Video Authentication

FORENSICS: VIDEO AUTHENTICATION PROCESS

Free consultation 800-647-4281
http://www.primeauforensics.com

In audio/visual forensics studies and application, video authentication is an intricate process requiring extensive training, experience and sophisticated tools and equipment. Add ever-changing technological advances and increased use of recording devices by businesses and the general public – and you begin to glimpse the expertise needed by today’s AV forensics professionals.

This post provides an overview of the process of authenticating a digital video file and videotape for purposes of verifying it as legal evidence. Should you need the services of a forensics expert, Ed Primeau has been a practitioner in this scientific field since 1984 and is a certified digital video forensic expert.

Recording over tapes is a common practice with consumers. It’s also quite common with security camera/surveillance tapes. Repeated over-recording of surveillance tapes is pretty much the norm since the use of new, blank tapes for every recording use would be costly, especially if security cameras are on 24/7. As a result of reusing tapes, videotapes being considered for use as evidence in court must often be examined for authenticity and recording integrity by AV forensics professionals.

The first step in the authentication process for an analogue video tape is to make a copy on the VCR used to create the original evidence. This is called making an exemplar.

VCRs actually have an identity, much like humans do. With people, we identify human characteristics like eye color, hair color, weight, body size/type, DNA, fingerprints. VCRs also have record “signatures” which forensics experts need to examine. Essentially, these identifying signatures or recording characteristics are: stop, start, record, record interruptions and other indications discovered on the tape’s audio tracks.

With video recorders, we identify signature characteristics in several ways. First, there are two distinct audio tracks generated on most videotapes that have replicated (or recorded) images existing on tape formats, such as VHS tape. The two tracks are: (1) Linear and (2) Non-linear. Audio tracks provide forensics experts with much information – as does the video control track.

We begin documenting the identity of the (alleged) recording device or VCR by recording a fresh video test pattern – via an NTSC test pattern generator – and a series of audio tones generated by an industry-standard tone generator. These are recorded onto a virgin (blank) tape.

Hertz frequencies are also examined. Hertz, or Hz, is an audio frequency measurement, similar to decibels (db) measuring audio volume intensity. HZ frequencies examined in forensics generally include 250 Hz, 1000 Hz, 3000 Hz and 8000 Hz. Reading and comparing these frequencies is achieved by use of a computer spectrum analyzer. (Primeau Productions uses an industry-standard analyzer made by made by Sound Forge.)

A comparison analysis is conducted on the exemplar and on the original evidence tape. Note that even if the videotape being examined under forensics scrutiny has no picture, the audio tracks can still be examined for evidence, along with the video’s control track.

Once we have an exemplar made on the same equipment on which the evidence was made, it’s time to address further comparisons.

Video recording signatures (think of them as similar to human signatures) are examined. Stop/start record signatures are studied; record-interrupt distances are measured physically. Developing” the tape itself by applying Krylon magnetic tape developing fluid exhibits the nature of the signature or anomolie. This fluid is amazingly effective in revealing the true recording signature – very similar to how fingerprint dusting powder reveals a person’s fingerprints.

After viewing the entire videotape using the “fast forward” mode, where ever a record interrupt is visually observed, the tape is stopped as near as possible to the exact interruption spot. The tape is disengaged (ejected) and physical exam of the tape commences. Krylon magnetic tape developing fluid is applied to the tape itself to reveal stops in the tape. (See exhibit 1, attached, which is a digital snapshot of a VHS tape “developed” with the magnetic tape developing fluid.

Notice the vertical line straight up the tape. This is where the recording stops.

It is apparent that, due to the region to the right of the vertical line, this tape has been re-recorded over a previous program. The distance between the stop signature and the curved restart signature to the right of the dark region is the gap in the engage mechanism. The curved program continuing would be another straight line of the tape, indicating that recording was stopped then restarted.

When a new videotape is inserted into a recorder, the tape is threaded into the engage mechanism. This places the tape against the recording head; this action actually pulls the tape out of the shell and threads it across the tape head. This process can be recreated if it becomes necessary.

If a recording is stopped, the engage mechanism disengages. If the recording is continued, and the tape is not shuttled, the tape is re-engaged and the recording continues. However, some physical “glitch” will be evident in both the TV monitor image and in the physical examination of the developed magnetic tape. In addition, evidence of this interrupt is often obvious (and substantiated) by examining the control track.

Since Exhibit 1 continues with a curved line, this is an indication that the tape was stopped and the time taken for the machine to disengage and stop recording. This is obvious due to the blank space between the vertical line and the curved record disengage which follows.

After the first identified record interrupt is examined and documented, physical study of the tape continues by repeating the process in search for any other interrupts – re-engaging the VHS tape into fast-forward tracking mode until another glitch is noticed. Naturally, the entire above process of developing and observing is again repeated for each instance of noted interruption.

Next, as required by the scientific community and forensics procedures, the exact length of the videotape must be established. While most videotapes have a time/length stamped on the spine, length verification is needed. The length is imprinted on the spine of the plastic shell that houses the physical tape itself – example: 120 or 160 may be imprinted. However, the stated length must be verified by taking a measurement. This is verified using information obtained using the hours/minutes/seconds display on a well-maintained, professional videotape recorder.

To do this, the tape is completely rewound to the beginning and the tape counter is reset as the start point. Then, fast-forwarding the tape to the end, the digital counter’s reading at the tape’s end point is observed and noted. Now, if the reading on the videotape display count is less than the indicated stamped length, this can be an indication that the tape has been tampered with. If the time is more than what is indicated on the spine, that’s acceptable. (Most tapes are loaded “long” from the factory; a manufacturer’s 120 minute-length tape may actually be 121¼ minutes, or thereabouts.)

Then, using a cross pulse monitor, any glitches discovered on the tape are measured and checked considering other conditions that exist on the tape (i.e., the tape’s “fingerprints.”)

The cross pulse monitor measures the glitches – different electrical and magnetic fields on the videotape – similar to how an EKG records and measures electronic signals from a human heart. Even if there is no video image on the tape, tape signatures can still be revealed during this monitoring test as long as the tape has been recorded on at some point.

Glitches are also examined using a frame-accurate professional tape deck. Since NTSC video (the standard in the U.S.) is 29.95 frames per second, one can observe individual video frames using the frame-accurate machine. If a tape has been re-recorded, a stop signature will be frame accurate (i.e., one frame has an image and the next frame does not).

On the frame-accurate deck, one will notice video frame deterioration over a series of several frames after the stop occurs, the deterioration appearing as “snow,” or video noise, on the screen/monitor. Basically, the image kind of fades out; then we can observe a gradual fade back-in from “snow” to the resumed image that was captured on the tape during recording. (Hence, Exhibit 1’s curved restart of previous recorded program.)

If a recording is stopped, and the tape was disengaged from the tape head then re-recorded, we would notice something very different. Physical examination using the magnetic tape developing fluid would reveal a straight vertical line, indicating the stop, and a straight vertical line indicating the re-start of the recording. A professional, frame-accurate video deck would reveal frame-accurate stop/start with no fade-in. Many of these tests can be conducted or recreated using a professional frame-accurate video deck.

If any frames need to be examined further, the video sequence is loaded into a computer using a professional video capture card, manufactured by Targa. NOTE: Targa is a professional-brand capture card. Off-market and consumer video capture cards are not of the highest resolution; they should not be used when forensics/scientific reliability is at stake.

Once the footage has been loaded into the computer, using the Adobe Premiere program, we can further examine the frame sequence and print out any exhibits as necessary.

Note, also, that videotapes can be physically cut and spliced. Thus, glitches detected during the process will also prompt the forensics expert to examine a tape for physical splicing (as opposed to electronic splicing or edits resulting from re-recording over tape images). A splice repair is generally made with an adhesive-style clear tape on the videotape. To the untrained eye, these could appear to be several scene changes. To the trained eye, these indicate that the tape has been recorded on previously or is possibly a physical splice to be examined.

Note, too, that it’s a good idea to read these and other stop/start signatures using an oscilloscope, as well as physically using Krylon fluid to confirm record-interrupt theories.

Next, all test results must be compared from the original evidence tape to the exemplar test results to determine if both tapes were made on the same equipment. The scientific community requires that forensics experts document all test steps and procedures, as well as equipment type, as in the authentication process in order to substantiate conclusions arrived at.

The digital video examination process uses similar equipment but involves a much different testing process. Digital video files are examined and authenticated based on their chain of custody. The equipment used to create the digital video files must be understood and examined as well. Compression, image rate and codes are also studied as part of this investigative process.