ARCHIVE

Archive for the ‘Forensic Video Authentication’ Category

Laquan McDonald Police Video With Audio is Fake

Friday, December 4th, 2015

Dash cam video of the Laquan McDonald shooting was released by the Chicago police department. Although most dash camera video recordings include an audio track, this dash cam video did not include audio. In a heightened state of concern, concerned citizens believed that the audio portion of the video recording was intentionally deleted or altered.  Did the equipment malfunction or is there another reason why the audio portion of this incident was not recorded? In the meantime, a video of the same incident, allegedly with audio, was posted on YouTube. Concerned citizens believed that this video was genuine and included the missing audio. Primeau Forensics was asked to investigate the YouTube video and offer an opinion as to the authenticity of this second version of the dash cam video that included audio.

During our investigation of the YouTube video titled “Is this the audio? Chicago Police dashcam video of Laquan McDonald shooting”, we discovered several anomalies and inconsistencies that scientifically revealed the second YouTube video is a fake. Using Time Domain Analysis, Frequency Domain Analysis, and Critical Listening Skills we have outlined these anomalies and inconsistencies below.

Frequency Analysis:

Frequency_Analysis_Laquan Laquan McDonald Police Video With Audio is Fake

 

In the image above, the Spectrogram reading shows the cutoff frequency of the gunshots well above the cutoff frequency of the noise floor (background noise, radio chatter & siren). A display of the difference in frequency content between the gunshots and background noise is displayed in the image below. The gunshots are represented by the red vertical sections.

Frequency_Analysis_Laquan_2 Laquan McDonald Police Video With Audio is Fake

The cutoff frequency of the audio content from the YouTube video titled “Is this the audio? Chicago Police dashcam video of Laquan McDonald shooting” is around 16 kHz. This is displayed in the image below:

Frequency_Analysis_Laquan_3 Laquan McDonald Police Video With Audio is Fake

Based on my experience, audio recorded evidence produced from law enforcement vehicles contain a cutoff frequency of 4 kHz. I have examined the frequency analysis of the audio recorded in the original video ( the video with no audio- lack of radio communication & officer dialogue). The cutoff frequency analysis of the original audio portion of the video recording is 4 kHz and displayed below:

Frequency_Analysis_Laquan_4 Laquan McDonald Police Video With Audio is Fake

 

Based on my forensic testing and analysis, I can confidently say that the audio portion of this second YouTube video has been manufactured and added to the video after the original video was created. Why would anybody add audio to a video recording? In an attempt to deceive and make the video more powerful with a fake audio track. The video recording with the fake audio deceives the viewer. Although it appears to be real, it is indeed fake.

 

Frequency_Analysis_Laquan_5 Laquan McDonald Police Video With Audio is Fake

  • The original video released by Chicago Police contains recorded audio content of cross-talk, and alternator or engine noise (see above image). The noises that are audible within the original video recording are low in amplitude but can be heard with a significant increase in volume. Because this digital recorder in the police car recorded an audio track, it is my opinion that the digital video recorder was functional and had the ability to record sound. Because of the lack of officer dialogue and radio chatter, we believe the lack of these sounds was due to the following reasons:
  1. The on-person lavalier microphones within the vehicle were muted
  2. The on-person lavalier microphones within the vehicle were disconnected
  3. The on-person lavalier microphones within the vehicle were deactivated
  • The gunshots, and radio chatter heard throughout the YouTube video titled “Is this the audio? Chicago Police dashcam video of Laquan McDonald shooting” are duplicated, equalized and are not genuine or authentic. Previously in this blog I discussed the inconsistency between the cutoff frequency of the gunshots and cutoff frequency of the background noise within the audio content. In addition, the audible fingerprint of the gunshots within the Spectrogram has a distinct shape, size, and intensity that are consistent with duplication or repetition. The frequency decay of the gunshot, timbre or sound of the gunshot, as well as duration of the sound are almost identical. The gunshots are displayed in the image below:

Frequency_Analysis_Laquan_6 Laquan McDonald Police Video With Audio is Fake

The radio chatter sample at timecode 0:04.387 (MM:SS:MS) is an exact duplicate of the radio chatter sample 0:03.000 (MM:SS:MS). The conversation being spoken is identical. The difference between the two is that the duplicate has been processed using equalization to deceive the listener into believing it is additional radio conversation.

This video claiming to have genuine audio is indeed a fake. The Laquan McDonald Police Video With Audio is Fake.

Video as Evidence – The Importance of Video Authentication

Thursday, September 26th, 2013

video-authentication-1024x768 Video as Evidence - The Importance of Video AuthenticationSo why is video authentication important? As a video forensic expert, I often find that videos submitted into litigation are not an original as the person admitting has stated. Instead, they are copies that have been altered to only contain the events they want the Trier of fact to see. From a forensic perspective, this is not fair because the original video will contain all the events as they actually occurred. Some of the events that were omitted have relevance to the criminal or civil litigation.

Last week, I testified in court in a video authentication case. The report that I wrote for the case was admitted into evidence. My report revealed that a video had been altered and was not an original.

I testified that my report revealed the scientific findings and my conclusion that the video recording was altered and not an original. Both conclusions were scientific and if I conducted the same test 1000 times over, I would arrive with the same conclusions. If any other forensic expert were to conduct the testing that I had documented in my work product and report, they would arrive at the same conclusion as well.

Lately, I authenticate all forms of video. Store CCTV, cell phone video and tablet video. We live in a video world! Anywhere you go out in public you are more than likely being video recorded. If you are riding a city bus, you are more than likely being video recorded. Some civilians have installed mobile CCTV systems in their cars just in case they need to defend themselves or catch a crime in progress.

The police originally installed cruiser video recording systems to first protect themselves and to also protect the citizens from prejudice. Cruiser video holds the police accountable by recording probable cause for traffic stops.

Forensic experts have many tools to determine scientifically if a video is first, original and second, if a video has been altered. It is especially difficult with digital video to determine how a video was edited if it does not purport to contain the information or events either litigator states that it should contain. This is where forensic investigation becomes the only way to determine the video evidence authenticity.

If you believe a video has been edited, here are a couple things you can do personally to determine if your video may have been edited.

  1. First determine the file format on your DVD or CD Disc. Insert the disc into your computer, left click on the drive (more than likely it’s your ‘D’’ drive) and select open. Is the file format VOB or MP4, AVI, MOV? This format is actually the video container.
  2. Next, go back to the file folder, left click to open, find the video (it’s the largest file in that folder) and right click on the file. All the way at the drop down menu is the word ‘properties.’ Left click to open and review the MAC information. Modified, accessed and created information will reveal dates. Does the disc/CD created day read a date that the litigator who submitted the video stated the date created to be?
  3. The length of the video can also be a clue for your preliminary video authentication. Are there any phone records to compare to the length of the video? Does your memory of the series of events match the length of the video and video events?

Of course there are many more steps a video forensic expert will take in order to determine if your video is genuine and authentic. Even if there is no audio on your video recording, the audio track can also reveal information about the authenticity of your video recording.

If you have a question about video authentication, give us a call for a no cost telephone consultation 800.647.4281 or email PrimeauForensics@Gmail.com.

How to tell if a video recording has been edited

Tuesday, April 23rd, 2013

Is my video edited? How to tell if a video recording has been edited?

Is my video edited? How to tell if a video has been edited? In order to authenticate video evidence accurately, a trained video forensic expert must perform the testing to ensure the authentication process is done accurately. The expert performs a series of tests on the meta data as well as visual characteristics of the entire video. Does the video have a definitive beginning and end? Are there jumps in the video that are observed during playback? Does the meta data match the file format and other playback characteristics like frame rate and sample rate??

Preliminary Analysis

We begin all forensic video authentication and analysis investigations with a preliminary analysis.  This scientific analysis is performed in our video forensic laboratory by a video forensic expert. The goal of the prelim analysis is to determine if any signs of tampering, anomalies or other red flags are present. This preliminary analysis allows us to learn some truths about your video recording before proceeding to more costly and detailed forensic testing. We prefer to NOT take our clients money if we aren’t confident that we can assist your investigation and the trier of fact scientifically and purposeful. Our preliminary analysis includes an hour in the lab reviewing all aspects of your video recording looking for reasons to believe the video recording is genuine or lacks integrity.

Chain of Custody

Another important ingredient to consider is the established chain of custody for the video recording in question. Has the creator who presented the video recording as evidence provided a chain of custody document to support the video recording as evidence? A chain of custody is a document that explains details about the recording. Who created it, what equipment was it created on? Who had access to the recording since it was created? What activity did each person who had the video in their possession do with the video? Even is a party only viewed the video recording while they had it in their possession, that activity should be noted in the chain of custody document.

The Importance of an Original Video Recording

Often times we receive video evidence that has been copied,  and makes the analysis process difficult.  The Scientific Working Group on Digital Evidence (SWGDE & IOCE) defines Original Digital Evidence as ,”The physical items and the data objects associated with such items at the time of acquisition or seizure.” In other words,  when the video evidence has been removed from the system that created it, it is susceptible to manipulation and tampering, and is no longer an original. When a copy has been produced as evidence that is not an original it’s important for all persons in the litigation to know that the video is authentic and represents the events as they occurred accurately.

The forensic video analysis process involves several steps that help the court better understand the history of video evidence that is being presented in the litigation.

Authenticate Video Evidence:

  • Establish a Chain of Custody:Determine how the video evidence was created, and who was involved in transporting & obtaining the evidence from the source. The most original video evidence is crucial for maintaining this chain of custody.
  • Video Evidence Recovery:Sometimes it is necessary to recover the video evidence onsite when the original is available.  This process assists the video forensic expert through examining the equipment that created the video recording.
  • Physical Inspection: Examine the video evidence for signs of physical tampering, scratches, or dis-assembly.
  • Intake: Create a bit for bit clone or carbon copy & HASH test analysis
  • Visual Inspection: Carefully watch the video evidence. Use Frame by Frame analysis, Vector Scope Analysis, and Vector Detection Analysis, Slow Motion Analysis. 
  • Digital Inspection: Examining the digital properties of video evidence such as, EXIF or Metadata and Hexadecimal information, is crucial to determine if manipulation is present. 
  • Research the Equipment: It is important to the Video Forensic Expert to familiarize themselves with the equipment that was used to create the video evidence. Every case is a research project! 
  • Create an Exemplar: Re-Create the events as they occurred using the same technology or digital recorder that created the video evidence. Reverse Projection is an example using people. 
  • Observation: Note inconsistencies & anomalies. Create a formal report stating results, and opinions.
  • Courtroom Testimony: Document the video authentication process, providing notes taken, and state all forensic findings about the authenticity of the video evidence.  The forensic report is used as the basis for courtroom testimony by the video forensic expert.

 

If you have a video that you question or need help understanding, please give me a call for a pro bono conversation. I apply my forensic expertise to cases in the United States and many countries around the globe. Any and all formats of audio and video accepted. Retainer agreement available on request; travel expenses will be quoted in advance excluding meal expenses and flat rate time for travel instead of hourly.

Click HERE to email your questions or

Call 800-647-4281 in the USA or +01-248-853-4091 Internationally.

Ed Primeau’s Curriculum Vitae has several references which include cases he has testified in as well as clients he has worked for in these cases.

Virtual Chain of Custody for Video Forensics

Thursday, April 4th, 2013

chain-of-custody-1024x768 Virtual Chain of Custody for Video ForensicsTraditionally, a chain of custody is established between all parties when handling video forensic evidence. Most of the time, the chain of custody process is easily established and agreed on when bringing in a forensic expert to authenticate or clarify and enhance the video evidence. This is a blog post about a new technology that is helping make this process easier and more convenient for all parties involved.

In an effort to provide good service while respecting the expectations of my clients, I have been using Cloud storage methods for sharing video evidence and work product.

Now that high speed Internet has hit critical mass it is easy and safe to share video forensic evidence over the Internet without violating the evidence integrity.

One network I have been using very successfully is to upload clarified video evidence to Vimeo using a password protected video post. Only the persons privy to the password can view the video. Of course, this practice is not acceptable in cases that involve children or pornography.

The link to the video post is then emailed to the client. The password is provided to the client in a separate email.

Once the forensic video process is complete the video evidence is then burned onto a CD or DVD Rom and returned to the client for the litigation proceeding.

Other virtual methods for safely transferring video evidence are Dropbox and YouSendIt.  As technology evolves, so does the forensic expert. Litigators are pleased with the convenience and forensic investigators are utilizing technological advancements to help speed up the forensic approval process.

Does My Video Have a Glitch?

Wednesday, February 8th, 2012

glitch-1024x768 Does My Video Have a Glitch?Does my video have a glitch?

I got a call recently from an attorney who had a VHS tape recording of a traffic stop.  The attorney asked if I could determine if the tape had been altered. He went on to describe what his client thought was a glitch. I understand the attorney’s dilemma. On one hand his client who just gave him a retainer said there was a glitch and on the other hand, why on earth would the police officer risk his career, pension and reputation in the community to alter a segment of video?

I have worked on forensic video cases where there was an alteration in a video and others where they had not been any alteration. I have worked for the good guys as well as the bad guys. Every video forensic case I accept and am retained for is different. Some video can be confirmed as original and other video footage can be confirmed as a copy. This is an important aspect to authenticating video evidence.  If you believe that your video has been altered then you are entitled to examination of the original.

What is an original digital video?

In my opinion, an original digital video is stored on the hard drive of the system that created the video. Once the video in question has been moved from the DVR (digital video recorder) it could be argued that it is no longer an original.  There are some exceptions that vary from state to state. If the video that is to be the original is agreed an “original” by all parties to the litigation then the video is indeed an original.

If there is a “glitch” in the video, as a forensic expert I would want to examine the original digital video source file (ODVSF). That is the file that the CCTV DVR made when the camera (s) were being recorded; the purpose; to see if the same glitch is in that original digital video source file. If the glitch or anomaly is not in the ODVSF it becomes very important to the case as to why the file is different.

One out of ten

A lack of complete digital video evidence, which is similar to a glitch, is a problem.  I worked on a slip and fall case where the property owners did not provide the entire CCTV system showing the entire fall.  Instead, the victim was given only one camera view out of ten available cameras. The owners tried to tell us that was the only camera view of the incident.  Then when I requested a camera grid of the CCTV system (map showing where each camera was located) we discovered that the original CCTV digital video recording had been deleted. This is a pretty big glitch: the glitch that goes UNseen, a reverse glitch.

So the next time you believe your video has a glitch, seek the help of a forensic expert who is a neutral unbiased third party that can form a professional opinion about the video recording used in your litigation.

 

 

photo credit: vertscape2-double10 via photopin (license)

 

Original Digital Media Evidence is Mandatory

Saturday, February 5th, 2011

913643_25477244 Original Digital Media Evidence is MandatoryDigital audio and video is recorded and stored in electronic equipment. If the audio or video is needed in court, the original device that created the recording must be identified and kept in a chain of custody. The only exception is when both parties involved in the litigation agree that a copy is sufficient. If there is doubt in the authenticity, the audio expert must refer to the original to support the authentication of the audio evidence.

The reason is that the audio or video copy has been removed from its original environment and is vulnerable to alteration. In addition, if a computer created the original recording, additional information can be examined by the audio expert such as file creation, last accessed and other computer forensic information that can support the audio evidence authenticity.

If the original audio recording was created in a digital pocket recorder (which many law enforcement officials use) then that original pocket recorder must maintain a chain of custody and become the original evidence. Any external copy created by a number of methods and played outside of the digital pocket recorder is a copy. Unless an audio expert can authenticate the copy (which can be done once the original has been examined) it cannot be used in a court proceeding. If the audio copy has been authenticated by an expert, than it will be easier to play and amplify in the court for a judge and jury.

I have testified in criminal cases for the defense when the client swore under oath that the audio recording had been altered and did not represent the facts as they occurred. Now it’s their word against the other side and when the court has to decide, the prosecution most always, will prevail.

If you have had an experience with Audio/Video evidence and would like to share your story, please comment on this post and your story will be heard.

800-647-4281

Audio Evidence

Tuesday, November 30th, 2010

5230479916_345e8050b3_o-1024x682 Audio EvidenceAudio evidence as well as video evidence is any recording that has been admitted and accepted into a litigation and is an account of events as they occurred.

Audio evidence includes confidential informant recordings, recordings of confession by officials, telephone intercept or wiretap, voice mail and 911 calls. The goal of the forensic expert is to process the recordings for forensic enhancement and or forensic authentication and analysis.

One step in the forensic authentication process of video recordings is to be sure a chain of custody has been established. Also, is the recording used as evidence an original or a copy? The audio portion of a video recording is also examined forensically when performing forensic video authentication.

This was important back when analogue recordings were primarily used as evidence.  This is because the audio portion of a video recording holds many clues for the forensic examiner. It is especially important today with digital recordings being the primary format for audio evidence.  Once the digital recording has been burned to a CD, it is no longer considered an original. Especially if anybody objects to its authenticity. It is considered a digital duplicate as long as all parties in the litigation agree to its contents and what it pro-ports to show. It is much more appropriate to use the original recording because it can be forensically authenticated when it is in its original environment.

There is no reason that an original digital audio recording cannot be preserved in the equipment that created it.

Digital audio recordings take up very little space and can easily remain stored on the equipment that created it. It is NOT okay to erase or delete the original so the recording equipment has more storage space. In the case of a digital pocket recorder deleting content to make room may be a logical thought process until somebody objects to its authenticity.

In some cases, a deleted audio recording could be considered spoliation of evidence if a forensic expert can not effectively authenticate the audio evidence. A CD copy is technically not an original because once the audio recording is removed from its native environment.  Often times, this alteration can go undetected even by an experience audio forensic expert. This is why preserving the original file of the audio evidence is extremely important.

Whether you are law enforcement presenting a confidential informant or confession audio recording, a private individual presenting a voice mail or concealed audio recording, always preserve the original recording so there is no doubt of the authenticity and integrity of the audio evidence.  Consult an experienced audio forensic expert to assist you in authenticating the audio evidence for a fair and accurate representation of the facts as they occurred in their original environment.

photo credit: Mixer board via photopin (license)

Video Forensic Expert Edward J Primeau Curriculum Vitae

download-cv