Video Authentication Analysis – Edit Detection and Tampering

Authentication of Digital Video Recordings

Introduction

Digital video recordings aren’t always an accurate eyewitness. The Federal Rules of Evidence require that digital video recordings used as evidence be authentic. In order for a digital video recording to be used as evidence in court, it must be authentic. Our video authentication services can assist the trier of fact to determine the authenticity of a video recording submitted as evidence.

Many of our clients believe that their digital video recordings are manipulated or edited. We often find that when people experience a traumatic event, their interpretation of the event is altered. Some clients even believe because a video has been edited, that is is not authentic.

The Federal Rules of Evidence state that editing a video recording to remove irrelevant portions will not effect its authenticity. This can be confusing to a lay person which is why a video forensic expert can be retained. We are brought in as a third party unbiased scientist to authenticate the digital video recording.

 

The Importance of an Original Video Recording

Often times we receive video evidence that has been copied,  and makes the analysis process difficult.  The Scientific Working Group on Digital Evidence (SWGDE & IOCE) defines Original Digital Evidence as:

“The physical items and the data objects associated with such items at the time of acquisition or seizure.”

In other words,  when the video evidence has been removed from the system that created it, it is susceptible to manipulation and tampering, and is no longer an original. When a copy has been produced as evidence that is not an original.  It’s important for everyone involved in the litigation to agree that the video is an authentic representation of the events.

Chain of Custody

It is important that the creator of the video recording provide chain of custody documentation. A chain of custody document explains how the video was handled from the time it was created, to the delivery to court. Some common questions that are answered in the chain of custody documentation are:

  • Who created the recording?
  • What equipment was it created on?
  • Who had access to the recording?
  • What activity was performed to the video recording?

These types of questions must be answered before beginning an investigation to determine if the authenticity of the chain of custody. Even if someone viewed the video recording while in their possession, that activity must be noted in the chain of custody.

Another method we use to investigate the digital integrity is to analyze the chain of custody. Specific digital information bout the system that created it strengthens the authenticity of the chain of custody. This assists the expert in gathering information to create any sample recordings needed for the investigation.

Evidence Recovery

The best way to authenticate a digital video recording is to perform a evidence recovery. This process ensures that the original digital video evidence is preserved, extracted and maintained to establish an authentic chain of custody. The integrity and authenticity of the recording is challenged less often if a qualified expert recovers it from the original system. To learn more about this process click HERE.

 

 

Video Authentication Science

Preliminary Analysis

We begin all forensic video authentication and analysis investigations with a preliminary analysis.  Throughout this process, our experts review the video recording in depth through frame by frame analysis. The goal of the preliminary analysis is to determine if any signs of tampering, anomalies or other red flags are present.

This allows us to learn more about your video recording before proceeding to more costly and detailed forensic testing. We accept retainers if we are confident that we can assist the investigation and the trier of fact scientifically and purposefully. Our preliminary analysis requires 1 hour of lab time to determine if an investigation is possible.

Digital Integrity Verification

The goal of the digital integrity verification testing is to authenticate the digital integrity of the format of the video evidence. Throughout this process we examine the digital information embedded within the  recording to determine if it is consistent with what we would expect to see from an original. This original recording would have been produced by the system that created it as a 1st generation copy.

One of the methods we are trained in is called the HASH test analysis. The HASH test is a series of numbers and letters that is considered a digital fingerprint of the video recording. It is compared to any other versions of the video recording to confirm consistency.

We also perform a 4 part digital information test that analyzes recording specifications of the video. This information may include footprints of third party software that were used to manipulate the video recording. Malicious edit detection and tampering can be detected through digital integrity verification testing.

Often times we are asked to authenticate the recorded date/time stamp information. Authentication testing may reveal that the date/time stamp information was not maintained or is not accurate under certain circumstances.

Visual Authentication

Often times, the authenticity of the video file as well as the events depicted is questioned. For example, if the FPS (frames per second) captured is not high enough, the events may not be represented accurately. Some examples include skipping, abrupt changes in events, as well as stop motion.

Video compression may introduce artifacts and reduce crucial information important to the authenticity of the events as they were recorded. If this information is not accurately recorded in the digital video evidence, the video MAY NOT be considered authentic. If a recording isn’t of sufficient image quality due to image compression, the video will lack authenticity. In other words, it lacks the necessary criteria to make an accurate identification of a suspect, vehicle or other object.

Exemplar Comparison

Sometimes it becomes necessary to create an exemplar recording (known recording) to analyze and compare against the evidence recording (unknown recording). In order to create an exemplar accurately, you must determine the type of equipment that created the original video recording.  Then you can obtain or gain access to that equipment and create test recordings for analysis.

This is the most accurate way to confirm the authenticity of the digital video recording if the original evidence is unavailable. Throughout this process we also analyze the behavior of the system at the time it recorded the video. Are the original video recorders specifications consistent with what the “original video recording” depicts that was submitted as evidence?

 

Courtroom Testimony

When under oath the expert witness has sworn to speak accurately and truthfully. Much like a deposition, courtroom testimony can be an intense situation for an expert. Our experts understand the process of direct and cross examination.

When we prepare for testimony, we anticipate all questions that will be asked of us during direct and cross examination. We understand that our attorney clients will never ask a question that they don’t know the answer to.  Helping the tier of fact to understand the scientific analysis in a simple way is important to our experts.

Our lead expert Edward Primeau has 35+ years testifying as an audio & video expert witness. This experience has strengthened Primeau Forensics’ expert witness performance in the court room. We have testified in local, state and Federal courts all over the USA and worked with lawyers around the world. We  know how to help a legal team develop a solid trial strategy.

Click HERE to learn about what some of our clients have said.

Video Forensic Expert Edward J Primeau Curriculum Vitae

download-cv


sidebar map
sidebar video
forensic associations