ARCHIVE

Archive for the ‘Forensic Video Authentication’ Category

Laquan McDonald Police Video With Audio is Fake

Friday, December 4th, 2015

Dash cam video of the Laquan McDonald shooting was released by the Chicago police department. Although most dash camera video recordings include an audio track, this dash cam video did not include audio. In a heightened state of concern, concerned citizens believed that the audio portion of the video recording was intentionally deleted or altered.  Did the equipment malfunction or is there another reason why the audio portion of this incident was not recorded? In the meantime, a video of the same incident, allegedly with audio, was posted on YouTube. Concerned citizens believed that this video was genuine and included the missing audio. Primeau Forensics was asked to investigate the YouTube video and offer an opinion as to the authenticity of this second version of the dash cam video that included audio.

During our investigation of the YouTube video titled “Is this the audio? Chicago Police dashcam video of Laquan McDonald shooting”, we discovered several anomalies and inconsistencies that scientifically revealed the second YouTube video is a fake. Using Time Domain Analysis, Frequency Domain Analysis, and Critical Listening Skills we have outlined these anomalies and inconsistencies below.

Frequency Analysis:

Frequency_Analysis_Laquan Laquan McDonald Police Video With Audio is Fake

 

In the image above, the Spectrogram reading shows the cutoff frequency of the gunshots well above the cutoff frequency of the noise floor (background noise, radio chatter & siren). A display of the difference in frequency content between the gunshots and background noise is displayed in the image below. The gunshots are represented by the red vertical sections.

Frequency_Analysis_Laquan_2 Laquan McDonald Police Video With Audio is Fake

The cutoff frequency of the audio content from the YouTube video titled “Is this the audio? Chicago Police dashcam video of Laquan McDonald shooting” is around 16 kHz. This is displayed in the image below:

Frequency_Analysis_Laquan_3 Laquan McDonald Police Video With Audio is Fake

Based on my experience, audio recorded evidence produced from law enforcement vehicles contain a cutoff frequency of 4 kHz. I have examined the frequency analysis of the audio recorded in the original video ( the video with no audio- lack of radio communication & officer dialogue). The cutoff frequency analysis of the original audio portion of the video recording is 4 kHz and displayed below:

Frequency_Analysis_Laquan_4 Laquan McDonald Police Video With Audio is Fake

 

Based on my forensic testing and analysis, I can confidently say that the audio portion of this second YouTube video has been manufactured and added to the video after the original video was created. Why would anybody add audio to a video recording? In an attempt to deceive and make the video more powerful with a fake audio track. The video recording with the fake audio deceives the viewer. Although it appears to be real, it is indeed fake.

 

Frequency_Analysis_Laquan_5 Laquan McDonald Police Video With Audio is Fake

  • The original video released by Chicago Police contains recorded audio content of cross-talk, and alternator or engine noise (see above image). The noises that are audible within the original video recording are low in amplitude but can be heard with a significant increase in volume. Because this digital recorder in the police car recorded an audio track, it is my opinion that the digital video recorder was functional and had the ability to record sound. Because of the lack of officer dialogue and radio chatter, we believe the lack of these sounds was due to the following reasons:
  1. The on-person lavalier microphones within the vehicle were muted
  2. The on-person lavalier microphones within the vehicle were disconnected
  3. The on-person lavalier microphones within the vehicle were deactivated
  • The gunshots, and radio chatter heard throughout the YouTube video titled “Is this the audio? Chicago Police dashcam video of Laquan McDonald shooting” are duplicated, equalized and are not genuine or authentic. Previously in this blog I discussed the inconsistency between the cutoff frequency of the gunshots and cutoff frequency of the background noise within the audio content. In addition, the audible fingerprint of the gunshots within the Spectrogram has a distinct shape, size, and intensity that are consistent with duplication or repetition. The frequency decay of the gunshot, timbre or sound of the gunshot, as well as duration of the sound are almost identical. The gunshots are displayed in the image below:

Frequency_Analysis_Laquan_6 Laquan McDonald Police Video With Audio is Fake

The radio chatter sample at timecode 0:04.387 (MM:SS:MS) is an exact duplicate of the radio chatter sample 0:03.000 (MM:SS:MS). The conversation being spoken is identical. The difference between the two is that the duplicate has been processed using equalization to deceive the listener into believing it is additional radio conversation.

This video claiming to have genuine audio is indeed a fake. The Laquan McDonald Police Video With Audio is Fake.

Audio in Video Evidence

Wednesday, April 29th, 2015

Sound-analyse Audio in Video EvidenceWhen performing an audio and video authentication and analysis,a trained audio video forensic expert will utilize several methods in an attempt to detect an edit in a video recording that is used as evidence. Some of the time a critical ear can be just as important to a video forensic expert as the scientific community accepted software tools and an established chain of custody.

Though it is said that “A picture is worth a thousand words,” an audio file can be worth even more in a video forensic laboratory. A trained video forensic expert knows what to look for (or listen to) during a forensic video authentication and analysis investigation.

Many CCTV systems now have the capability to record audio, and this audio portion of the surveillance video recording can be crucial to the legitimacy of the digital video evidence. Audio is a great tool to investigate and detect an anomaly or edit when investigating a video recording. To do so there’s a process and protocol we follow at Primeau Forensics. 

Audio is comprised of “sound pressure waves,” which are waveform representative of the change in air pressure in a recording. One characteristic of sound pressure waves is that they are always smooth and continuous.

Let’s say, for example, you’re recording in an open, quiet room. While you’re recording, a rebellious teenager comes in the room and blows off his air-horn. Even though that loud sound completely changed the overall sound in the room, the wave that represents the pressure change will always be smooth and continuous.

The only time that a wave is not smooth and continuous is when an edit is made. Keeping this in mind will give you more of an idea of what you’re listening for.

When an edit is made to a recording, this disturbs the waveform. This makes it temporarily rigid and inconsistent. All sound pressure waves should be the opposite of that. So, when I am critically listening and hear a sound that is outside of that smooth, uninterrupted audio file, I know I have an anomaly that may be an edit.

How is that disturbance represented? Well, it will usually manifest itself in the form of a ‘pop’. In the context of video, it usually will only last a frame, but the sound will be there. If you hear anything that deviates from the already established waveform, you know that the evidence may have been edited.

Adobe and Izatope RX has software that allows a forensic experts to more accurately detect these edits. For example, a “spectrogram,” detects the “noise floor” in a recording. The spectrum recorded for a noise floor should be consistent in visual characteristics as long as nothing changes with the ambiance in a recording. When you see a deviation in that consistency, just as if you hear one in the dialogue, you can tell that the audio, and sub-sequentially the video, may have been altered.

There are many ways to detect edits visually when reviewing digital video evidence. Beginning with an established chain of custody and performing forensic video authentication and analysis will reveal integrity in your video recording or anomalies that reveal scientifically that the CCTV video recording may have been compromised and is unreliable.

Video as Evidence – The Importance of Video Authentication

Thursday, September 26th, 2013

video-authentication-1024x768 Video as Evidence - The Importance of Video AuthenticationLast week, I testified in court in a video authentication case. The report that I wrote for the case was admitted into evidence. My report revealed that a video had been altered and was not an original. I testified that my report revealed the scientific findings and my conclusion that the video recording was altered and not an original. Both conclusions were scientific and if I conducted the same test 1000 times over, I would arrive with the same conclusions. If any other forensic expert were to conduct the testing that I had documented in my work product and report, they would arrive at the same conclusion as well.

Lately, I authenticate all forms of video. Store CCTV, cell phone video and tablet video. We live in a video world! Anywhere you go out in public you are more than likely being video recorded. If you are riding a city bus, you are more than likely being video recorded. Some civilians have installed mobile CCTV systems in their cars just in case they need to defend themselves or catch a crime in progress.

The police originally installed cruiser video recording systems to first protect themselves and to also protect the citizens from prejudice. Cruiser video holds the police accountable by recording probable cause for traffic stops.

So why is video authentication important? As a video forensic expert, I often find that videos submitted into litigation are not an original as the person admitting has stated. Instead, they are copies that have been altered to only contain the events they want the Trier of fact to see. From a forensic perspective, this is not fair because the original video will contain all the events as they actually occurred. Some of the events that were omitted have relevance to the criminal or civil litigation.

Forensic experts have many tools to determine scientifically if a video is first, original and second, if a video has been altered. It is especially difficult with digital video to determine how a video was edited if it does not purport to contain the information or events either litigator states that it should contain. This is where forensic investigation becomes the only way to determine the video evidence authenticity.

If you believe a video has been edited, here are a couple things you can do personally to determine if your video may have been edited.

  1. First determine the file format on your DVD or CD Disc. Insert the disc into your computer, left click on the drive (more than likely it’s your ‘D’’ drive) and select open. Is the file format VOB or MP4, AVI, MOV? This format is actually the video container.
  2. Next, go back to the file folder, left click to open, find the video (it’s the largest file in that folder) and right click on the file. All the way at the drop down menu is the word ‘properties.’ Left click to open and review the MAC information. Modified, accessed and created information will reveal dates. Does the disc/CD created day read a date that the litigator who submitted the video stated the date created to be?
  3. The length of the video can also be a clue for your preliminary video authentication. Are there any phone records to compare to the length of the video? Does your memory of the series of events match the length of the video and video events?

Of course there are many more steps a video forensic expert will take in order to determine if your video is genuine and authentic. Even if there is no audio on your video recording, the audio track can also reveal information about the authenticity of your video recording.

If you have a question about video authentication, give us a call for a no cost telephone consultation 800.647.4281 or email PrimeauForensics@Gmail.com.

How To Tell If Video Is Edited

Tuesday, April 23rd, 2013

Consider that there are dozens of software programs available that are capable of altering and editing a digital video recording. An average person with some computer skills can easily edit a video and appear to be authentic.

These software programs use what is referred to as ‘open source’ video recordings.

For our purpose of discussing how to tell if a video is edited, there are two types of digital video recordings, ‘open source‘ and ‘proprietary‘. An opened source video recording can be easily transferred and altered. It can be modified to change the date and other properties. These types of ‘open source’ digital video recordings can also be played in universal media players like VLC, Windows Media Player Classic and Windows Media Player. File formats used in open source video recordings include AVI, MOV and MP4.

On the other hand, A ‘proprietary video recording is a recording created on a CCTV security video system designed to protect the video recording from altering and editing. The video recordings are in stored in armor car type of containers, often password protected to keep the video safe and free from modification. It is more difficult to edit proprietary video recordings. Proprietary video recordings must be played in a specific media player created by the company who created the CCTV video recorder. Examples of proprietary video players include L3, WatchGuard and Pelco to name a few.

All too often, video that is going to be used in the courtroom is suspect of tampering and editing. Because video is an extremely important medium, some litigators intentionally alter video before it is ever seen by prosecutors, lawyers, judges and juries. It is not always the intention of the person to deceive the litigators. Rather, their motivation is to edit a video recording to only show specific scenes as they occurred in an effort to save time. This is referred to as ‘Court Room Ready’ video evidence. Digital video recordings that are easily played in court.

The problem with court room ready video is the content that was removed. It may not be important now but it could become important in the future. In addition, other aspects of the video recording may have been accidentally altered

In our opinion, portions of video that are removed from a longer video recording compromises the integrity of the video recording. Unless an edited or altered video recording is approved and agreed on by both parties in a litigation, that altered recordings should be examined by a trained forensic examiner for forensic authentication testing and analysis.

A video forensic expert performs authentication testing and reports their findings in report form. A majority of these tests are performed by examining the meta data also known as the digital back door to a digital video recording.

 

 

 

The biggest problem from a video forensic expert’s perspective is that video that has been edited lacks integrity.

Lack of integrity is a deal breaker in court for many different forms of evidence and witnesses. For example, if a witness testifies and appears to lack integrity, the testimony  will serve of little value to the court. The same is true with video evidence integrity. It is extremely important to submit your entire original video recording into evidence, not just a portion of it.

Video forensic experts follow a series of action steps to determine if a full analysis or authentication investigation of a video recording, video tape, digital video file or DVD is possible.

Step #1: One of the first steps in the video authentication process is to understand how the video was recorded; what type of equipment was used? Smartphone video? Tablet video? Was it a CCTV surveillance video? A police dash-cam or body cam video?

Step #2: Determine if the video recording is original or a copy. By way of definition, an original video recording has been authenticated by a video forensic expert after performing a series of tests.

Step #3: Video Forensic Expert must critically view the video frame by frame looking for anomalies. This is done by playing the video evidence in whatever software or hardware is necessary to view the video.  Experts look for any video anomalies that cause concern or question scientific explanation as to why that anomaly is there.  Abrupt scene changes or repeated frames are closely examined by the video forensic expert.

To learn more about Video Authentication and Video Analysis click HERE!

If you have a video that you question or need help understanding, please give me a call for a pro bono conversation. I apply my forensic expertise to cases in the United States and many countries around the globe. Any and all formats of audio and video accepted. Retainer agreement available on request; travel expenses will be quoted in advance excluding meal expenses and flat rate time for travel instead of hourly.

Click HERE to email your questions or

Call 800-647-4281 in the USA or +01-248-853-4091 Internationally.

Edward Primeau’s Curriculum Vitae has several references which include cases he has testified in as well as clients he has worked for in these cases.

Virtual Chain of Custody for Video Forensics

Thursday, April 4th, 2013

chain-of-custody-1024x768 Virtual Chain of Custody for Video ForensicsTraditionally, a chain of custody is established between all parties – prosecution and defense, civil or criminal litigators – when handling forensic video evidence. Most of the time, the chain of custody process is easily established and agreed on when bringing in a forensic expert to authenticate or clarify and enhance the video evidence. This is a blog post about a new technology that is helping make this process easier and more convenient for all parties involved.

In an effort to provide good service while respecting the expectations of my clients, I have been using Cloud storage methods for sharing video evidence and work product.

Now that high speed Internet has hit critical mass it is easy and safe to share video forensic evidence over the Internet without violating the evidence integrity.

One network I have been using very successfully is to upload clarified video evidence to Vimeo using a password protected video post. Only the persons privy to the password can view the video. Of course, this practice is not acceptable in cases that involve children or pornography.

The link to the video post is then emailed to the client. The password is provided to the client in a separate email.

Once the forensic video process is complete the video evidence is then burned onto a CD or DVD Rom and returned to the client for the litigation proceeding.

Other virtual methods for safely transferring video evidence are Dropbox and YouSendIt.  As technology evolves, so does the forensic expert. Litigators are pleased with the convenience and forensic investigators are utilizing technological advancements to help speed up the forensic approval process.

Does My Video Have a Glitch?

Wednesday, February 8th, 2012

glitch-1024x768 Does My Video Have a Glitch?Does my video have a glitch?

I got a call recently from an attorney who had a VHS tape recording of a traffic stop.  The attorney asked if I could determine if the tape had been altered. He went on to describe what his client thought was a glitch. I understand the attorney’s dilemma. On one hand his client who just gave him a retainer said there was a glitch and on the other hand, why on earth would the police officer risk his career, pension and reputation in the community to alter a segment of video?

I have worked on forensic video cases where there was an alteration in a video and others where they had not been any alteration. I have worked for the good guys as well as the bad guys. Every video forensic case I accept and am retained for is different. Some video can be confirmed as original and other video footage can be confirmed as a copy. This is an important aspect to authenticating video evidence.  If you believe that your video has been altered then you are entitled to examination of the original.

What is an original digital video?

In my opinion, an original digital video is stored on the hard drive of the system that created the video. Once the video in question has been moved from the DVR (digital video recorder) it could be argued that it is no longer an original.  There are some exceptions that vary from state to state. If the video that is to be the original is agreed an “original” by all parties to the litigation then the video is indeed an original.

If there is a “glitch” in the video, as a forensic expert I would want to examine the original digital video source file (ODVSF). That is the file that the CCTV DVR made when the camera (s) were being recorded; the purpose; to see if the same glitch is in that original digital video source file. If the glitch or anomaly is not in the ODVSF it becomes very important to the case as to why the file is different.

One out of ten

A lack of complete digital video evidence, which is similar to a glitch, is a problem.  I worked on a slip and fall case where the property owners did not provide the entire CCTV system showing the entire fall.  Instead, the victim was given only one camera view out of ten available cameras. The owners tried to tell us that was the only camera view of the incident.  Then when I requested a camera grid of the CCTV system (map showing where each camera was located) we discovered that the original CCTV digital video recording had been deleted. This is a pretty big glitch: the glitch that goes UNseen, a reverse glitch.

So the next time you believe your video has a glitch, seek the help of a forensic expert who is a neutral unbiased third party that can form a professional opinion about the video recording used in your litigation.

 

 

photo credit: vertscape2-double10 via photopin (license)

 

Original Digital Media Evidence is Mandatory

Saturday, February 5th, 2011

913643_25477244 Original Digital Media Evidence is MandatoryDigital audio and video is recorded and stored in electronic equipment. If the audio or video is needed in court, the original device that created the recording must be identified and kept in a chain of custody. The only exception is when both parties involved in the litigation agree that a copy is sufficient. If there is doubt in the authenticity, the audio expert must refer to the original to support the authentication of the audio evidence.

The reason is that the audio or video copy has been removed from its original environment and is vulnerable to alteration. In addition, if a computer created the original recording, additional information can be examined by the audio expert such as file creation, last accessed and other computer forensic information that can support the audio evidence authenticity.

If the original audio recording was created in a digital pocket recorder (which many law enforcement officials use) then that original pocket recorder must maintain a chain of custody and become the original evidence. Any external copy created by a number of methods and played outside of the digital pocket recorder is a copy. Unless an audio expert can authenticate the copy (which can be done once the original has been examined) it cannot be used in a court proceeding. If the audio copy has been authenticated by an expert, than it will be easier to play and amplify in the court for a judge and jury.

I have testified in criminal cases for the defense when the client swore under oath that the audio recording had been altered and did not represent the facts as they occurred. Now it’s their word against the other side and when the court has to decide, the prosecution most always, will prevail.

If you have had an experience with Audio/Video evidence and would like to share your story, please comment on this post and your story will be heard.

800-647-4281

Video Forensic Expert Edward J Primeau Curriculum Vitae

download-cv