Forensic integrity verification of video recordings based on MTS files

Digital video is used in criminal trials as evidence with legal responsibility because video content vividly depicts events occurring at a crime scene. However, using sophisticated video editing software, assailants can easily manipulate visible clues for their own benefit. Therefore, the integrity of digital video files acquired or submitted as evidence must be ensured. Forensic analysis of digital video is key to ensuring the integrity of links with individual cameras. In this study, we analyzed whether it is possible to ensure the integrity of MTS video files. Herein, we propose a method to verify the integrity of MTS files encoded by advanced video coding high definition (AVCHD), which is frequently used for video recording. To verify MTS file integrity, we propose five features. Codec information, picture timing, and camera manufacture/model are modified AVI and MP4-like format video verification features. Group of pictures and Universally Unique Identifier patterns were specifically developed for MTS streams. We analyzed the features of 44 standard files recorded using all recording options of seven cameras. We checked whether integrity can be validated on unmanipulated videos recorded in various environments. In addition, we considered whether manipulated MTS files edited in video editing software could be validated. Experimental results show that all unmanipulated and manipulated MTS files with known recording devices were discriminated only when all five features were checked. These results show that the proposed method verifies the integrity of MTS files, strengthening the validity of MTS file-based evidence in trials.     

Forensic analysis of video file formats

Video file format standards define only a limited number of mandatory features and leave room for interpretation. Design decisions of device manufacturers and software vendors are thus a fruitful resource for forensic video authentication. This paper explores AVI and MP4-like video streams of mobile phones and digital cameras in detail. We use customized parsers to extract all file format structures of videos from overall 19 digital camera models, 14 mobile phone models, and 6 video editing toolboxes. We report considerable differences in the choice of container formats, audio and video compression algorithms, acquisition parameters, and internal file structure. In combination, such characteristics can help to authenticate digital video files in forensic settings by distinguishing between original and post-processed videos, verifying the purported source of a file, or identifying the true acquisition device model or the processing software used for video processing.     

Passive forensics in image and video using noise features: A review

Due to present of enormous free image and video editing software on the Internet, tampering of digital images and videos have become very easy. Validating the integrity of images or videos and detecting any attempt of forgery without use of active forensic technique such as Digital Signature or Digital Watermark is a big challenge to researchers. Passive forensic techniques, unlike active techniques, do not need any preembeded information about the image or video. The proposed paper presents a comprehensive review of the recent developments in the field of digital image and video forensic using noise features. The previously existing methods of image and video forensics proved the importance of noises and encourage us for the study and perform extensive research in this field. Moreover, in this paper, forensic task cover mainly source identification and forgery detection in the image and video using noise features. Thus, various source identification and forgery detection methods using noise features are reviewed and compared in this paper for image and video. The overall objective of this paper is to give researchers a broad perspective on various aspects of image and video forensics using noise features. Conclusion part of this paper discusses about the importance of noise features and the challenges encountered by different image and video forensic method using noise features.     

Differentiating synthetic and optical zooming for passive video forgery detection: An anti-forensic perspective

A video can be manipulated using synthetic zooming without using the state-of-the-art video forgeries. Synthetic zooming is performed by upscaling individual frames of a video with varying scale factors followed by cropping them to the original frame size. These manipulated frames resemble genuine natural (optical) camera zoomed frames and hence may be misclassified as a pristine video by video forgery detection algorithms. Even if such a video is classified as forged, forensic investigators may ignore the results, believing it as part of an optical camera zooming activity. Hence, this can be used as an anti-forensic method which eliminates digital evidence. In this paper, we propose a method for differentiating optical camera zooming from synthetic zooming for video tampering detection. The features used for this method are pixel variance correlation and sensor pattern noise. Experimental results on a dataset containing 3200 videos show the effectiveness of the proposed method.     

Authentication of Surveillance Videos: Detecting Frame Duplication Based on Residual Frame

Nowadays, surveillance systems are used to control crimes. Therefore, the authenticity of digital video increases the accuracy of deciding to admit the digital video as legal evidence or not. Inter‐frame duplication forgery is the most common type of video forgery methods. However, many existing methods have been proposed for detecting this type of forgery and these methods require high computational time and impractical. In this study, we propose an efficient inter‐frame duplication detection algorithm based on standard deviation of residual frames. Standard deviation of residual frame is applied to select some frames and ignore others, which represent a static scene. Then, the entropy of discrete cosine transform coefficients is calculated for each selected residual frame to represent its discriminating feature. Duplicated frames are then detected exactly using subsequence feature analysis. The experimental results demonstrated that the proposed method is effective to identify inter‐frame duplication forgery with localization and acceptable running time.     

Evaluating digital video transcoding for forensic derivative results

Video data received for analysis often come in a variety of file formats and compression schemes. These data are often transcoded to a consistent file format for forensic examination and/or ingesting into a video analytic system. The file format often requested is an MP4 file format. The MP4 file format is a very common and a universally accepted file format. The practical application of this transcoding process, across the analytical community, has generated differences in video quality. This study sought to explore possible origins of the differences and assist the practitioner by defining minimum recommendations to ensure that quality of the video data is maintained through the transcoding process. This study sought to generate real world data by asking participants to transcode provided video files to an MP4 file format using programs they would typically utilize to perform this task. The transcoded results were evaluated based on measurable metrics of quality. As the results were analyzed, determining why these differences might have occurred became less about a particular software application and more about the settings employed by the practitioner or of the capabilities of the program. This study supports the need for any video examiner who is transcoding video data to be cognizant of the settings utilized by the programs employed for transcoding video data, as loss of video quality can affect analytics as well as further analysis.     

Detection of frame deletion in HEVC-Coded video in the compressed domain

In this paper, we propose an algorithm for detecting frame deletion in HEVC-coded video in the compressed domain. Specifically, we focus on the frame type changes occurring upon frame deletion, which cause slight differences between the coding patterns in original and forged video. Then, we identify discriminating coding patterns for use as features, which are classified by machine learning classifiers. Furthermore, we propose video sequence integrity detection on a group-of-picture basis, which is computationally efficient and robust even when applied to static videos and videos with genuine scene changes. The experimental results show that the proposed technique can classify HEVC-coded videos more accurately than previous methods. In addition, the results demonstrate that the selected features work harmoniously in discrimination and that the learning-based classifiers are more robust and reliable than model-based classifiers.     

基于YouTube的视频源鉴别

在一定条件下,传感器的光电响应非均匀(PRNU)特性能够作为拍摄器材的特异性指标,用于视频图像的来源鉴别.本文利用Luká(s)等[1]定义的小波滤波器提取经过AVC方式重新编码的视频文件中的光电响应非均匀特性模式,研究调节分辨率和编码参数对拍摄器材的光电响应非均匀性模式的影响,发现部分经过重新编码的视频仍能够通过光电响应非均匀特性进行拍摄器材的鉴别.     

Information assurance in a distributed forensic cluster

When digital forensics started in the mid-1980s most of the software used for analysis came from writing and debugging software. Amongst these tools was the UNIX utility ‘dd’ which was used to create an image of an entire storage device. In the next decade the practice of creating and using ‘an image’ became established as a fundamental base of what we call ‘sound forensic practice’. By virtue of its structure, every file within the media was an integrated part of the image and so we were assured that it was wholesome representation of the digital crime scene. In an age of terabyte media ‘the image’ is becoming increasingly cumbersome to process, simply because of its size. One solution to this lies in the use of distributed systems. However, the data assurance inherent in a single media image file is lost when data is stored in separate files distributed across a system. In this paper we assess current assurance practices and provide some solutions to the need to have assurance within a distributed system.     

Study on the tracking revision history of MS Word files for forensic investigation

Document forensics remains an important field of digital forensics. To date, previously existing methods focused on the last saved version of the document file stored on the PC; however, the drawback of this approach is that this provides no indication as to how the contents have been modified. This paper provides a novel method for document forensics based on tracking the revision history of a Microsoft Word file. The proposed method concentrates on the TMP file created when the author saves the file and the ASD file created periodically by Microsoft Word during editing. A process whereby the revision history lists are generated based on metadata of the Word, TMP, and ASD files is presented. Furthermore, we describe a technique developed to link the revision history lists based on similarity. These outcomes can provide considerable assistance to a forensic investigator trying to establish the extent to which document file contents have been changed and when the file was created, modified, deleted, and copied.     

Analyzing multiple logs for forensic evidence

Information stored in logs of a computer system is of crucial importance to gather forensic evidence of investigated actions or attacks. Analysis of this information should be rigorous and credible, hence it lends itself to formal methods. We propose a model checking approach to the formalization of the forensic analysis of logs. A set of logs is modeled as a tree whose labels are events extracted from the logs. In order to provide a structure to these events, we express each event as a term of algebra. The signature of the algebra is carefully chosen to include all relevant information necessary to conduct the analysis. Properties of the model, attack scenarios, and event sequences are expressed as formulas of a logic having dynamic, linear, temporal, and modal characteristics. Moreover, we provide a tableau-based proof system for this logic upon which a model checking algorithm can be developed. We use our model in a case study to demonstrate how events leading to an SYN attack can be reconstructed from a number of system logs.     

Dynamic Characteristics of Signatures: Effects of Writer Style on Genuine and Simulated Signatures

The aims of this study were to determine if computer‐measured dynamic features (duration, size, velocity, jerk, and pen pressure) differ between genuine and simulated signatures. Sixty subjects (3 equal groups of 3 signature styles) each provided 10 naturally written (genuine) signatures. Each of these subjects then provided 15 simulations of each of three model signatures. The genuine (N = 600) and simulated (N = 2700) signatures were collected using a digitizing tablet. MovAlyzeR^® software was used to estimate kinematic parameters for each pen stroke. Stroke duration, velocity, and pen pressure were found to discriminate between genuine and simulated signatures regardless of the simulator's own style of signature or the style of signature being simulated. However, there was a significant interaction between style and condition for size and jerk (a measure of smoothness). The results of this study, based on quantitative analysis and dynamic handwriting features, indicate that the style of the simulator's own signature and the style of signature being simulated can impact the characteristics of handwriting movements for simulations. Writer style characteristics might therefore need to be taken into consideration as potentially significant when evaluating signature features with a view to forming opinions regarding authenticity.     

A critical evaluation of two methods of signature analysis.

The assessment of signature disguise, where an individual attempts to disguise their own signature on a document with the intent of later disclaiming it (so-called 'view to deny' signatures), is a problem faced by many document examiners. This study evaluates a method known as the angle value test and another experimental method involving angle measurements to determine if either of them can reliably establish whether a questioned signature is disguised or has been written by another person. By using 29 sets of normal and disguised signatures, both methods of analysis were shown to be unreliable techniques for identifying the author of a particular signature.     

Individual Camera Identification Using Correlation of Fixed Pattern Noise in Image Sensors

Abstract:  This paper presents results of experiments related to individual video camera identification using a correlation coefficient of fixed pattern noise (FPN) in image sensors. Five color charge-coupled device (CCD) modules of the same brand were examined. Images were captured using a 12-bit monochrome video capture board and stored in a personal computer. For each module, 100 frames were captured. They were integrated to obtain FPN. The results show that a specific CCD module was distinguished among the five modules by analyzing the normalized correlation coefficient. The temporal change of the correlation coefficient during several days had only a negligible effect on identifying the modules. Furthermore, a positive relation was found between the correlation coefficient of the same modules and the number of frames that were used for image integration. Consequently, precise individual camera identification is enhanced by acquisition of as many frames as possible.     

A passive approach for effective detection and localization of region-level video forgery with spatio-temporal coherence analysis

In this paper, we present a passive approach for effective detection and localization of region-level forgery from video sequences possibly with camera motion. As most digital image/video capture devices do not have modules for embedding watermark or signature, passive forgery detection which aims to detect the traces of tampering without embedded information has become the major focus of recent research. However, most of current passive approaches either work only for frame-level detection and cannot localize region-level forgery, or suffer from high false detection rates for localization of tampered regions. In this paper, we investigate two common region-level inpainting methods for object removal, temporal copy-and-paste and exemplar-based texture synthesis, and propose a new approach based on spatio-temporal coherence analysis for detection and localization of tampered regions. Our approach can handle camera motion and multiple object removal. Experiments show that our approach outperforms previous approaches, and can effectively detect and localize regions tampered by temporal copy-and-paste and texture synthesis.     

再看摹仿签名笔迹鉴定

由于签名笔迹字数少、可摹仿性强的特点,长期以来,摹仿签名笔迹鉴定始终是笔迹鉴定的难点。笔者从不同类型的摹仿方法出发,讨论不同方法下摹仿签名笔迹的特点,总结其特征规律。同时要重视笔迹鉴定过程中了解相关案情,为识别是否存在摹仿现象提供线索。在此基础之上,对比摹仿签名笔迹特征的变化规律,并从摹仿签名笔迹特征反映构成方面系统性地进行鉴定,鉴别是否存在摹仿签名的情况。通过撰写此文,以期对摹仿签名笔迹鉴定实务具有借鉴意义。     

The dynamic character of disguise behavior for text-based, mixed, and stylized signatures

The aims of this study were to determine if dynamic parameters (duration, size, velocity, jerk, and pen pressure) differed for signing style (text-based, stylized, and mixed) and if signing style influences handwriting dynamics equally across three signature conditions (genuine, disguised, and auto-simulation). Ninety writers provided 10 genuine signatures, five disguised signatures, and five auto-simulated signatures. All 1800 signatures were collected using a digitizing tablet resulting in a database of each signature's dynamic characteristics. With genuine signatures, there were significant differences between styles for size, velocity, and pen pressure, and there were significant differences between genuine signatures and at least one of the un-natural signature conditions for all parameters. For velocity and size, these changes with condition were dependent on style. Changes with condition for the other parameters were similar for the three styles. This study shows that there are differences among natural signature styles and disguise behaviors that may be relevant in forensic signature examinations.     

Human height estimation from highly distorted surveillance image

Video surveillance camera (VSC) is an important source of information during investigations especially if used as a tool for the extraction of verified and reliable forensic measurements. In this study, some aspects of human height extraction from VSC video frames are analyzed with the aim of identifying and mitigating error sources that can strongly affect the measurement. More specifically, those introduced by lens distortion are present in wide-field-of-view lens such as VSCs. A weak model, which is not able to properly describe and correct the lens distortion, could introduce systematic errors. This study focuses on the aspect of camera calibration to verify human height extraction by Amped FIVE software, which is adopted by the Forensic science laboratories of Carabinieri Force (RaCIS), Italy. A stable and reliable approach of camera calibration is needed since investigators have to deal with different cameras while inspecting the crime scene. The performance of the software in correcting distorted images is compared with a technique of single view self-calibration. Both approaches were applied to several frames acquired by a fish-eye camera and then measuring the height of five different people. Moreover, two actual cases, both characterized by common low-resolution and distorted images, were also analyzed. The height of four known persons was measured and used as reference value for validation. Results show no significant difference between the two calibration approaches working with fish-eye camera in test field, while evidence of differences was found in the measurement on the actual cases.     

Quantifying and Ranking Quality for Acquired Recordings on Digital Video Recorders

As the closed-circuit television (CCTV) security industry transitioned from analog media to digital video recorders (DVRs) with digital storage, the law enforcement community struggled with the means with which to collect the recordings. New guidelines needed to be established to determine the collection method which would be efficient as well as provide the best quality evidence from live DVRs. A test design was developed to measure, quantify, and rank the quality of acquisition methods used on live systems from DVRs typically used in digital CCTV systems. The purpose was to determine guidelines for acquiring the best quality video for investigative purposes. A test pattern which provided multiple quantifiable metrics for comparison between the methods of acquisition was used. The methods of acquisition included direct data download of the proprietary file and open file format as well as recording the video playback from the DVR via the available display monitor connections including the composite video, Video Graphics Array (VGA), and high-definition multimedia interface (HDMI). While some acquisition methods may provide the best quality evidence, other methods of acquisition are not to be discounted depending on the situation and need for efficiency. As an investigator that needs to retrieve video evidence from live digital CCTV systems, the proprietary file format, overall, provides the best quality evidence. However, depending on the circumstance and as recording technology continues to evolve, options other than the proprietary file format may provide quality that is equal to or greater than the proprietary file format.