What is Video Forensics? Forensic Video Analysis

What is video forensics? Forensic video analysis is the scientific examination, comparison and/or evaluation of video in legal matters. This definition was created by accredited video forensic agencies around the country and internationally such as LEVA, NATIA as well as IAI. The video forensic process must be performed in a forensic lab that is equipped with the appropriate tools and follows best practice protocols in order to process the video recording with integrity and accuracy.

THREE CATEGORIES OF VIDEO FORENSIC SCIENTISTS:

TECHNICIAN

Intake of the evidence, copies and converts media, performs preliminary enhancements and other assessments.

ANALYST

Includes all technician skills, performs image comparison investigations, aspect ratio calibration, color correction, reverse projection, photogammetry, authentication, motion tracking, image authentication.

EXPERT WITNESS

Includes all technician and analyst skills, provides consultation with litigators, generates formalized reports, peer/technical review, formulating opinions, evidence recovery.

With the rapid proliferation of surveillance cameras in public and private places, law enforcement agencies and litigators are increasingly making use of these recordings as evidence. Fixed and mobile digital video recorders and other portable video recording CCTV systems are making it easier to capture crime scene video that may be used as evidence in court.

WHAT TYPES OF RECORDERS CREATE DIGITAL VIDEO EVIDENCE?

DIGITAL VIDEO FORMATS

Digital video evidence is most commonly created by passive and active recording systems. A passive recording system is a recording system that doesn’t store information in its memory system. An active recording system is a recording that stores information in its memory system. Active recording systems are most commonly produced with a digital storage medium such as a HDD, SSD or Volatile (flash) memory. Video recorders create digital video recordings in these types of formats:

Open source format

An open source format is a file format for storing digital data, defined by a published specification usually maintained by a standards organization, and which can be used and implemented by anyone.

Proprietary format

A proprietary format is a file format of a company, organization, or individual that contains data that is ordered and stored according to a particular encoding-scheme. This scheme is designed by the company or organization to be secret, such that the decoding and interpretation of this stored data is easily accomplished only with particular software or hardware that the company itself has developed. These formats are more common when video evidence is extracted directly from the system that created it, because they are a more secure and higher quality formatting. These proprietary formats also contain digital information like Meta Data and Telemetry Data that can assist a video forensic investigation.

Courtroom ready format

A copy of the video recording that is easily playable in a court of law using a computer, projection system, or large television. This digital format today should be tested on the system that it will be played through prior to presentation in court. Often times this format is deliverable in the form of a flash drive, DVD or Data Disc. Although the playable copy will be encoded in a common video format (MP4, AVI, WMV) it still may require a freeware player like VLC player or DVD playback software to advance frames as well as play or decode smoothly.

Acquisition of Video Evidence

It is often necessary for a forensic technician, analyst or video forensic expert to perform a digital video evidence recovery in order to secure the Digital Media Evidence and establish a chain of custody. DME (Digital Media Evidence) is defined by LEVA as “Information of probative value stored in binary form” (LEVA-2013). CCTV surveillance video recordings are the most common type of digital media evidence (DME). Once the recordings have been secured, an accurate chain of custody can be presented to the trier of fact. In addition, the forensic expert that acquired the video evidence can ensure that the highest quality versions of the recording are obtained so that a successful forensic video enhancement or forensic image comparison can be performed.

Most fixed and mobile Digital Video Recorder (DVR)-based surveillance systems employ proprietary computer operating systems and record digital video to proprietary formats. Under these circumstances, causing minimal degradation of picture quality during the process of recovering and trans-coding video files is a complex challenge for both law enforcement agencies and video forensic experts. There are a wide variety of surveillance system manufacturers and an even wider number of models of DVRs, which requires the video forensic expert to prepare ahead of time and acquire the appropriate tools necessary to recover the recording accurately and efficiently.

In addition, the video forensic expert must follow protocols set forth by the scientific community in order to ensure that the processes used for video evidence recovery are systematic and admissible in a court of law. Video Forensic Expert recommends that every video expert prepare a forensic recovery kit that would include I/O cabling, storage mediums in varying sizes, a cloning device, video camera equipment, write blocker, evidence bags in order to be prepared for the various recovery situations from the various CCTV digital video and mobile video recorders.

Creating a disc image (clone) of the DVR’s hard drive is the most common first step in the evidence recovery protocol to protect the probative information stored in the system’s volatile and non-volatile memory. The technician must understand the file system structure on the primary and slave drive before performing a disc image or forensic clone.

LAB INVESTIGATION

FORENSIC IMAGE COMPARISON INVESTIGATION

The Forensic Image Comparison investigation is the process of comparing digital images, or digital images extracted from video recordings to determine the probability that the people or objects depicted in these images are the same or different. The Forensic Image Comparison investigation is most accurate when the images or videos are of sufficient quality, and they meet the forensic comparison criteria.

It is considered that the most prolific source of evidence for police investigations are from video recordings. Video Forensics tells us that all video recordings are not an accurate medium because digital compression removes information and adds information that wasn’t originally included. It is because of these reasons that a Video Forensic Expert MUST be able to interpret the images and video recording in order to present the events as they occurred and compare these and analyze the results.

Because of the unreliability of images and video presented as evidence, a Video Forensic Expert MUST also be able to qualify the events to ensure that the people or objects presented has sufficient detail and pixel information for an accurate forensic image comparison investigation. In some cases, when the objects or people displayed are not clear, we perform a forensic video enhancement in order to see the details of the images more clearly for an accurate comparison.

VIDEO CLARIFICATION/ENHANCEMENT

The objective of Forensic Video Enhancement is to clarify or enhance the events as they occurred. This is done using non destructive techniques to preserve the video evidence integrity, and pixel quality. Clarifying or enhancing the events as they occurred assists the Trier of Fact to weigh the video evidence and its relevance to the litigation. As video forensic expert, we are often asked to enhance CCTV Surveillance video recordings for court. We are also asked to provide video image enhancement for identification purposes. We create customized filtering to sharpen the video image and remove video noise for identification and enhancement of the images in the CCTV Surveillance video.

Below are some of the most popular clarification and enhancement techniques that can be applied to an investigation.

Scaling/Pixel Interpolation: Re-size, or scale an image or video to a larger resolution to further identify suspects.
Sharpening: Enhances the edge contrast of an image or video.
Warp Stabilization: This is most common today with smart phone video evidence. Reduces the amount of movement from the user that created the video evidence.
Shadow and Highlight Adjustments (Exposure): Reveals subtle detail in the shadow and/or highlight areas of your images.
Frame Averaging: Increase the quality of the image by combining data from surrounding frames as well as a better signal to noise ratio (SNR) in your images or videos.
Speed Reduction: Decrease the original playback of video evidence to view the events as they occurred in more detail.
Pixel Aspect Ratio Calibration: Adjusting the ratio that describes how the width of a pixel in a digital image compares to the height of that pixel
Color Correction:
Reverse Projection:
Photogammetry:
Motion Tracking:
Demonstrative Video Exhibits:

Forensic enhancement and analysis tools include software and hardware that are implemented and used on a powerful desktop computer. Methods applied to this scientific examination must be executed in a systematic and accurate nature. Our video forensics service is sought after by law enforcement agencies, attorney’s, government agencies and private clients. Opinions and conclusions drawn by the video forensic expert MUST follow best practices. A forensic report is created on completion that exhibits all activity performed in the lab as well as forensic processes performed. That way, any other qualified video forensic expert can follow our steps multiple times and establish the same conclusions and opinions. Our video forensic processes and executed with the utmost accuracy as we testify in court on our opinions and conclusions.

VIDEO ANALYSIS/AUTHENTICATION

Forensic video analysis and authentication is the scientific processes performed by a trained video forensic expert in order to determine events that occurred at the time of the video recording. CCTV cameras do not see the same as the human eye. Some of the video recordings we examine in our lab have been altered either with malice or unintentionally using processes that alter the integrity of the evidence. As video forensic experts we help our client attorneys understand any anomalies in the video recording we are asked to analyze and perform several scientific tests to determine the nature of any anomalies.

EXPERT WITNESS TESTIMONY

What is a Video Forensic Expert Witness?

A Video Forensic Expert has the scientific knowledge, training and expertise necessary to enhance and authenticate video recordings that are being used in a criminal or civil court case. The expert witness has previous court room experience testifying and helps the Trier of Fact understand the video evidence that is offered in a litigation.