Video Authentication

FORENSICS: VIDEO AUTHENTICATION PROCESS

Free consultation 800-647-4281
http://www.primeauforensics.com

In audio/visual forensics studies and application, video authentication is an intricate process requiring extensive training, experience and sophisticated tools and equipment. Add ever-changing technological advances and increased use of recording devices by businesses and the general public – and you begin to glimpse the expertise needed by today’s AV forensics professionals.

This post provides an overview of the process of authenticating a digital video file and videotape for purposes of verifying it as legal evidence. Should you need the services of a forensics expert, Ed Primeau has been a practitioner in this scientific field since 1984 and is a certified digital video forensic expert.

Recording over tapes is a common practice with consumers. It’s also quite common with security camera/surveillance tapes. Repeated over-recording of surveillance tapes is pretty much the norm since the use of new, blank tapes for every recording use would be costly, especially if security cameras are on 24/7. As a result of reusing tapes, videotapes being considered for use as evidence in court must often be examined for authenticity and recording integrity by AV forensics professionals.

The first step in the authentication process for an analogue video tape is to make a copy on the VCR used to create the original evidence. This is called making an exemplar.

VCRs actually have an identity, much like humans do. With people, we identify human characteristics like eye color, hair color, weight, body size/type, DNA, fingerprints. VCRs also have record “signatures” which forensics experts need to examine. Essentially, these identifying signatures or recording characteristics are: stop, start, record, record interruptions and other indications discovered on the tape’s audio tracks.

With video recorders, we identify signature characteristics in several ways. First, there are two distinct audio tracks generated on most videotapes that have replicated (or recorded) images existing on tape formats, such as VHS tape. The two tracks are: (1) Linear and (2) Non-linear. Audio tracks provide forensics experts with much information – as does the video control track.

We begin documenting the identity of the (alleged) recording device or VCR by recording a fresh video test pattern – via an NTSC test pattern generator – and a series of audio tones generated by an industry-standard tone generator. These are recorded onto a virgin (blank) tape.

Hertz frequencies are also examined. Hertz, or Hz, is an audio frequency measurement, similar to decibels (db) measuring audio volume intensity. HZ frequencies examined in forensics generally include 250 Hz, 1000 Hz, 3000 Hz and 8000 Hz. Reading and comparing these frequencies is achieved by use of a computer spectrum analyzer. (Primeau Productions uses an industry-standard analyzer made by made by Sound Forge.)

A comparison analysis is conducted on the exemplar and on the original evidence tape. Note that even if the videotape being examined under forensics scrutiny has no picture, the audio tracks can still be examined for evidence, along with the video’s control track.

Once we have an exemplar made on the same equipment on which the evidence was made, it’s time to address further comparisons.

Video recording signatures (think of them as similar to human signatures) are examined. Stop/start record signatures are studied; record-interrupt distances are measured physically. Developing” the tape itself by applying Krylon magnetic tape developing fluid exhibits the nature of the signature or anomolie. This fluid is amazingly effective in revealing the true recording signature – very similar to how fingerprint dusting powder reveals a person’s fingerprints.

After viewing the entire videotape using the “fast forward” mode, where ever a record interrupt is visually observed, the tape is stopped as near as possible to the exact interruption spot. The tape is disengaged (ejected) and physical exam of the tape commences. Krylon magnetic tape developing fluid is applied to the tape itself to reveal stops in the tape. (See exhibit 1, attached, which is a digital snapshot of a VHS tape “developed” with the magnetic tape developing fluid.

Notice the vertical line straight up the tape. This is where the recording stops.

It is apparent that, due to the region to the right of the vertical line, this tape has been re-recorded over a previous program. The distance between the stop signature and the curved restart signature to the right of the dark region is the gap in the engage mechanism. The curved program continuing would be another straight line of the tape, indicating that recording was stopped then restarted.

When a new videotape is inserted into a recorder, the tape is threaded into the engage mechanism. This places the tape against the recording head; this action actually pulls the tape out of the shell and threads it across the tape head. This process can be recreated if it becomes necessary.

If a recording is stopped, the engage mechanism disengages. If the recording is continued, and the tape is not shuttled, the tape is re-engaged and the recording continues. However, some physical “glitch” will be evident in both the TV monitor image and in the physical examination of the developed magnetic tape. In addition, evidence of this interrupt is often obvious (and substantiated) by examining the control track.

Since Exhibit 1 continues with a curved line, this is an indication that the tape was stopped and the time taken for the machine to disengage and stop recording. This is obvious due to the blank space between the vertical line and the curved record disengage which follows.

After the first identified record interrupt is examined and documented, physical study of the tape continues by repeating the process in search for any other interrupts – re-engaging the VHS tape into fast-forward tracking mode until another glitch is noticed. Naturally, the entire above process of developing and observing is again repeated for each instance of noted interruption.

Next, as required by the scientific community and forensics procedures, the exact length of the videotape must be established. While most videotapes have a time/length stamped on the spine, length verification is needed. The length is imprinted on the spine of the plastic shell that houses the physical tape itself – example: 120 or 160 may be imprinted. However, the stated length must be verified by taking a measurement. This is verified using information obtained using the hours/minutes/seconds display on a well-maintained, professional videotape recorder.

To do this, the tape is completely rewound to the beginning and the tape counter is reset as the start point. Then, fast-forwarding the tape to the end, the digital counter’s reading at the tape’s end point is observed and noted. Now, if the reading on the videotape display count is less than the indicated stamped length, this can be an indication that the tape has been tampered with. If the time is more than what is indicated on the spine, that’s acceptable. (Most tapes are loaded “long” from the factory; a manufacturer’s 120 minute-length tape may actually be 121¼ minutes, or thereabouts.)

Then, using a cross pulse monitor, any glitches discovered on the tape are measured and checked considering other conditions that exist on the tape (i.e., the tape’s “fingerprints.”)

The cross pulse monitor measures the glitches – different electrical and magnetic fields on the videotape – similar to how an EKG records and measures electronic signals from a human heart. Even if there is no video image on the tape, tape signatures can still be revealed during this monitoring test as long as the tape has been recorded on at some point.

Glitches are also examined using a frame-accurate professional tape deck. Since NTSC video (the standard in the U.S.) is 29.95 frames per second, one can observe individual video frames using the frame-accurate machine. If a tape has been re-recorded, a stop signature will be frame accurate (i.e., one frame has an image and the next frame does not).

On the frame-accurate deck, one will notice video frame deterioration over a series of several frames after the stop occurs, the deterioration appearing as “snow,” or video noise, on the screen/monitor. Basically, the image kind of fades out; then we can observe a gradual fade back-in from “snow” to the resumed image that was captured on the tape during recording. (Hence, Exhibit 1’s curved restart of previous recorded program.)

If a recording is stopped, and the tape was disengaged from the tape head then re-recorded, we would notice something very different. Physical examination using the magnetic tape developing fluid would reveal a straight vertical line, indicating the stop, and a straight vertical line indicating the re-start of the recording. A professional, frame-accurate video deck would reveal frame-accurate stop/start with no fade-in. Many of these tests can be conducted or recreated using a professional frame-accurate video deck.

If any frames need to be examined further, the video sequence is loaded into a computer using a professional video capture card, manufactured by Targa. NOTE: Targa is a professional-brand capture card. Off-market and consumer video capture cards are not of the highest resolution; they should not be used when forensics/scientific reliability is at stake.

Once the footage has been loaded into the computer, using the Adobe Premiere program, we can further examine the frame sequence and print out any exhibits as necessary.

Note, also, that videotapes can be physically cut and spliced. Thus, glitches detected during the process will also prompt the forensics expert to examine a tape for physical splicing (as opposed to electronic splicing or edits resulting from re-recording over tape images). A splice repair is generally made with an adhesive-style clear tape on the videotape. To the untrained eye, these could appear to be several scene changes. To the trained eye, these indicate that the tape has been recorded on previously or is possibly a physical splice to be examined.

Note, too, that it’s a good idea to read these and other stop/start signatures using an oscilloscope, as well as physically using Krylon fluid to confirm record-interrupt theories.

Next, all test results must be compared from the original evidence tape to the exemplar test results to determine if both tapes were made on the same equipment. The scientific community requires that forensics experts document all test steps and procedures, as well as equipment type, as in the authentication process in order to substantiate conclusions arrived at.

The digital video examination process uses similar equipment but involves a much different testing process. Digital video files are examined and authenticated based on their chain of custody. The equipment used to create the digital video files must be understood and examined as well. Compression, image rate and codes are also studied as part of this investigative process.

Video Forensic Analysis and Tips

Today, evidence from video recordings plays an increasingly significant role in the criminal justice process. It’s an example of the newer forms of evidence that law enforcement officials take into consideration when presenting facts in court cases.

Video footage from in-car mounted cameras in police cars, security cameras used for businesses, institutions, stores, etc. – plus footage from private citizens – is often surfacing as evidence in legal situations. Perhaps you have convinced your department head or company to install a surveillance system to monitor security situations and possibly detect instances of crime. And perhaps the camera/recorder has captured footage that may be key to a convicting a perpetrator. Unfortunately, during the “discovery” stage of the case, the defendant’s attorney states that something happened to the video recording; there is a glitch. He announces that a forensics expert is now on his defense team to prove that your video has been falsified and/or inadmissible.

This brief article covers video forensic examination tips that may keep your recordings glitch-free. If you are involved in video recordings that can be used for legal evidence, this article may save you from having your evidence challenged in court.

As a Video Forensic Expert, I’m often hired by law enforcement officials, attorneys and corporations to report on the methodology used in videos cited as legal evidence. As part of my work, I review many resources, like police chase footage, hidden-camera coverage from workplaces, retail store surveillance footage, and so on. The question I’m most often asked is to respond to is: “Was this video recording edited or altered in any way?”

To respond to this, forensic experts must gather scientific clues to answer the following questions:

• What do we know about this recording to be true (within a reasonable degree of professional certainty)?
• On what type of equipment was the video recording made?
• Is the original recording of the video available for examination?
• Is the original recording equipment that made the tape also available for examination?

While extensive technology is certainly involved in the video recording process, and this article cannot begin to address it fully, here are theories/procedures regarding examination which provide an overview of how forensic experts may need to examine and identify video anomalies.

Anomalies are abnormalities, deviations or “breaks” in the recording process as evidenced on the physical tape or digital video file. These aberrations can impact the legitimacy of a video (digital or analogue) as a piece of legal evidence.

Digital Video
When a videotape recorder or digital video recorder (DVR)/video camera records to videotape or DVR, the recording process creates a very structured format of code and information that is embedded on the tape or hard drive to create pictures and sound and signals. (Note, all videotape, except ¾” format video, travels from the left spool to the right spool when the machine is in the “Record,” “Playback” or “Fast Forward” modes. DVR recordings store video signal on hard drives using proprietary codecs or code and compression).

Digital video requires a different forensic process than analogue. Instead of recording the video image on tape, digital video is recorded on computer hard drives or digital video recorders (DVR).

Video systems that record digital video have several variable settings like frame rate and recycle time. If you look at the video below, you will better understand the importance of frame rate and forensic examination. Some officials and owners of digital video systems choose a lower frame rate to save on hard drive storage space. This makes it difficult for the forensic examiner to authenticate and identify events in question on the video recording. It is more efficient and effective for closed circuit television (CCTV) owners or purchase additional hard drive storage instead of choose a low digital video frame rate.

There are also several manufactures of digital video CCTV systems making it necessary for the video forensic expert to review operators and installation manuals for each system. I have been certified by the Pelco Global Institure in digital video and understand the details of digital video systems and the processes necessary to investigate digital video surveillance footage.








Analogue Video
On analogue tape, at the bottom of the tape (running just parallel to the tape edge) is the control track, or recording signature. Just above the control track is the composite picture and audio signal. On hi-fi VHS video recorders, above the composite signal, there are the hi-fi tracks. These are the physical areas of the recorded tape that forensic experts look at to determine if glitches – or anomalies, as they are professionally termed – exist.

There are two types of anomalies: non-destructive and destructive. A non-destructive anomaly is any deviation from the normal events one would expect to see and hear when viewing a videotape. In other words, a non-destructive anomaly or glitch in the tape could be an edit, an indication of a record interrupt or an over-record (recording over a previously recorded tape or segment of the tape).

When examining a tape for anomalies, the forensic expert must take all things into consideration. For this reason, it’s strongly recommended that the examination start by determining the origin of the recording device. If the machine that made the recording is available, a test recording – or exemplar – should be made using blank, unrecorded (virgin) tape. The goal here is to gather information on the alleged machine signatures from the original recording device used – that is, signals from the control track and the stop and start signatures. This is done for comparison purposes and to identify facts that may exist about the anomaly.

Next the tape being examined – i.e., the evidence or the alleged video containing the in-question anomaly – is viewed in “Play” or “Fast Forward” mode to determine the number of deviations or anomalies. Each deviation is carefully noted and examined using test equipment that helps to determine the characteristic of the anomaly. Much like the medical profession uses testing to research and document the reason for an illness, diagnostic tests are also necessary for forensics professionals; testing will eliminate certain factors so that real facts can be isolated to conclude, to a reasonable degree of professional certainty, the source or cause of the anomaly.

Many times it is necessary to physically examine the tape at the actual spot where the anomaly exists. An expert will physically examine the videotape itself to accomplish this, applying a special, non-destructive liquid to the tape which then develops the digital information so it can be reviewed. (This is much like how a photograph is developed, applying developer chemicals to the film.) Once the tape is “developed,” the expert can continue with the physical examination processes.

For a jaunt back in history – yes, in the “olden” days when I began my career – video recording tape was not yet in plastic shells but rather on spools, making it fairly easy to physically review the tape; but it was also quite easy to damage the tape’s edges since the tape was a good deal more exposed to mishandling. Videotape edge damage is considered a “destructive anomaly.” This damage can be in the form of a crease, tape crinkle, the result of a liquid spilled on the tape, etc. Of course, this can still occur with today’s videotape, even in the protective shell or tape housing, but not as easily.

Also, back then, videotape was comparatively more expensive than it is now. Thus, videotape was quite often recycled and recorded over for economy’s sake. As you might imagine, anomalies were fairly prevalent in those years. In one respect, this was good for my skills development as a forensics expert since I had the opportunity to experience dozens and dozens of destructive anomaly situations during the late ‘70s, for instance. This permitted me to gain great insight into their cause and nature.

When videotape started to be enclosed in cassette-styled plastic housings as VCRs gained in popularity, it became a bit more difficult to physically examine tapes for anomalies. So the scientific community evolved accordingly and developed new ways of testing.

Once you understand the science of how video recording works, how recordings and devices can be distinguished from each other, you’ll have a better understanding of how to go about identifying anomalies. I encourage you to read up on today’s video technology to advance your knowledge.
(You may also wish to refer to another article, “Forensics: Video Authentication Process,” included on this website.) Meantime, for simple practice in identifying anomalies, try creating your own:

Take a tape that has been previously recorded over. Fast forward the tape to about 10 minutes in and record something new, getting about 30-40 seconds’ worth. Rewind the tape and review your “over-record” characteristics. Take note of how the over-record starts and how it ends. These “in and out” points are characteristic of the equipment on which you recorded the program.

Of course there are many other forensic aspects in the study of anomalies –examination of stop/start record “signatures,” record-interrupt distances on the tape, study of the audio and video tracks, control track examination, application of magnetic tape developing fluid to further detect anomaly conditions – to name key areas.

But getting back to what’s most likely your interest in uncovering reasons for an anomaly, this works down to two essential questions: Did it occur as a result of wishing to intentionally cover up something? How do we know it wasn’t an honest mistake? And finally: Can we recover the images and sounds of the previously recorded material?

The answer is no. Once original material has been recorded over, it’s gone forever. But, as mentioned, the machine control track, audio tracks, etc., can provide recording “signatures” that exist on the physical tape; these may contain the clues toward determining others certain “truths” about the over-record. Our article on “Video Authentication Process” provides added information on these points.

When dealing with a video recording device and tapes that may be needed to substantiate legal situations: Make sure your equipment is cleaned and well-maintained and do not use videotape that has been recorded on previously. Use a new tape.

With the main investment already made in video equipment, the slight cost and effort to maintain that equipment – and the nominal cost of fresh tape stock for all recordings – is well spent. Having a clear recording on new tape stock (which avoids pre-existent anomalies that would exist on recycled tape) is an inexpensive way to better ensure your videotape evidence is solid and will be less apt to be court-challenged for authenticity.

800-647-4281

Closed Circuit TV Video Problems and Solutions

By Edward J Primeau, RI

As a video forensic expert, I have seen almost everything when it comes to Closed Circuit TV. Some of it is very disturbing, but much of it is benign -- from the lady whose ex-husband is stalking her, to the bank that just captured a robbery on video. Understanding CCTV systems has become part of the video forensic examiner’s job because a majority of video evidence is made on CCTV systems. In the following article, I will give you my tips, from a forensic perspective, on CCTV.

Imagine this. You are the proprietor of a convenience store. Last night at 11:06, you rang up a customer’s Snickers bar and a Jumbo Slurpee. The customer reached in his pocket, pulled out a gun, and put it to your head, demanding all the cash in the register. Terrified for your life, you gave him the money. Luckily you had a CCTV system and turned the tape over to the police. The police sent it to a forensic expert because all you could see on the tape was a dark silhouette of the criminal. Unfortunately, the robber’s face and features were unidentifiable.

Although CCTV systems can prove to be beneficial for many reasons, they can be useless without some well thought out considerations. My hope is that the law enforcement and legal community will read this article and pass on the information to the businesses in their community.

CCTV is a network of cameras hooked to a monitoring system so that various locations or angles can be viewed and/or recorded. It does differ from broadcast television in that CCTV cameras are not openly broadcast through the airwaves. However, some CCTV systems have point-to-point transmissions (wireless cameras) that could be intercepted by someone with the equipment and knowledge to intercept that signal.

The benefits outweigh the drawbacks for implementing CCTV systems for several reasons. Think of how CCTV systems have helped our traffic problems. Having cameras all over our roads and highways allows accidents and traffic jams to be discovered sooner so traffic can be rerouted. In banks, casinos, airports, shopping centers, businesses and military bases, CCTV systems can prove beneficial against crime.

There are some drawbacks that can really cause problems with CCTV systems.

These systems can be expensive. They can be considered an invasion of privacy. Also, a system can fail because of a bad or over-recycled tape, and the crime will not be recorded.”

For some strange reason, businesses who still use VHS tape to record their surveillance often insist in recycling their videos beyond a logical limit. Then, when the expert needs to lift an image off for identification, fuzzy, blurry photos are produced.

In the convenience store example above, the camera was in the wrong position. A light was installed in a recently added display that was not in the store when the CCTV system was installed. Nobody ever updated the CCTV system or performed maintenance to discover the problem.

The purpose of this article is to share some of my experiences with CCTV footage and provide some tips from a forensic expert’s point of view, sound advice to avoid costly mistakes and expensive forensic restoration.

Number one: Plan your CCTV system layout in advance. Do not put in a CCTV system without planning for your potential crime circumstances. What crimes could be executed under the watchful eyes of your CCTV system? You can call this crisis management. Draw a diagram of this activity, and use it as your blue print for locating your camera positions. If you own a business that has a back lot to cover, don’t just mount a camera to the back of your building, thinking it will do the job. Consider what you have to protect, the value of these items, and the various ways a criminal could get at them. Then, place the camera (s) to cover all potential activity. Consider multiple cameras because, in the long run, it will save you money.

Because so many systems were not planned thoroughly in advance, the majority of my forensic cases involve video restoration and clarification. So much of this can be avoided.

Number two: Use a digital video recorder and record direct to hard drive. If at all possible, do not use VHS . There are some great companies like Focus Micro and Crest Electronics who specialize in DVR CCTV systems, maintenance of the system, and training your staff to use them properly. They offer some excellent products and CCTV systems, and will even help you plan your system layout.

Number three: Make sure to account for lighting conditions as well as sun positions.

About one out of ten of my cases require comparison of a frame of evidence from darkly lit video with an exemplar frame or photo. Make sure there is light where your camera is located. If necessary, hire an electrician to put in a light or two near your camera, especially if the potential crimes that warrant the installation of your CCTV system can occur at night. Duh! I can hear the installer now, “Sure looked good in daylight”!

In addition, consider sun positions all year long. Remember sixth grade science class? The sun changes positions with the seasons. Bright sun facing the camera will cause the iris in the camera to close (in automatic position), causing the image of the perpetrator to darken. Try this with your home camera. Take a video of your friends with the sun behind them instead of behind you. The friends will appear dark because of the camera’s lenses adjusting for the high light level.

Number four: Plan camera positions for all possible situations. I have heard it said that if you want to rob a bank, wear a baseball cap. Why is it that CCTV installers put the cameras in high positions that will never show a criminal’s face?

Number five: Keep your camera clean. Car dealerships wash their windows and cars weekly if not more often. Why don’t they wash their cameras? Think about it. Many outdoor cameras are somewhat protected from the elements, but after awhile, dirt will still gather on the surface of the camera lenses.

A solution of Shaklee basic H or white vinegar in hot water will clean them nicely without scratching or clouding the lenses or protective housing. Harsh cleaning chemicals can scratch or cloud the glass, especially on Plexiglas camera housings.

Number six: Do not use wireless cameras. If at all possible, run cable and go wired for your entire network. Wireless cameras are unreliable, especially in storms.

Almost all maintenance can be performed by you or done very reasonably by a professional. Avoid costly mistakes and tragedy by keeping your system maintained and updated. (Use Google to seek a professional in your area who can help with your circumstances.)

Ed Primeau is a video forensic expert, Author, professional speaker and business owner in Rochester Hills Michigan. He is the author of two books, “The Art of Production” and “The Video Revolution”

email Ed@PrimeauProductions.com 

800-647-4281