How to Tell if a Video Recording has been Edited

How can I tell if my video recording has been edited? In order to authenticate video evidence accurately, a trained video forensic expert must perform the testing to ensure the authentication process is done accurately. The expert performs a series of tests on the metadata as well as the visual characteristics of the entire video. Does the video have a definitive beginning and end? Are there jumps in the video that are observed during playback? Does the metadata match the file format and other playback characteristics like frame rate and sample rate?

Preliminary Analysis

We begin all forensic video authentication and analysis investigations with a preliminary analysis. This scientific analysis is performed in our video forensic laboratory by a video forensic expert. The goal of the preliminary analysis is to determine if any signs of tampering, anomalies, or other red flags are present. This preliminary analysis allows us to learn some truths about your video recording before proceeding to more costly and detailed forensic testing. We prefer to not take our clients’ money if we aren’t confident that we can assist your investigation and the trier of fact scientifically and purposefully. Our preliminary analysis includes an hour in the lab reviewing all aspects of your video recording looking for reasons to believe the video recording is genuine or lacks integrity.

Chain of Custody

Another important ingredient to consider is the established chain of custody for the video recording in question. Has the creator who presented the video recording as evidence provided a chain of custody document to support the video recording as evidence? A chain of custody is a document that explains details about the recording. Who created it, what equipment was it created on? Who had access to the recording since it was created? What activity did each person who had the video in their possession do with the video? Even is a party only viewed the video recording while they had it in their possession, that activity should be noted in the chain of custody document.

The Importance of an Original Video Recording

Often times we receive video evidence that has been copied and makes the analysis process difficult. The Scientific Working Group on Digital Evidence (SWGDE & IOCE) defines Original Digital Evidence as “the physical items and the data objects associated with such items at the time of acquisition or seizure.” In other words, when the video evidence has been removed from the system that created it, it is susceptible to manipulation and tampering and is no longer an original. When a copy has been produced as evidence that is not an original it’s important for all persons in the litigation to know that the video is authentic and represents the events as they occurred accurately.

The forensic video analysis process involves several steps that help the court better understand the history of video evidence that is being presented in the litigation.

Authenticate Video Evidence:

Establish a Chain of Custody: Determine how the video evidence was created, and who was involved in transporting & obtaining the evidence from the source. The most original video evidence is crucial for maintaining this chain of custody.
Video Evidence Recovery: Sometimes it is necessary to recover the video evidence onsite when the original is available. This process assists the video forensic expert by examining the equipment that created the video recording.
Physical Inspection: Examine the video evidence for signs of physical tampering, scratches, or disassembly.
Intake: Create a bit for bit clone or carbon copy & HASH test analysis.
Visual Inspection: Carefully watch the video evidence. Use Frame by Frame analysis, Vector Scope Analysis, and Vector Detection Analysis, Slow Motion Analysis.
Digital Inspection: Examining the digital properties of video evidence such as EXIF or Metadata and Hexadecimal information, is crucial to determine if manipulation is present.
Research the Equipment: It is important to the video forensic expert to familiarize themselves with the equipment that was used to create the video evidence. Every case is a research project.
Create an Exemplar: Recreate the events as they occurred using the same technology or digital recorder that created the video evidence. Reverse Projection is an example of using people.
Observation: Note inconsistencies & anomalies. Create a formal report stating results, and opinions.
Courtroom Testimony: Document the video authentication process, providing notes taken, and state all forensic findings of the authenticity of the video evidence. The forensic report is used as the basis for courtroom testimony by the video forensic expert.