Do You Suspect the Authenticity or Integrity of a Video Recording

To determine whether a video (CCTV, Smartphone, or other device) recording has been tampered with or otherwise maliciously edited in order to deceive or mislead, the authenticity and integrity of the file(s) must be assessed.

The verification of the authenticity and integrity of a digital media file is an important component of multimedia digital forensics.  Authentication and integrity testing is not a trivial process and should not be requested on a whim or as a result of wishful thinking.  One minute of video or CCTV at 25 frames per second (fps) produces 1500 frames or images. Analysis of this nature can become very time consuming and costly.

As there are many variables and not all information may be available on the origins of a recording. The outcome may not be conclusive as there are often unexplainable characteristics identified which do not necessarily indicate clear evidence of malicious tampering. On occasions, it may be necessary to purchase an exemplar test device to match the claimed device used. This enables confirmation of the characteristics of the claimed device to determine whether certain unusual characteristics are the result of that particular make and model of recording device or the result of post-recording editing of some sort.

Handling and Documentation

Depending upon the handling and claimed origins, additional work may be required to determine the presence or absence of the recording or other versions of the recording on other synchronised devices or cloud storage areas linked to that user.

To minimise costs and maximise results, please provide as much guidance as possible as to what has prompted you to believe that the integrity of the file is in question. Where possible, provide details of time or frame offsets within the file where these discrepancies occur and a description of what you believe should or should not be present.

Even if a video recording appears normal when viewing, there may be hidden characteristics that can indicate the video is not original, or even a true duplicate copy of the original. The more information you can provide relating to the provenance (origin and handling history) of the recording, the more we have to work with and the better the chances of a reliable and confident outcome. Ideally, you should provide information relating to the make, model and settings of the recording device. It is also important to provide information as to all and any handling of the recorded material i.e. who, what, where, when and why.

Authenticity Assessment

An Authenticity assessment can provide verification of the source recording device, the mode of recording and date and time the recording took place. If any of these “external characteristics” do not correlate with that which is observed in the file being assessed, then there is a strong probability that the recording did not originate from the claimed device or was made at the claimed time. These finding then provide a strong argument for or against the reliability of the recording and whether it supports the claimed origins.

Integrity Assessment

An Integrity assessment looks at the content of the recording to determine whether the video is reliably representing the situation it is being relied upon to portray. Any characteristics not expected for the type of video format that the claimed device uses such as unusual or varied compression levels, varying or odd frame rates, missing frames, sudden changes in lighting or framing etc. can identify if the video has in some way been altered or staged.

Video / CCTV Analysis Can Include

• Identification of the recording device used.
• Identification of the recording modes and formats used.
• Identification of any variations in frame timing and timestamp accuracy.
• Identification of sudden jumps in frame scenes and recorded activity.
• Identification of any out-of-sync audio.
• Inspection of inter-frame and intra-frame compression algorithms for consistency and relevance to format and recorder settings and capabilities.
• Analysis of the video stream’s structural integrity i.e. frame count continuity, dropped, missing or out-of-order frames or packet and timestamp discrepancies.
• Bit-level analysis of the data to detect specific instances and types of tampering or modifications to the pixels of the images.
• Inspection and analysis of the continuity of reflections, shadows, perspectives, level of detail, direction and consistency of lighting.