Search

Forensic examination of digital audio, video, and images frequently requires transforming multimedia data from one format to another. The transformative activity may cause changes to the administrative elements of the file but leave the multimedia streams unchanged and intact. However, the forensic science community has a method knowledge gap in accurately determining if the multimedia streams changed or remained the same in the transformative processes. This paper illustrates the practical use of multimedia stream hashing as a forensic method for verifying multimedia content. A universal stream hashing tool decodes the multimedia stream data at rest in a file container. Subsequently, it calculates the data stream hash using reference video, audio, and image codecs. This paper illustrates that the multimedia stream hashing method can accurately confirm the integrity of digital images, videos, and audio following transmission, transcoding, or re‐containerization. Our findings confirmed that stream hashing could accurately detect changes in multimedia streams during transcoding. Furthermore, the stream hashing method can also accurately detect matching multimedia streams. In addition, this paper verified the forensic use of the multimedia stream hash method while establishing the error rate for its use. The hash algorithms used in stream hashing have zero false negative rates by design. However, the false positive (error rate) is extremely low and depends on hashing algorithm. Finally, we recommend the forensic science community adopt the multimedia stream hashing method as an initial testing method. The method can verify a multimedia stream's conversion (transcoding) from one codec to another using FFmpeg. Highlights: Re‐encoding of multimedia streams must be transparent for forensic examinations.Multimedia stream hashing is a stream integrity verification method used in forensic science.Multimedia stream hashing has an extremely low potential for a false positive (error rate). [ABSTRACT FROM AUTHOR]

Detailed data analyses were conducted of the header metadata of 20 MP3-encoded files produced on 6 small digital audio recorders and then re-encoded with 4 commonly used audio editing programs. The purpose of this research was to identify specific changes made as a result of the re-encoding processes as they relate to forensic audio authenticity examinations. The re-encoding processes by the 4 audio editing programs always produced changes in the header sections that were different from the original recording format; additionally, 19 of the 80 re-encoded files had audio missing at the very end of the recorded data. The header format structure, the procedures followed, the numerous changes identified in the headers and the audio information of the re-encoded files, and a discussion of the authenticity implications are presented. [ABSTRACT FROM AUTHOR]

The average DC offset values of recordings produced on nine small digital audio recorders were evaluated to determine if they demonstrated characteristics meaningful for forensic audio authenticity examinations when submitted audio files are compared with test recordings made using exemplar digital recorders. Five audio formats (PCM WAV, ADPCM WAV, MP3, WMA, and DSS) were tested with no input, using the internal microphone(s), and with two Olympus external microphones. The average DC offset values were calculated using sound editing, digital analysis, and scientific computing programs. Based on the standard deviations of the DC offsets in these recordings, their wide variation and inconsistency probably preclude meaningful comparisons between one-minute submitted digital audio recordings and exemplars in authenticity examinations. [ABSTRACT FROM AUTHOR]

Detailed data analyses were conducted of the header sections of eleven (l 1) Windows Media Audio-formatted files produced on three small Olympus digital audio recorders and then re-encoded with four common audio editing programs. The purpose of this research was to identify changes made as a result of the re-encoding processes as they relate to forensic audio authenticity examinations. The header format structure, the procedures followed, the numerous changes identified in the headers of the re-encoded files, and a discussion of the authenticity implications are listed. [ABSTRACT FROM AUTHOR]

The scientific authentication of digital video-audio recordings involves the examination of both the visual and acoustic information through a number of analysis steps. One step in this pro-tocol is determining whether any of the individual images are identical to any other images within the same digital recording. Additionally, in some examinations, it is necessary to identify nonmatching pixels from nearly identical images. These duplicate, or nearly duplicate images, could be indicative of editing, an irregularity of a specific recording device, or just identically captured and processed images. In this paper, three questions involving video frame comparisons are addressed: (1) Does a specific, commonly available, consumer-quality camcorder produce any identical images with a static visual view in standard and high definition modes? (2) Are there accurate methodologies for determining whether two recorded digital images are identical? (3) What digital analysis procedures are available for compar-ing two nearly identical images? These questions are answered with the analysis of more than 147,100 frames from a consumer camcorder using digital data analyses and Photoshop routines. [ABSTRACT FROM AUTHOR]

This case report sets forth the preliminary examinations plus the procedures and results of a specialized data analysis to identify identical and nearly identical video frames produced in recordings from a miniature Lawmate PV-500 digital video-audio recorder. A review of five investigative recordings and test recordings from two recorders, using the native DivX MPEG-4 encoding at the recorded rate of 24 frames per second, revealed a video stream containing identical and nearly identical frames that could be identified solely by their chunk sizes within the resulting AVI files. Based upon this research, data analysis procedures can be used with Lawmate PV-500 recordings and similarly configured formats to identify consecutive identical and nearly identical frames during forensic authenticity examinations of video-audio recordings. [ABSTRACT FROM AUTHOR]

A detailed methodology is described to authenticate investigative and other forensic audio recordings collected via digital recording systems. These examinations are conducted to determine whether the recorded information is original, contains alterations, has discontinuities due to recorder stops and starts, and matches a submitted recording system, if available. Sections are included on examination requests, laboratory space, contributor-supplied materials, equipment and software, an 11-step authenticity examination protocol, authenticity examples, evidence handling, and expert testimony. The 11-step protocol consists of evidence marking, physical inspection, digital data imaging and playback optimization, critical listening, high-resolution waveform analysis, narrow-band spectrum analysis, spectrographic analysis, digital data analysis, miscellaneous techniques, work notes, and reporting. A formal procedure has been developed to optimally authenticate digital recordings submitted to a forensic laboratory, based on proper education, training, specialized schooling, and experience; appropriate laboratory space; specialized software; scientific protocols; accepted evidence-handling practices; and effective expert testimony. The paper complements an earlier publication (1990) except that it does not present specific procedures of a particular government laboratory. [ABSTRACT FROM AUTHOR]

The article lists various articles published in this issue, on topics including a Clipped-Sample Restoration Software in forensic science, three-dimensional laser scanning of chewing gum as a forensic method, and installation of CCTV recording systems.