audio enhancement and analysis
• Analysis reports including findings, procedures and methodology
• Notarized affidavits detailing enhancement procedures
• Depositions
• Named expert testimony