Image & Video Forensics
Two different questions get asked of the same file. Is this genuine, and can we see what is actually in it? They are answered in that order, because enhancing a forgery only makes a forgery easier to believe. Container analysis, compression history and camera ballistics settle the first; a recorded, reversible chain of filters addresses the second.
What is image & video forensics?
Image and video forensics covers two distinct tasks that are often confused. Authentication asks whether a file is what it claims to be — taken by the device it claims, at the time it claims, without a region having been spliced, cloned or regenerated since. Enhancement asks whether detail already present in the recording can be made legible enough to support a conclusion about a face, a plate or a sequence of events.
The order matters. Authentication runs on the original file, before any processing, because the artefacts that expose manipulation — quantisation table mismatches, inconsistent sensor noise, duplicated blocks, re-encoding traces — are exactly the things an enhancement pass disturbs. Once a file has been converted by an ordinary media player or a messaging app, most of that evidence is gone, which is why the native export from a recorder matters far more than the convenience of a file that plays.
Authenticate First
Container, codec and quantisation signatures tested before a single pixel is processed.
Localise, Don't Declare
Manipulation narrowed to a region and a mechanism, not asserted over the whole frame.
Enhance On The Record
Every filter logged as a reversible step the opposing expert can replay or undo.
Step-by-Step Methodology
The sequence a careful examiner follows, in order.
- 1
Preserve and hash the original on receipt
Hash the file as received and work only on copies. Where the exhibit is a recorder rather than a file, acquire the storage itself before anyone exports through the device's own interface.
- 2
Recover from the recorder in its native format
Proprietary DVR formats, deleted footage and overwritten segments are recovered at file-system, signature and frame level. A re-encoded export from the recorder's playback software is a derivative work, not the evidence.
- Carve by frame signature where the file system is damaged or the format undocumented
- Record the recorder's clock offset against a known reference before anything is exported
- 3
Read the container before the pixels
Metadata, codec parameters, encoder signature, frame rate regularity and GOP structure often answer the question on their own. A file whose encoder string does not match any camera that claims to have produced it has already told you something.
- 4
Establish compression and provenance history
Quantisation tables, chroma subsampling and double-compression traces show how many times a file has been saved and by what. Sensor pattern noise can tie an image to a specific camera body where reference material is available.
- 5
Test for manipulation and localise it
Splice, clone and inpainting detection narrow a finding to a region. The useful output is 'this block is inconsistent with the rest of the frame, by this measure', not a verdict over the whole image.
- 6
Screen for synthetic and AI-generated media
Face swaps, reenactment and fully generated frames leave artefacts at the pixel and cross-modal level, some of which survive re-encoding. Report a scored, explainable finding with the method visible — never a bare yes or no.
- 7
Enhance as a recorded chain, then state the limits
Stabilisation, de-interlacing, super-resolution and region magnification are applied as an ordered list of steps that can be reproduced or reversed from the original hash. Enhancement reveals detail that was recorded; it never adds detail that was not.
Commands & Code
Copy-ready snippets used in real workflows.
# Full metadata, including maker notes and any encoder signature
exiftool -a -u -G1 exhibit.jpg
# Stream, codec and frame-rate detail for video
ffprobe -v error -show_format -show_streams exhibit.mp4
# Frame-by-frame type and timing: irregular GOP structure or a
# discontinuous presentation timestamp can indicate re-encoding or an edit
ffprobe -v error -select_streams v:0 \
-show_entries frame=pkt_pts_time,pict_type,key_frame \
-of csv exhibit.mp4 | head -40# Hash the exhibit before touching it
sha256sum exhibit.mp4 | tee exhibit.sha256
# Extract the frames of interest losslessly, preserving the native timestamps
ffmpeg -i exhibit.mp4 -vf "select='between(t,124,131)'" \
-vsync 0 -q:v 1 frames/f_%05d.png
# Hash every extracted frame so each still can be tied back to the source
sha256sum frames/*.png > frames/frames.sha256# JPEG quantisation tables — a camera-original and a re-saved file
# rarely share the same tables
exiftool -htmldump exhibit.jpg > qt_dump.html
# Compare the tables of the questioned image against a known original
# from the same claimed device
exiftool -s -JPEGQualityEstimate -YCbCrSubSampling \
questioned.jpg reference.jpgLegal & Ethical Considerations
- Surveillance footage usually belongs to a third party. Secure the recorder or the export under the appropriate legal process, and record who produced it and when.
- Footage of uninvolved people carries privacy obligations. Redact what is not relevant before an exhibit is served, and keep the unredacted original under custody.
- Disclose the enhancement chain in full. An opposing expert is entitled to reproduce every step from the original hash, and a chain that cannot be reproduced invites the whole exhibit to be excluded.
- Facial and vehicle identification from low-resolution footage carries real uncertainty. State what the imagery supports and what it does not, rather than letting a magnified still imply more than it can carry.
Common Mistakes
- Enhancing before authenticating, which disturbs the very artefacts that would have exposed a manipulation.
- Treating a player's re-encoded export as the exhibit. Always acquire the recorder's native file, and the recorder's storage where you can.
- Taking a recorder's on-screen timestamp at face value. DVR clocks drift, often by minutes or hours — measure the offset against a known reference and state it.
- Screenshotting playback instead of extracting frames, which bakes in the player's scaling and colour handling and loses the original pixel data.
- Presenting a sharpened still as though the detail were observed rather than reconstructed, which is the fastest way to lose an expert's credibility under cross-examination.