Multimedia stream hashing: A forensic method for content verification.

Forensic examination of digital audio, video, and images frequently requires transforming multimedia data from one format to another. The transformative activity may cause changes to the administrative elements of the file but leave the multimedia streams unchanged and intact. However, the forensic science community has a method knowledge gap in accurately determining if the multimedia streams changed or remained the same in the transformative processes. This paper illustrates the practical use of multimedia stream hashing as a forensic method for verifying multimedia content. A universal stream hashing tool decodes the multimedia stream data at rest in a file container. Subsequently, it calculates the data stream hash using reference video, audio, and image codecs. This paper illustrates that the multimedia stream hashing method can accurately confirm the integrity of digital images, videos, and audio following transmission, transcoding, or re-containerization. Our findings confirmed that stream hashing could accurately detect changes in multimedia streams during transcoding. Furthermore, the stream hashing method can also accurately detect matching multimedia streams. In addition, this paper verified the forensic use of the multimedia stream hash method while establishing the error rate for its use. The hash algorithms used in stream hashing have zero false negative rates by design. However, the false positive (error rate) is extremely low and depends on hashing algorithm. Finally, we recommend the forensic science community adopt the multimedia stream hashing method as an initial testing method. The method can verify a multimedia stream's conversion (transcoding) from one codec to another using FFmpeg.

Effects of content trimming iPhone 12 Pro Max video files in iOS 14.

In this audio/video authenticity research project, 44 original MOV files were produced on an Apple iPhone 12 Pro Max mobile device, running the iOS 14.2.1 operating system, in all available video formats and at four different nominal recording lengths. Each of the original files was then trimmed, using the Apple Photos app, in three different ways: deleting a portion of the beginning, a portion of the end, and portions of both the beginning and end. These 176 original and trimmed files were transferred to a laboratory computer and the footer and other metadata were analyzed with a hex editor. This analysis revealed that the trimmed recordings could be differentiated from the originals; that the iPhone model and the iOS operating system version could be identified; that important recording dates and times can be determined; and that the type of trimming, in some cases, could be determined.

The average direct current offset values for small digital audio recorders in an acoustically consistent environment.

In this research project, nine small digital audio recorders were tested using five sets of 30-min recordings at all available recording modes, with consistent audio material, identical source and microphone locations, and identical acoustic environments. The averaged direct current (DC) offset values and standard deviations were measured for 30-sec and 1-, 2-, 3-, 6-, 10-, 15-, and 30-min segments. The research found an inverse association between segment lengths and the standard deviation values and that lengths beyond 30 min may not meaningfully reduce the standard deviation values. This research supports previous studies indicating that measured averaged DC offsets should only be used for exclusionary purposes in authenticity analyses and exhibit consistent values when the general acoustic environment and microphone/recorder configurations were held constant. Measured average DC offset values from exemplar recorders may not be directly comparable to those of submitted digital audio recordings without exactly duplicating the acoustic environment and microphone/recorder configurations.

An inconclusive digital audio authenticity examination: a unique case.

This case report sets forth an authenticity examination of 35 encrypted, proprietary-format digital audio files containing recorded telephone conversations between two codefendants in a criminal matter. The codefendant who recorded the conversations did so on a recording system he developed; additionally, he was both a forensic audio authenticity examiner, who had published and presented in the field, and was the head of a professional audio society's writing group for authenticity standards. The authors conducted the examination of the recordings following nine laboratory steps of the peer-reviewed and published 11-step digital audio authenticity protocol. Based considerably on the codefendant's direct involvement with the development of the encrypted audio format, his experience in the field of forensic audio authenticity analysis, and the ease with which the audio files could be accessed, converted, edited in the gap areas, and reconstructed in such a way that the processes were undetected, the authors concluded that the recordings could not be scientifically authenticated through accepted forensic practices.

Identification of an eccentricity in the date/time metadata of a PAL MiniDV recording.

A Phase-Alternation Line (PAL) Mini Digital Video (MiniDV) recording and camcorder were provided by the Law Society of Singapore for forensic examination. During visual analyses of the submitted recording and a test recording produced on the submitted camcorder, the number of occurrences of each unique date/time stamp varied from the nominal value of 25 frames (the frame rate per second of PAL recordings), within a range of +/-3 frames. This embedded date/time information is recorded in the digital bit stream along with the video and audio information and can be optionally displayed during playback. These visual observations prompted detailed analyses of the digital metadata of the recordings which consisted of locating the portions of the bit stream associated with the date/time information, and then identifying their redundancy characteristics, data structure, and encoding protocol. Automated scripts were developed using digital data analysis software to locate, extract, convert, and count all of the unique date/time stamps, and to provide an easily-viewable output of the results. The application of the scripting process to both the submitted tape and the test recording produced on the submitted camcorder revealed that the date/time information on each exhibited a nonstandard but consistent timing pattern, which confirmed the visual observations and provided evidence that the submitted recording was consistent with having been produced on the submitted camcorder.