Guide to Audio, Video, & Image Forensics
In this era, the use of recording devices is everywhere. Stores, businesses and even city streets are equipped with surveillance video systems. In fact, most police cars use dash cam video recorders which record both audio and video. The use of covert audio/video recording devices by law enforcement both in the field and interview rooms is almost standard practice. Audio or video is frequently recorded on Smartphones by people involved in an incident or people simply in the area.
The information in this article will assist you in achieving a better understanding of recorded evidence and how “looking beyond the obvious,” will be of great value in dealing with cases involving audio & video recordings as well as evidence images in both criminal and civil investigations.
Major sections in this guide include:
- Changes in Technology
- Terms and Definitions
- About Forensic Audio
- About Forensic Video
- Presentation of Audio Evidence
- Presentation of Image Evidence
- Testimony vs. Expert Testimony
The technology of yesteryear’s audio and video recordings was analog. These recordings were on cassette tapes, micro cassette tapes, VHS tapes, etc. Though analog tapes may still be seen occasionally, over the past several years, the use of analog recorders has been replaced by digital recorders and systems. These range from personal digital recorders to sophisticated law enforcement only covert audio and video systems, as well as surveillance systems that also record audio. Though the fundamentals of audio science remain the same, the technology for creating and analyzing recordings continues to advance.
In this document, the fundamentals of evidence recording in both analog and digital form will be explored.
Analog Recording: An analog recording is one that is made using conventional magnetic tape. This includes standard audiotape and microcassette recordings.
Digital Recording: A digital recording does not use magnetic tape. It records information using configurations of data stream blocks of 0’s and 1’s, resulting in levels of frequencies of discreet values or steps. The information that comprises the recording is stored on digital media, consisting of a computer chip, digital media card or computer sound file.
Compression: Most digital recorders use compression. In a lossy compression scheme, as the name implies, some of the original information is discarded when it is compressed. Therefore, it is impossible to produce an exact replica of the original signal when the recording is played back. There are many different schemes of lossy compression available. These schemes generally provide varying compression ratios. In audio, the most popular of these are MPEG or MP3 format and is commonly used with compression ratios of up to ten to one. All lossy compression schemes add artifacts to the compressed audio as well as decreased audio clarity. Artifacts are small imperfections created by the loss of the actual audio or video data. Most digital video formats also use compression. Like audio compression a video with compression does not have as good a quality as uncompressed video.
Proprietary Files: There are open file formats, meaning that they can be played in a variety of media players on computers and proprietary formats. Proprietary files use a codec specific to a certain manufacturer. These files can only be played using the original audio/video recorder or system that created it, or software provided by the manufacturer. Common examples are digital surveillance videos, and law enforcement only audio/video recorders.
File Types: There are many types of audio and video file formats. Some use lossy compression. Others use lossless compression, while still others are uncompressed. Below are some examples of file formats:
- wav – standard audio file format used mainly in Windows PCs. Commonly used for storing uncompressed (PCM), CD-quality sound files, which means that they can be large in size – around 10MB per minute of music. It is less well-known that wav files can also be encoded with a variety of codecs to reduce the file size (for example the GSM or mp3 codecs).
- mp3 – the MPEG Layer-3 format is the most popular format for downloading and storing music. By eliminating portions of the audio file that are essentially inaudible, mp3 files are compressed to roughly one-tenth the size of an equivalent PCM file while maintaining good audio quality. We recommend the mp3 format for music storage, however it is not recommended for voice storage.
- RAW – a raw file can contain audio in any codec but is usually used with PCM audio data. It is rarely used except for technical tests.
- wma – Windows Media Audio format owned by Microsoft, which is a commonly used format.
- aac – the Advanced Audio Coding format is based on the MPEG4 audio standard which is owned by Dolby. A copy-protected version of this format has been developed by Apple for use in music downloaded from their iTunes Music Store.
- dss – Digital Speech Standard files. This is an Olympus proprietary format. It is a rather poor codec, and fairly old. gsm or mp3 format is preferred where the recorder allows it.
- msv – is a Sony proprietary format for Memory Stick compressed voice files. It may require a Sony plugin to play files in this format.
- dvf – Sony’s proprietary format for compressed voice files used by Sony dictation recorders. It may require a Sony plugin to play files in this format.
- avi – AVI Format. AVI stands for audio video interleave and was developed by Microsoft. It can be uncompressed or use less compression that some other formats. It stores data that can be encoded in a number of different codec’s and can contain both audio and video data. The AVI format usually uses less compression than some similar formats and is a very popular format amongst internet users.The AVI format is supported by almost all computers using Windows, and can be played on various players. Some of the most common players that support the avi format are:
- Apple QuickTime Player (Windows & Mac)
- Microsoft Windows Media Player (Windows & Mac)
- VideoLAN VLC media player (Windows & Mac)
- GOM Player
- mov – QuickTime Format. The QuickTime format was developed by Apple and is very common. It is often used on the internet, and for saving movie and video files.The format contains one or more tracks storing video, audio, text or effects. It is compatible with both Mac and Windows platforms, and can be played on an Apple QuickTime player.
- mp4 – MP4 Format. This format is mostly used to store audio and visual streams online, most commonly those defined by MPEG. It Expands MPEG-1 to support video/audio “objects,” 3D content, low bit rate encoding and support for Digital Rights Management.
- mpg – Mpg Format. Common video format standardized by the Moving Picture Experts Group (MPEG). It typically incorporates MPEG-1 or MPEG-2 audio and video compression; often used for creating downloadable movies. It can be played using Apple QuickTime Player or Microsoft Windows Media Player.
- wmv – Windows Media Video Format. WMV format, short for Windows Media Video was developed by Microsoft. It was originally designed for internet streaming applications, and can now cater to more specialized content. Windows Media is a common format on the Internet, but Windows Media movies cannot be played on a non-Windows computer without an extra (free) component installed. Some later Windows Media movies cannot play at all on non-Windows computers because there isn’t a player available. Videos stored in the Windows Media format have the extension .wmv.
- 3gp – 3GP File Extension. The 3gp format is both an audio and video format that was designed as a multimedia format for transmitting audio and video files between 3G cell phones and the internet. It is most commonly used to capture video from a cell phone and place it online.This format supports both Mac and windows applications and can be commonly played in the following:
- Apple QuickTime Player
- RealNetworks RealPlayer
- VideoLAN VLC Media Player
- MIKSOFT Mobile 3GP Converter (Windows)
- DM Player
When a recording is captured on a computer hard drive using forensic audio software or audio editing software, the recording may be viewed in terms of a graphical display called the waveform. The waveform graphically reflects the relationship between the time and amplitude of recorded sounds. It allows the identification and comparison of record events on evidence and test recordings.
Record Event: A record event is an occurrence that initiates, interrupts or stops a recording process.
Magnetic Signature: (Analog tapes) When a record event occurs on an analog recording, a magnetic impression known as a signature, is permanently placed on the tape recording by the record head and the erase head. These signatures have generic similarities and individual characteristics. A particular tape recorder can be identified or eliminated by analysis of the magnetic signatures. These signatures identify when a recorder was started, stopped, re-started or paused.
Anomaly: An abnormality of an undetermined origin in a recording.
Discontinuity: An event that interrupts the continuous flow of recording. It can occur either in the original recording by stopping or pausing the recording, or in the preparation of subsequent copies.
Edit: Editing is a process of altering the content of a recording. There are a variety of methods by which a recording can be edited. Edits can be done during the recording process or after the recording is completed.
Important Note: If the recording is on an analog tape, such as a standard audio tape or microcassette tape, it is important to work with the most original copy while performing enhancement or analysis. In terms of enhancement, working with the original will provide the best outcome. However, if the original isn’t available, a good, first generation copy should be used. Each time a tape is copied (using analog equipment) there is loss of quality with each subsequent copy, much like one would observe when making a photocopy of a photocopy of a photocopy…
If the recording is digital, quality is not lost in the duplicating process as long as the original format is maintained.
The following problems frequently occur on evidence audio recordings include those listed below:
- The voice is too faint to be heard intelligibly.
- One voice is audible, but the other voice is faint, perhaps due to proximity of the microphone.
- There is background noise impairing the intelligibility of those speaking.
- The voices are masked by hisses, hums or other noise.
- 911 recordings have important speech in the background that cannot be heard clearly.
- The speed of the recording is too fast, too slow or fluctuates.
- Due to recording problems or poor acoustics, the speech is less intelligible than desired.
- The recording has an echo, making the voice less than intelligible.
Enhancement is conducted through computerized, digital audio enhancement technology. If the recording is analog, it is played using a broadcast quality recorder and captured to the hard drive of a laboratory computer. If the recording is digital, it is opened in the appropriate audio software programs, then, using the appropriate processes, improvements are made which can provide the following:
- Increase the volume of quiet voices.
- Improve the intelligibility of speech.
- Bring out background voices to make them more audible and intelligible.
- Reduce or remove tape noise, hisses and hums.
- Isolate voices from noisy backgrounds.
- Decrease or remove echo.
- Correct tape speed problems.
Once the enhancement is complete, the result can be placed on a CD or USB drive. Even after enhancement, evidence recordings will require careful, often repeated listening of specific portions to fully understand the words in question. There are two ways to effectively do this. The first is with a media player common to computers. As the recording plays, the progress slider moves from left to right. To repeat listening, place the mouse curser just behind the slider and click, this will back it up to where the curser is located and replay that portion. This can be repeated as many times a necessary.
The second way is to use audio software. As the recording is opened, the audio waveform is displayed. “Audacity” is a free software program and can be downloaded from the internet. A digital audio file can be opened in this software and viewed as a waveform. As the recording plays a curser progresses. When you reach a portion that you want to re-listen to, you can highlight it on the waveform and it will play repeatedly.
Speakers/Headphones: A key factor in the ability to hear speech in evidence recordings of marginal quality is the equipment which you listen with. It is very important to use either high quality speakers or high quality headphones. Bose makes both which are ideal for such needs.
Enhancement of a digital recording can also be performed. Since it was recorded in digital format, which isn’t degraded in the copying process, a copy will usually suffice. It is important to note that there are audio file formats which use compression and degrade the quality. A WAV file format has no compression and is the best quality. Digital audio files should never be converted to a compressed format such as mp3 in order to send them via email. Only an exact copy of the original on a CD should be provided for enhancement.
All analog tape recorders have at least two heads: an erase head and a record/play head. The tape first travels past the erase head, which erases any existing recording before it reaches the record/play head. When the record mode is engaged, a magnetic impression or “signature” is left on the tape by both the erase head and the record head. As the tape travels past the record head, it erases the signature left by the erase head. Consequently, only the record head signature is left. When the recording is stopped, a signature of both the erase head and the record head is left. Using forensic audio software we are able to view the graphical display waveform of the material contained on the tape. The signatures are visible on the waveform, and may be both seen and heard when played on the computer. When stop, start, pause or editing occurs a signature is permanently left on the recording. These signatures can be viewed and printed for comparison. If suspect signatures are found during analysis, the original recording device will be requested in order to conduct comparison testing for the purpose of making a conclusive determination.
Digital audio recordings may be stopped (paused) and restarted during the recording process in order to exclude a portion of what takes place. When this occurs, a small digital signature is present. Though they differ from the magnetic signature of analog tapes, they can be examined as part of the analysis, and compared with exemplar signatures from the recorder that made the recording.
Indications of an altered recording is a word, multiple words or portions of speech missing, which change the meaning of what is being said. Altered recordings often have a click or a pop where an edit has been made.
Analog recording have distinctive types of signatures. They are described below:
- STOP/START: Tape recorder in record mode is stopped, then record mode is re-engaged with no intervening tape transport function having been engaged. These events are often the record events of most concern to the forensic audio expert.
- STOP/ADVANCE/START: Record mode is stopped, the tape is advanced, then record mode is engaged again.
- STOP/REWIND/START: Record mode is stopped, rewound, then record mode is engaged again. Since the tape has been rewound to a point just prior to the position of the “stop signature,” this will effectively eliminate (or erase) the “stop” signature, leaving what appears to be only a “start signature” at this point on the tape.
- START/NO-STOP: Record mode is engaged, and then tape runs out and reaches the leader while recording is in process. (Microcassettes do not have leaders.)
- NO-START/STOP: When record mode is engaged on the plastic leader it is not recorded, and then the record mode is disengaged later on the tape.
- PAUSE: Recording is stopped by pausing, then re-engaged by un-pausing.
- VOICE ACTIVATED START/RECORD/STOP: Voice activation circuitry is used to engage, then disengage record mode.
Though stop, pause and start signatures are recognizable, different recorders have unique characteristics.
An audio professional can delete material from an audio recording by use of digital audio editing computer software in such a way that the average person will usually not be able to detect it. This has necessitated the use of intricate methodologies and sophisticated software utilized by forensic experts for this type of analysis.
- Physical Inspection: (Analog tapes) Physical inspection should be conducted to determine the condition of the tape and to inspect for any damage that would affect how it functions.
- Critical Listening: Critical listening is an aural evaluation of the audio recording, which provides considerable direction to the examiner in locating areas requiring specific instrumental, or on analog tapes, physical inspection.
- Waveform Analysis: The waveform display reflects graphically the relationship between the time and amplitude of recorded sounds and allows the identification and comparison of record events on evidence and test tapes. When a record event occurs such as a start, stop, stop/re-start or pause on a magnetic analog tape, a distinctive mark or signature is placed on the tape. When waveform analysis is conducted, these signatures can be seen and in most cases, heard. Digital recorders also produce small signatures which can be seen on the waveform.
- Spectrographic Analysis: A sound spectrograph displays the recorded material in time, frequency, and amplitude. Its distinctive display is used to further study the effects of record events, etc. Any gap in the audio signal as well as signatures can be examined on the spectrograph.
- Magnetic Development: (Analog tapes) When the tape recorder heads touch or leave the magnetic recording tape, they leave a signature like a fingerprint. This signature is unique to the tape recorder. The process of magnetic development allows for these signatures to be examined under microscopic magnification by applying a non-destructive, Freon-based, ionized-particle solution.
- Physical Inspection: (Analog tapes) If a portion of a tape has actually been removed by cutting it out and then splicing the tape, it will be revealed by physical inspection of the tape. It would also be detected through analysis of the digital capture of the recording using audio software.
- Scanning Software: With the rapid increase in the use of digital recorders, the demand for software and methodologies in authentication analysis of digital recordings has become increasingly necessary. Sophisticated programs such as Edit Tracker, by the Center for Speech Technology, were engineered for such purpose. This software conducts various scans designed to search for indicators of digital editing.
- Hex Editor: A Hex Editor Software program is used when looking at the “DNA” of a digital recording as well as digital images. In most cases, when a recording is made, it contains the date/time it was started and stopped as well as the recorder/camera that created it. If the file has been opened in editing software and changed in any way, the name of the software will be added to the file and is visible using the Hex Editor.
ANALYSIS FOR TIMING AND SEQUENCE OF EVENTS
There are times when it is important to determine the time lapse between events on a tape, the sequence of events on a tape, or the number of events on a tape, such as in a recording of multiple gunshots. Each of these tasks may be done through the use of waveform and spectrographic analysis on both audio recordings and video recordings that contain audio.
Voice identification is a combination of aural, or listening and instrumental comparison of one or more known voices with an unknown voice for the purpose of identification or elimination. The fundamental premise for voice identification is that every voice is individually characteristic enough to distinguish it from others through voiceprint analysis.
Factors contributing to voice uniqueness lie in the size and configuration of the vocal cavities, such as the throat, nasal, and oral cavities and the shape, length and tension of the individual’s vocal cords. Another factor in determining voice uniqueness lies in the manner in which the articulator muscles are manipulated during speech.
Factors which are also compared are resonance quality, pitch, temporal factors, inflection, dialect, articulation, syllable grouping and peculiar speech characteristics.
After the evidence recording is received, the recorded speech is captured to a lab computer. The recording is reviewed to identify the words that will be best utilized for comparison. The words sought are those which are most clearly articulated, not slurred, truncated or run together with other words. Each group of words selected is then placed into what is referred to as a short term memory file. The desired number of words per comparison is 20 or more.
COLLECTION OF EXEMPLAR
It is recommended that the exemplar of the known voice be collected in as close to the same manner as the recording of the unknown voice was recorded. For example, if the recording of the unknown voice was recorded over the phone, the exemplar of the known voice should be collected over the phone, etc. When the exemplar is collected the suspect is asked by the examiner to say the same words in the same way as they were spoken by the unknown person. In other words in a normal, natural voice.
AURAL AND WAVEFORM ANALYSIS
Analysis is conducted through aural (listening) and visual comparison of the words through graphical (waveform) display. Each recording is transferred onto the computer using a digital sound card to ensure the best quality capture. A graphical display of the recorded material, called the waveform, can then be viewed as the recording is played and reviewed. The configuration of the individual words can be seen as they are played.
A computerized spectrographic analysis is conducted. This facilitates visual comparison of the features of each word spoken. The spectrogram displays the speech in three formats: time, frequency and amplitude. The spectrogram serves as a permanent visual record of the words spoken and facilitates visual comparison of similar words spoken by an unknown speaker’s voice with a known speaker’s voice. The spectrogram shows time along the horizontal axis, and frequency along the vertical axis. Amplitude is indicated in varying degrees of gray or colored shading.
STANDARDS FOR COMPARISON DETERMINATION
The following are the standards accepted nationally by all professional organizations involved with voice identification, including the Audio Engineering Society International and the American Board of Recorded Evidence.
- IDENTIFICATION: At least 90% of all comparable words must be very similar aurally and spectrally, producing not less than twenty (20) matching words.
- PROBABLE IDENTIFICATION: At least 80% of the comparable words must be very similar aurally and spectrally, producing not less than fifteen (15) matching words.
- POSSIBLE IDENTIFICATION: At least 80% of comparable words must be very similar aurally and spectrally, producing not less than ten (10) matching words.
- INCONCLUSIVE: Falls below either the Possible Identification or Possible Elimination confidence levels and/or the examiner does not believe a meaningful decision is obtainable due to various limiting factors.
- POSSIBLE ELIMINATION: At least 80% of comparable words must be very dissimilar aurally and spectrally, producing not less than ten (10) words that do not match.
- PROBABLE ELIMINATION: At least 80% of the comparable words must be dissimilar aurally and spectrally, producing not less than fifteen (15) words that do not match.
- ELIMINATION: At least 90% of the comparable words must be very dissimilar aurally
and spectrally, producing not less than twenty (20) words that do not match.
When a tape of the unknown voice consists of multiple recordings of separate conversations, a separate comparison is required for each conversation. The target number is twenty or more words for each conversation.
BIOMETRIC VOICE IDENTIFICATION
For more than forty years, the court accepted method of voice identification analysis is the aural/spectrographic method. In recent years advances in biometric analysis has occurred. The term Biometrics refers to the identification of humans by their unique characteristics. It is used in DNA testing, facial recognition, and now voice identification analysis. A sample of 16 seconds of a known voice and an unknown voice is necessary. Multiple voices can be compared in a single analysis. The system uses the following three methods to compare the voices:
Pitch Statistics: Pitch refers to how high or low a person’s voice sounds. The pitch of the voice can be measured scientifically. The Pitch Statistics Method (PSM) contains 16 different pitch parameters, including average pitch value, maximum, minimum, median, percent of areas with rising pitch, pitch logarithm variation, pitch logarithm asymmetry, pitch logarithm excess and 8 additional parameters.
Spectral-Formant Method: The spectral maxima of speech signal are called formants. They are formed because of the resonances, which happens in the vocal tract during the speech generation process. The formants (resonance frequencies) depend on the geometrical size and shape of the vocal tract (head with all the cavities and organs). In general, in the frequency band of a phone line (300-3400 Hz), we can find only four formants. The instantaneous values and dynamic traces of those four formants are extracted from the dynamic spectrogram and compared using Support Vector Machine (SVM) classifier.
Gaussian Mixture Models based Method (GMM): This approach is more statistical and requires computing power, so it cannot be accomplished manually. In simple words, not only the spectral maxima (values of resonance frequencies) are measured and compared, but the shape of those and energy distribution along the frequencies.
After the analysis is conducted, the results are displayed in likelihood percentages as well as other statistics.
ENHANCEMENT OF AUDIO TRACK
Video interviews are often recorded under poor acoustical conditions, causing the same intelligibility problems as with audio recordings. Using computerized forensic audio technology, the audio tracks of video interviews can be forensically enhanced. If it is necessary, the enhanced audio and the video portion can be re-synchronized so it can be seen and listened to together.
CCTV SURVEILLANCE VIDEOS
Closed Circuit TV Surveillance Videos (analog), are recorded using a time lapse VCR, which tapes at a very slow speed, allowing as much as 24 hours or more to be recorded on a single VHS tape. When played back on a standard VCR, they play at high speed. When slowing with a standard VCR, distortion occurs. Even with a Super VHS VCR, the resolution is diminished. Utilizing a time lapse VCR within a forensic lab environment, it senses the speed at which the tape was recorded and plays it at the same rate. Important portions can then be captured to the computer using a forensic video system. The majority of CCTV systems have been replaced by digital systems.
DIGITAL SURVEILLANCE VIDEO SYSTEMS
Digital video recorders (DVR’s) are rapidly replacing analog systems. Unlike analog systems where VHS tapes were the standard, there is no standard file format. Each DVR manufacturer has its own proprietary algorithm used to record and store the video footage. This algorithm uses compression to reduce the amount of hard drive space needed to store video data.
When retrieving the video footage from the original device, many DVR systems will give the option of exporting in the proprietary format or AVI. If the video file is exported in the proprietary format, no additional compression is used on the video. However, a proprietary video player will be needed to view the video. The proprietary player is often exported automatically at the same time as the video data from the DVR. If the video file is exported in AVI format, there is an additional compression used. When possible, it is always recommended to use the proprietary export feature to preserve the highest quality video possible.
DEMULTIPLEXING MULTI CAMERA RECORDINGS
Many businesses use multiple surveillance cameras at a single property. When using analog systems, they are all captured to a single VCR through a device called a multiplexer. This is a switching system which quickly rotates through the different camera views. When a video generated through a multiplexer is played back on a standard VCR, it flashes so rapidly between the views of the various cameras that is not possible to see the occurring events. By use of a computer video forensics system, the various camera views can be separated and any single view can be reviewed. A grid formation showing all the separated camera views can also be done. Any single camera view can be played continuously and record the results onto another video tape or disk. The desired frames can be digitized, enhanced and printed out as still images.
DEMULTIPLEXING OF DIGITAL SURVEILLANCE VIDEOS
The player software of digital systems normally includes built in tools for demultiplexing (demuxing) the camera views.
VIDEO IMAGE ENHANCEMENT
Video enhancement is dependent upon sophisticated computer software and systems dedicated solely to forensic video enhancement and analysis. Some of those include Salient Stills, Ikena, Video Investigator, etc. Guided by the examiner, they utilize algorithms to perform the desired result.
Photogrammetry is defined as: “The art, science and technology of obtaining reliable information about physical objects and their environment through the process of capturing, measuring and interpreting photographic images.” In many cases, the images come from surveillance videos. Using photogrammetry, the height of the perpetrators in a video from such places as convenience stores can be calculated scientifically. There are several ways in which the calculations can be performed: (1) Where there are known, measurable objects still present in the same location as they were at the time of the video recorded incident. Known objects might be counter tops, merchandise racks, shelves, newspaper stands, doorways, etc. In some cases the necessary measurements can be made by an investigator in that area and forwarded to the lab. (2) Reverse projection photogrammetry is conducted by placing an object of known dimension into the scene and capturing the images using the same surveillance camera/system in the same position as it was at the time of the incident. For this type of analysis, a visit to the scene is necessary.
ANALYSIS FOR ALTERING OR EDITING, TIMING AND SEQUENCE OF EVENTS
As with audio tapes, VCRs have an erase head and a record/play head. Both leave a magnetic signature on the tape when it is started, paused or stopped. When viewing the tape you see only the picture. Using forensic technology to conduct detailed analysis, it can be determined if analog tapes have been altered or edited and if it is original or a copy.
There are other instances where information may need to be obtained forensically from both audio and video recordings. One example would be the need to determine the number of gunshots rapidly fired in a recording. Another is to determine the timing or sequence of events that occur on the recording. All of these can be determined through analysis using various scientific software programs. Exhibits are often prepared to demonstrate the results of the analysis.
DIGITAL SURVEILLANCE VIDEOS
As with digital audio files, analysis of digital security videos is conducted for evidence of altering or to establish authenticity. The same methods as are used with digital audio recordings. (See previous section)
STILL IMAGES FROM EVIDENCE VIDEOS
After a video has been enhanced, specific frames are often beneficial for use as exhibits. Further enhancement may be needed prior to conducting detailed analysis of patterns. Examples of patterns which might need to be compared are tattoos, clothing characteristics, unique features, a vehicle, etc. Today’s software enables the examiner to export any quantity of still images to a separate file. The images should be saved in an uncompressed format such as BMP or TIFF. The images are placed on a disc or a USB drive and can be viewed using any image viewer standard on a PC or Apple (Mac) computer.
When printed, the quality of the printer and paper is vital to achieving the best quality. This is achieved using a lab quality photo printer, such as Epson or HP, not a color laser printer.
Using digital imaging software, evidence images can be forensically clarified. Such clarification is acceptable for legal purposes, including evidentiary use in court. The original image should remain preserved and a copy should be used for enhancement. There is no loss of quality when an image is copied. After clarification has been achieved, the image should be saved in an uncompressed format.
IMAGE AUTHENTICATION ANALYSIS
When a picture is taken by any camera, even Smartphone cameras, file property information is embedded into the image. This includes EXIF information. The EXIF information is the equivalent to the DNA of a digital image. It includes the following information:
- Make and model of the camera that took the picture
- Shutter speed
- Focal length
- Exposure values
- Date and time the photograph was taken (according to how the date/time setting is within the camera.)
- Other image information
An unaltered original image or an exact copy will still contain the EXIF information. Specific cameras have camera specific compression used when a jpeg file is created. The compression signature in the image can be compared with that of known software such as Photoshop, Corel Paint, ACDSee, etc. If image processing software has been used, the software leaves a compression signature in the image. There are programs which are used in image authentication analysis.
- FourMatch: This is a plugin for Adobe Photoshop. One of the creators is Haney Farid, PhD. Dr. Farid is considered one of the foremost authorities on image forgery. He is a professor in the computer science department at Dartmouth College. This technology scans for EXIF data as well as compression signatures matching known image processing software. It provides a result and indicates if the image has passed or failed authentication. If it fails, image processing software that matches the compression signature is identified.
- JPEG Snoop: This is a stand-alone program that works similar to FourMatch, but with a different variation of scans. It also provides the results.
- FIAS: (Forensic Image Authentication System). At this time, this is most likely the most sophisticated image authentication software. This software was engineered by Dr. Catalin Grigoras, Director of the National Center for Media Forensic in Denver, CO. It not only examines the EXIF data and compressions signatures, but has the tools to identify and reveal specifically which pixel information has been changed.
Other analysis includes critical inspection of the image details for signs of editing. This is conducted using a high resolution monitor and imaging software, in addition to high quality prints.
Images that do not have the EXIF information will not pass authentication.
PRESENTATION OF AUDIO EVIDENCE
It’s best not to depend on the courtroom’s audio system to play evidence recordings in court. Most courtrooms lack sufficient quality and amplitude. The most effective method is to use at least two sets of speakers, such as BOSE. One set can be placed in front of the jury and the other used for the attorneys and the judge. Some courtrooms may have sound systems that will work well with these speakers. Place a speaker in front of the microphone or if there is a jack at the witness stand, plug it into the computer, along with the free standing speakers using a Y adapter in the audio output of the computer.
PRESENTATION OF IMAGE EVIDENCE
Image evidence must be presented in a way that will be effectively shown to a jury. Presenting digital image evidence directly from a computer using a high quality monitor large enough for the jury to see detail is effective. If this method is used, the jury will need a laptop computer in the jury room for deliberations. The laptop must not be connected to the internet and should not have any other data for the jury to see, including games.
Printed images on high quality photo paper and printed on a lab quality printer can also be beneficial, as they can easily be submitted as exhibits and examined by a jury in deliberations. Using printed images in conjunction with the digital images may compliment each other.
TESTIMONY VS. EXPERT TESTIMONY
There are two reasons why testimony would be necessary regarding recorded evidence.
- To lay foundation for the evidence to be admitted.
- To provide expert testimony.
Though expert testimony is necessary in some cases, it may not always be essential. If an expert opinion is not required, a trained and experienced investigator may be able to testify to lay a foundation in order for recorded evidence to be admitted.
Copyright © 2013, Gregg Stutchman & Steve Buller (All rights reserved)