Forensic analysis of video file formats

Video file format standards define only a limited number of mandatory features and leave room for interpretation. Design decisions of device manufacturers and software vendors are thus a fruitful resource for forensic video authentication. This paper explores AVI and MP4-like video streams of mobile phones and digital cameras in detail. We use customized parsers to extract all file format structures of videos from overall 19 digital camera models, 14 mobile phone models, and 6 video editing toolboxes. We report considerable differences in the choice of container formats, audio and video compression algorithms, acquisition parameters, and internal file structure. In combination, such characteristics can help to authenticate digital video files in forensic settings by distinguishing between original and post-processed videos, verifying the purported source of a file, or identifying the true acquisition device model or the processing software used for video processing.     

Integrity verification of the ordered data structures in manipulated video content

Video content stored in Video Event Data Recorders (VEDRs) are used as important evidence when certain events such as vehicle collisions occur. However, with sophisticated video editing software, assailants can easily manipulate video records to their advantage without leaving visible clues. Therefore, the integrity of video content recorded through VEDRs cannot be guaranteed, and the number of related forensic issues increases. Existing video integrity detection methods use the statistical properties of the pixels within each frame of the video. However, these methods require ample time, because they check frames individually. Moreover, the frame can easily be replaced and forged using the appropriate public software. To solve this problem, we propose an integrity checking mechanism using the structure of ordered fields in a video file, because existing video editing software does not allow users to access or modify field structures. In addition, because our proposed method involves checking the header information of video content only once, much less detection time is required compared with existing methods that examine the entire frames. We store an ordered file structure of video content as a signature in the database using a customized automated tool. The signature appears according to the video editing software. Then, the suspected video content is compared to a set of signatures. If the file structure matches with a signature, we recognize a manipulated video file by its corresponding editing software. We tested five types of video editing software that cover 99% of the video editing software market share. Furthermore, we arranged 305,981 saving options for all five video editing suites. As a result, we obtained 100% detection accuracy using stored signatures, without false positives, in a collection of 305,981 video files. The principle of this method can be applied to other video formats.     

Quantifying and Ranking Quality for Acquired Recordings on Digital Video Recorders

As the closed-circuit television (CCTV) security industry transitioned from analog media to digital video recorders (DVRs) with digital storage, the law enforcement community struggled with the means with which to collect the recordings. New guidelines needed to be established to determine the collection method which would be efficient as well as provide the best quality evidence from live DVRs. A test design was developed to measure, quantify, and rank the quality of acquisition methods used on live systems from DVRs typically used in digital CCTV systems. The purpose was to determine guidelines for acquiring the best quality video for investigative purposes. A test pattern which provided multiple quantifiable metrics for comparison between the methods of acquisition was used. The methods of acquisition included direct data download of the proprietary file and open file format as well as recording the video playback from the DVR via the available display monitor connections including the composite video, Video Graphics Array (VGA), and high-definition multimedia interface (HDMI). While some acquisition methods may provide the best quality evidence, other methods of acquisition are not to be discounted depending on the situation and need for efficiency. As an investigator that needs to retrieve video evidence from live digital CCTV systems, the proprietary file format, overall, provides the best quality evidence. However, depending on the circumstance and as recording technology continues to evolve, options other than the proprietary file format may provide quality that is equal to or greater than the proprietary file format.     

Passive forensics in image and video using noise features: A review

Due to present of enormous free image and video editing software on the Internet, tampering of digital images and videos have become very easy. Validating the integrity of images or videos and detecting any attempt of forgery without use of active forensic technique such as Digital Signature or Digital Watermark is a big challenge to researchers. Passive forensic techniques, unlike active techniques, do not need any preembeded information about the image or video. The proposed paper presents a comprehensive review of the recent developments in the field of digital image and video forensic using noise features. The previously existing methods of image and video forensics proved the importance of noises and encourage us for the study and perform extensive research in this field. Moreover, in this paper, forensic task cover mainly source identification and forgery detection in the image and video using noise features. Thus, various source identification and forgery detection methods using noise features are reviewed and compared in this paper for image and video. The overall objective of this paper is to give researchers a broad perspective on various aspects of image and video forensics using noise features. Conclusion part of this paper discusses about the importance of noise features and the challenges encountered by different image and video forensic method using noise features.     

Characterization of Digital Cameras for Reflected Ultraviolet Photography; Implications for Qualitative and Quantitative Image Analysis During Forensic Examination

Reflected ultraviolet imaging techniques allow for the visualization of evidence normally outside the human visible spectrum. Specialized digital cameras possessing extended sensitivity can be used for recording reflected ultraviolet radiation. Currently, there is a lack of standardized methods for ultraviolet image recording and processing using digital cameras, potentially limiting the implementation and interpretation. A methodology is presented for processing ultraviolet images based on linear responses and the sensitivity of the respective color channels. The methodology is applied to a FujiS3 UVIR camera, and a modified Nikon D70s camera, to reconstruct their respective spectral sensitivity curves between 320 and 400 nm. This method results in images with low noise and high contrast, suitable for qualitative and/or quantitative analysis. The application of this methodology is demonstrated in the recording of latent fingerprints.     

LET'S GO TO THE VIDEOTAPE: WHY THE FORENSIC INTERVIEWS OF CHILDREN IN CHILD PROTECTIVE CASES SHOULD BE VIDEO RECORDED*

Child sexual abuse is often difficult to prove due to a lack of physical evidence. In many instances, the only evidence is a child's statement given during a forensic interview. Forensic interviews are conducted to assess whether the child has been abused, to develop a plan to protect a child's safety pending trial, and to provide further investigative leads. Note taking by the interviewer is currently the primary method for documenting what takes place in a forensic interview. Research shows that this form of documentation is problematic because interviewers tend to omit abuse‐related details in their notes. This Note suggests that federal law should require that forensic interviews of children in child sexual abuse cases be video recorded. State law can provide for a policy of video recording even in the absence of a federal law mandate. Video recording would better preserve the child's statements thereby improving the reliability of the information that is obtained during forensic interviews. The child's demeanor would also be fully captured on video as opposed to getting lost in an interviewer's notes.     

The Prevalence of Encoded Digital Trace Evidence in the Nonfile Space of Computer Media,,

Forensically significant digital trace evidence that is frequently present in sectors of digital media not associated with allocated or deleted files. Modern digital forensic tools generally do not decompress such data unless a specific file with a recognized file type is first identified, potentially resulting in missed evidence. Email addresses are encoded differently for different file formats. As a result, trace evidence can be categorized as Plain in File (PF), Encoded in File (EF), Plain Not in File (PNF), or Encoded Not in File (ENF). The tool bulk_extractor finds all of these formats, but other forensic tools do not. A study of 961 storage devices purchased on the secondary market and shows that 474 contained encoded email addresses that were not in files (ENF). Different encoding formats are the result of different application programs that processed different kinds of digital trace evidence. Specific encoding formats explored include BASE64, GZIP, PDF, HIBER, and ZIP.     

Suspect Height Estimation Using the Faro Focus3D Laser Scanner

At present, very little research has been devoted to investigating the ability of laser scanning technology to accurately measure height from surveillance video. The goal of this study was to test the accuracy of one particular laser scanner to estimate suspect height from video footage. The known heights of 10 individuals were measured using an anthropometer. The individuals were then recorded on video walking along a predetermined path in a simulated crime scene environment both with and without headwear. The difference between the known heights and the estimated heights obtained from the laser scanner software were compared using a one-way t-test. The height estimates obtained from the software were not significantly different from the known heights whether individuals were wearing headwear (p = 0.186) or not (p = 0.707). Thus, laser scanning is one technique that could potentially be used by investigators to determine suspect height from video footage.     

一种AI换脸方法生成的伪造视频分析

深度伪造(Deepfake)是一种将图像篡改与AI相结合的面部替换方法。本文首先介绍了Deepfake的产生背景和发展状况,介绍了相应检测技术的研究状况,并对相关文献进行归纳;然后探究了Deepfake运行的基本构架和核心部件,给出了视频面部替换的基本流程和步骤,并阐释了利用自编码网络进行脸部图像训练和转换的原理;最后,从视频的基本信息、编辑痕迹、违背摄影规律、视频整体和案情五个方面与原始视频作对比,分析这类伪造视频存在的问题。深度伪造技术在推动娱乐和文化发展的同时也产生了大量恶意的换脸视频,对国家安全、社会稳定和个人隐私造成潜在的威胁,本文通过对Deepfake实现原理的研究和伪造视频特征的分析,希望能够为该类视频的真伪检验提供一定的理论支持。     

数码照相机与视频荧光鉴别仪的物证检验应用比较

索尼SONY WVC-CD300数码照相机与SYJ-5型视频荧光鉴别仪应用在文件检验时,视频荧光鉴别仪部分功能可用 该种数码照相机代替,各具特色。     

Authentication of Surveillance Videos: Detecting Frame Duplication Based on Residual Frame

Nowadays, surveillance systems are used to control crimes. Therefore, the authenticity of digital video increases the accuracy of deciding to admit the digital video as legal evidence or not. Inter‐frame duplication forgery is the most common type of video forgery methods. However, many existing methods have been proposed for detecting this type of forgery and these methods require high computational time and impractical. In this study, we propose an efficient inter‐frame duplication detection algorithm based on standard deviation of residual frames. Standard deviation of residual frame is applied to select some frames and ignore others, which represent a static scene. Then, the entropy of discrete cosine transform coefficients is calculated for each selected residual frame to represent its discriminating feature. Duplicated frames are then detected exactly using subsequence feature analysis. The experimental results demonstrated that the proposed method is effective to identify inter‐frame duplication forgery with localization and acceptable running time.     

Forensic discovery auditing of digital evidence containers

Current digital forensics methods capture, preserve, and analyze digital evidence in general-purpose electronic containers (typically, plain files) with no dedicated support to help establish that the evidence has been properly handled. Auditing of a digital investigation, from identification and seizure of evidence through duplication and investigation is, essentially, ad hoc, recorded in separate log files or in an investigator's case notebook. Auditing performed in this fashion is bound to be incomplete, because different tools provide widely disparate amounts of auditing information – including none at all – and there is ample room for human error. The latter is a particularly pressing concern given the fast growth of the size of forensic targets.Recently, there has been a serious community effort to develop an open standard for specialized digital evidence containers (DECs). A DEC differs from a general purpose container in that, in addition to the actual evidence, it bundles arbitrary metadata associated with it, such as logs and notes, and provides the basic means to detect evidence-tampering through digital signatures. Current approaches consist of defining a container format and providing a specialized library that can be used to manipulate it. While a big step in the right direction, this approach has some non-trivial shortcomings – it requires the retooling of existing forensic software and, thereby, limits the number of tools available to the investigator. More importantly, however, it does not provide a complete solution since it only records snapshots of the state of the DEC without being able to provide a trusted log of all data operations actually performed on the evidence. Without a trusted log the question of whether a tool worked exactly as advertised cannot be answered with certainty, which opens the door to challenges (both legitimate and frivolous) of the results.In this paper, we propose a complementary mechanism, called the Forensic Discovery Auditing Module (FDAM), aimed at closing this loophole in the discovery process. FDAM can be thought of as a ‘clean-room’ environment for the manipulation of digital evidence, where evidence from containers is placed for controlled manipulation. It functions as an operating system component, which monitors and logs all access to the evidence and enforces policy restrictions. This allows the immediate, safe, and verifiable use of any tool deemed necessary by the examiner. In addition, the module can provide transparent support for multiple DEC formats, thereby greatly simplifying the adoption of open standards.     

论统一的同步录音录像制度构建——以新《刑事诉讼法》的实施为逻辑起点

从物质保障、社会条件、文化因素以及法制环境等层面分析,统一的同步录音、录像制度建构具有现实可行性.明确同步录音录像制度的适用范围,统一同步录音录像制度的实施主体,创设并严格执行同步录音录像的操作程序和规范,构建同步录音录像制度的监督制约体系是统一的同步录音录像制度建构的可行性路径.     

Digital photographic evidence and the adjudication of domestic violence cases

This study reported the impact of digital photographic evidence on domestic violence case outcomes in two Indiana counties. It analyzed whether outcomes differed between cases with digital photographic evidence (treatment group) and cases with no photographic evidence (comparison group). Examined impacts included guilty pleas, convictions, and sentence severity. Data included in the analysis came from case files and police and prosecutor interviews. Findings suggest that digital photographic evidence can be a useful prosecutorial tool – treatment group members were more likely to plead guilty, be convicted, and receive more severe sentences.     

Cognitive tempo,violent video games,and aggressive behavior in young boys

In a factorial design, impulsive and reflective children played video games with aggressive or nonaggressive themes. Interpersonal aggression and aggression toward inanimate objects were assessed in a free-play setting and interpersonal aggression was assessed during a frustrating situation. Results indicated that subjects who played the video game with aggressive content exhibited significantly more object aggression during free-play and more interpersonal aggression during the frustrating situation than youngsters who played nonaggressive video games. Aggressive behavior was unaffected by cognitive tempo.     

论公共摄像监视——以隐私权为中心

目前，在公共空间实施摄像监视已日益普遍。如何看待公共空间中摄像头“注视”之下的个人隐私权并予以相应保护，我国现有的立法尚未予以足够关注，司法上亦采取较为保守的态度。事实上，个人身处公共空间，亦有其隐私利益存在。因为隐私并不仅仅是他人头脑中关于人们自身信息的某种缺失，而更多的是，人们对于自身信息的控制。摄像头长时间地有计划地有目的地注视，不同于路人偶然无意识的一瞥，它将使人们因此而丧失对自身信息的选择暴露权和控制权，从而导致个人在公共空间的某些隐私利益的丧失。鉴于此，我们认为有必要从立法上和司法上规范公共摄像监视行为，捍卫人们在公共空间中的必要的隐私利益，维护人们在公共空间中的个性正义。     

监控录像图像伪造手法及其特征综述

随着监控录像设施越来越多，在诉讼中使用监控录像作为证据的案件也越来越多。使用伪造或变造的监控录像的案件也有发生，本文提出了伪造监控录像图像的几种不同手法，并分析了不同伪造手法图像所表现的特征。