ForeNsic Video and Audio Analysis

8/19/2019 ForeNsic Video and Audio Analysis

http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 1/18

A Simplified Guide To

Forensic Audio and Video Analysis

IntroductionUnlike other forms of forensic evidence, audio and video recordings

can provide a real-time, eyewitness account of a crime so

investigators can watch or hear what transpired. For instance, a

surveillance video captures a bank robbery in progress, or a hidden

camera records an undercover sting operation.

Over the past decade, sources of recorded audio and video that can

assist in an investigation have increased exponentially. Closed

circuit television systems CC!"# and video and audio recorders can

be found in businesses, at tra$c intersections, parking lots, bank

machines, on police-vehicle dashboards and of course, in cell

phones.

For large-scale events or crimes, the sheer amount of recorded

audio and video evidence can be massive. %uring the riots thatoccurred in "ancouver, &ritish Columbia after the '()) *tanley Cup

Finals, more than +,((( hours of recordings were captured. aw

enforcement has since brought charges against more than a

hundred rioters using video evidence and more charges are

expected.



For most crimes, however, high-uality audio andor video

recordings are often not available. !his is where forensic audio andvideo expertise can help. Forensic experts have many techniues to

enhance recordings that can bring out details and provide a clearer

picture of what occurred, or make an audio recording more audible.

!his in turn helps investigators, lawyers and /urors better conduct

their duties.

Back to top of page ▲

NFSTC



http://www.forensicsciencesimplified.org/av/index.htm#top

http://www.nfstc.org/

http://www.nfstc.org/

http://www.forensicsciencesimplified.org/av/index.htm#top



Principles of Forensic Audio and

Video Analysis !o assist in an investigation, forensic experts can repair, recover,

enhance and analy0e audio and video recordings using an array of

scienti1c tools and techniues.

Repair and Recovery of Evidence

&efore audio and video evidence can be

analy0ed, it may 1rst need to be repaired or recovered from

damaged media or a damaged recording device.

2epairing evidence is especially common for analog and digital

magnetic tape. 3t may need to be spliced back together or put into a

new audiovideo housing in order to recover the audio or video. 3n

today4s digital world, C%s, %"%s, cell phones, portable cameras and

other sources of digital media and recording devices can be

damaged by heat, misuse, the environmental conditions of a crime

scene, or simply on purpose by an o5ender. 6ven in these situations,

the digital 1les can be recovered and used for analysis.

Evidence Enhancement



!he most common function of forensic video and audio experts is to

clarify a recording so that it is more apparent to investigators,

attorneys and /urors what the evidence demonstrates.

To enhance a video recording, 1lters can be used to ad/ust thebrightness and contrast, correct the color, crop and resi0e an image,

enhance edge detail and reduce visual distortion. !he speed of

playback can also be ad/usted to more accurately display the frame

rate at which it was recorded.

Before Stabilization Courtesy of !arget7 Forensic *ervice#

After Stabilization Courtesy of !arget7 Forensic *ervice#

To enhance an audio recording, 1lters can be employed to

improve clarity. !his may entail removal of unwanted noise or

enhancing the intelligibility of speech. 2ecordings will often be madein less than ideal circumstances, such as when someone is wearing

a body wire. Utili0ing audio engineering techniues may allow faint

voices or events to be heard more clearly on playback.

Analysis, Interpretation and Identification

Authentication of recordings 8 3n many criminal cases, the

authenticity of the recording and the content of the recording may

be called in to uestion. Forensic audio and video experts can

examine a variety of characteristics of the audio or video recordingto determine whether the evidence has been altered. !his includes

con1rming the integrity veri1cation# of the recording, as well as

authenticating that the content of the image or audio is what it

purports to be.

3f the ambient sound present on an audio recording changes

abruptly, this could indicate that the environment where the

recording took place suddenly changed. !he volume and tone of a

voice on the recording can provide clues as to distance and spatial

relationships within a scene. ighting conditions can be examined toestimate the time of day or environmental conditions at the time of

the recording.

!echnical details may also con1rm information about a recording.

For instance, an unnatural waveform present in the audio or video

signal may indicate that an edit has been made. 9 physical identi1er

http://www.forensicsciencesimplified.org/av/Stablization_Before.html

http://www.forensicsciencesimplified.org/av/Stablization_After.html

http://www.forensicsciencesimplified.org/av/Stablization_Before.html

http://www.forensicsciencesimplified.org/av/Stablization_After.html



may be present in the signal on magnetic tape that can identify it as

a copy or indicate that it was recorded on a particular device.

*ometimes, a perpetrator will try to destroy audio or video

evidence: however, using these methods, the recording can be

analy0ed to determine what occurred.

3n the famous ;atergate investigation, a great deal of e5ort was

spent examining an )<=-minute gap in an audio recording of

>resident 2ichard ?ixon discussing the ;atergate break in with his

Chief of *ta5. 9nalysis of the audio signature) left behind in this

erased portion allowed investigators to determine which ;hite

@ouse tape recorder made the erasure and how many di5erent

erasures were made. 6xamining the level of 9C hum recorded to

tape even provided details on whether the recording took place in?ixon4s secretary4s o$ce or in another location.

9nd new techniues are constantly being developed. 9 uniue

approach employed in the United Aingdom examines the low-

freuency hum captured when a recorder is plugged into an

electrical outlet or near a strong electrical current. !his freuency

will alternate slightly depending on the power load experienced at

that time of day. &y examining minute Buctuations of this freuency,

analysts can determine whether a recording took place at the stated

time and whether the recording is continuous and unaltered. !his

techniue has been in use in the UA for over eight years: in the

United *tates, this techniue is still being researched and databases

are being built for comparison.

Identifying people or obects on a recording 8 3dentifying a

person or ob/ect from an image on a video or voice on an audio

recording reuires training in 3mage Content 9nalysis or speech

science. !hese examinations are detailed comparisons of an

unknown recording to a known recording, or an unknown ob/ect to a

known ob/ect in an attempt to make a positive identi1cation. For

instance, an image of a hat at the crime scene may be compared

with a hat found on a suspect. !he comparison techniues used in

image analysis follow the same detailed comparison techniues as

Fingerprint and %ocument examiners. !earn "ore about

Fingerprints and#ocu"ent $%a"ination !he analysis and

http://www.forensicsciencesimplified.org/prints/


http://www.forensicsciencesimplified.org/docs/



http://www.forensicsciencesimplified.org/docs/



comparison of voices is an evolving area of practice that can be

controversial in criminal cases.)&ellinger' (hilip T)' *Cracking +atergate,s Infa"ous -./ &inute

0ap1' Forensic Magazine 2online3 February -.' 45-- 2accessed Septe"ber

6' 45-43



Why and when is audio-videoevidence used?3n the movie, The Fugitive, %r. 2ichard Aimble, played by @arrison

Ford, is on the run from police. @e calls the Chicago >olice

%epartment to proclaim his innocence. @e ends the phone call

before it can be traced, but there was one thing he didn4t anticipate

the sound of the train can be heard in the background. &yanaly0ing the recording, the police know he4s calling from Chicago.

;hile most audio evidence won4t launch a city-wide manhunt, it

may aid the investigators in piecing together the facts of a case.

9udio from a recorded D)) phone call, for instance, can provide key

informationnot only from the words of the caller, but from sounds

in the background. Can the assailant be heard in the distanceE @ow

many parties are audible on the tapeE

To Corroborate Statements

3n many cases, audio and video evidence can be used to corroborate

sub/ect or witness statements. For instance, video from a security

camera can provide information on the direction or means of travel

into or away from the crime scene. %id the sub/ect Bee in a -door,

http://www.forensicmag.com/article/cracking-watergates-infamous-18-12-minute-gap











red FordE %id he depart the scene heading north or southE !he

recorded footage can con1rm a witness statement.

*ometimes a video surveillance camera is the only eyewitness to a

crime. "ideo evidence was key in 1nding and identifying theperpetrator in the abduction and killing of ))-year-old Carlie &rucia

of *arasota, F. "ideo from security cameras showed her being

taken from a carwash parking lot and led away by a middle-aged

man wearing a work uniform. !he video of the abduction circulated

nationwide on television and a housemate of the perpetrator called

police when she saw the footage.

Upon enhancement of the video recording, investigators were able

to provide clearer images of the man4s face, tattoos on his forearms,and even the name tag on his uniform.

To Identify Suspects

!he power of video evidence in aiding an investigation is illustrated

by a website created by the "ancouver >olice' to identify suspects

from the infamous '()) *tanley Cup riots. 9fter painstakingly

reviewing the video evidence, photos of rioters have been extracted

from these videos and posted on the site for identi1cation by thegeneral public.

6ven if video or audio evidence does not capture key actions of the

crime, the recording may be able to add information or provide

additional details such as the appearance of the perpetrator or what

they were wearing.



How It’s Done



Audio and Video Evidence That May e Analy!ed

9udio and video evidence can be found at more locations and from

more diverse sources than ever before. From convenience stores to

fast food restaurants, malls to banks, tra$c intersections to parks,CC!" systems are virtually everywhere. 9nd cell phone cameras

extend a watchful eye to nearly every corner of every town. 9udio

evidence may be available from D)) calls, telephone answering

machines, voicemail recordings, video cameras, cell phones and

computer 1les.

"o# the Evidence Is Collected

%epending on the circumstance, the

surroundings, and the witnesses who may have been present,

several di5erent recordings of an event may be available. !he

responding o$cers or crime scene investigators should 1rst identify

all video or audio evidence that may exist. 3n addition to surveillance

cameras at the scene, surveillance systems nearby may provide

valuable footage, such as recordings of a perpetrator approaching or

Beeing a scene.

6ven if the recording does not appear to be very clear or useful, all

relevant footage should be collected. Forensic enhancement may

recover details that aren4t noticeable when viewing or listening to

the unprocessed recording.



#igital video and audio - ;ell over half of all closed-circuit

television evidence sei0ed by police today is digital and 1le-based,

although some systems can record to digital magnetic tape. %igital

video recorders come in two general typesG embedded stand-alone

and >C-based. &oth types generally record the audio and video tohard drives: however, some systems record to secure digital *%#

cards and other removable media.

%igital video and audio evidence from CC!" systems are generally

proprietary in nature and reuire a special software player produced

by the manufacturer to play back the collected recordings properly.

;hen the video and audio is collected from the device it needs to be

retrieved in a manner that produces the best uality possible, which

is usually the proprietary recorded 1les. !here are numerous types

of digital video and audio recording devices, with a variety ofmethods of exporting these 1les. *ome will have C%%"% writing

capabilities, some use U*& for output, and some, although digital,

may only have analog outputs. Find further infor"ation on

proper collection "ethods

Analog video and audio - 9nalog video systems are rapidly

becoming a recording technology of the past: however, many are

still in use today. 3f a system uses analog tape, the investigator

should bear in mind that every playback of the tape will degrade the

recorded images. >rior to e/ecting the tape, the investigator will

make sure the tape is stopped, document everything on the display,

then e/ect the tape and remove the write protection tab to prevent it

from being recorded over. 9 copy of the tape should then be made

for all future viewing, preserving the original video evidence.

2egardless of whether the evidence was recorded by a digital or

analog system, the investigator should note the make and model of

the recording device and important details about the recording

system e.g., how many cameras are connected and recording,

whether it is recording in time-lapse mode, the current timedate,

and the timedate on the recorder4s display#. 3t is also preferable to

sketch the cameras4 positions.

$ho Conducts the Analysis

http://www.tswg.gov/subgroups/isf/electronic-evidence/DCCTV_Web_.doc.pdf






!he disciplines of forensic audio analysis, forensic video analysis,

image analysis and computer forensics are recogni0ed as four

separate disciplines by the 9merican *ociety of Crime aboratory

%irectors aboratory 9ccreditation &oard 2ASC!#7!AB3. Hany

Federal, *tate and local law enforcement and private agencies arenow developing %igital and Hulti-Hedia *ections within their

agencies that may include some or all of these disciplines. 3n some

agencies, examinations may be conducted by the same person. 3n

large agencies, and on the Federal and *tate level, most examiners

speciali0e in one discipline and become a sub/ect matter expert

after years of experience.

9gencies may have an in-house training program that includes

vendor-based training, training with senior examiners and

competency testing. !his ensures analysts have the speci1c skills tomatch the services their agency provides. 9dditional information on

training reuirements is available from guidelines of the Scienti8c

+orking 0roups on #igital $vidence and I"aging Technology.

!wo certi1cation programs currently exist in the discipline of "ideo

9nalysisG aw 6nforcement and 6mergency *ervices "ideo

9ssociation 2!$9A3 and the 3nternational 9ssociation for

3denti1cation 2IAI3. 3n the 1eld of forensic audio, training courses are

available, but no speci1c certi1cation currently exists.

Courtesy of !argetI Forensic *ervices

http://www.ascld-lab.org/

https://www.swgit.org/pdf/Guidelines%20and%20Recommendations%20for%20Training%20in%20Digital%20and%20Multimedia%20Evidence?docID=57


http://www.leva.org/

http://www.theiai.org/certifications/video/index.php




http://www.leva.org/

http://www.theiai.org/certifications/video/index.php



"o# the Analysis Is %erformed

!he 1rst step of an analysis is for the examiner to simply listen to or

view the recorded footage. !he examiner will then begin to locate

the area of interest to be enhanced and examined in closer detailusing speciali0ed devices and software.

&efore processing audio and video evidence, a working copy of the

evidence may be created. !his assures that the original evidence is

always available in its unaltered state. 3n addition, the original will

always be available for comparison to the processed copy.

9ll examination procedures are carefully constructed so that the

image or video is a true and accurate representation of the scene.3nvestigators never change the recorded datathey only enhance

what is already present.

9ideo $nhance"ent Techni:ues - 9 variety of enhancement

techniues can be employed on video evidence. 3t is important that

the best video recording be submitted to obtain the best

enhancement results. imitations on the enhancement process may

exist if an analog copy or digital 1le that has undergone additional

compression is submitted for analysis. !echniues can includeGSharpening 8 Hakes edges of images in the recording become more

clear and distinct.

Video stabilization 8 2educes the amount of movement in the video,

producing the smoothest possible playback.

Masking 8 Covers the face or areas of the video that may protect a

witness, victim or law enforcement o$cer.

Interlacing 8 3n an analog system, interlaced scanning is used to

record images a techniue of combining two television 1elds in

order to produce a full frame of video#. 9 process called de-interlacing may be used to retrieve the information in both 1elds of

video.

Demultiplexing 8 9llows for isolation of each camera. 3n CC!"

systems, a device called a multiplexer is used to combine multiple

video signals into a single signal or separate a combined signal.

!hese devices are freuently used in security and law enforcement



applications for recording andor displaying multiple camera images

simultaneously or in succession.

Audio $nhance"ent Techni:ues - For audio recordings, a variety

of 1lters can be applied to enhance the material, bringing out

speci1c aspects or events contained in the recording.Frequency qualization J @ighly precise euali0ers can be used to

boost or cut speci1c bands of freuencies. !o help make speech

more intelligible, the freuency band containing most speech

content, '((@08+(((@0, can be ampli1ed or isolated. 3f ampli1cation

is applied to a freuency range, other information residing in this

freuency range will be boosted as well. 3f noise resides in this same

range, this noise will also be increased, limiting the ability to clarify

voices.

oud background noises may be analy0ed by a spectrum analy0erand the corresponding freuencies reduced so that these noises are

less noticeable.

!ompression J Faint sounds in the recording can be boosted by

compressing or leveling the signal so that the dynamic range of the

material is reduced, making soft sounds more apparent.

;aveform of a recording made at a low volume with signi1cantly loud ambient noise

that is masking the speech content of the recording.



!he same recording after enhancement. !he noise is attenuated and the volume of

the speech is increased.


A Siplified !uide "o


FA#sClick each uestion to show or hide the answers.

What kind of results should be expectedfrom enhancement or analysis of video and audio evidence?

3n most cases, the goal of the forensic audio or video professional is

to provide the absolute best representation possible of the video or

audio evidence. ow-lit video might be enhanced to provide more

details, and muKed audio may be clari1ed so that the words are

intelligible. @owever, each circumstance and recording is uniue.

http://www.forensicsciencesimplified.org/av/how.html#top

http://www.forensicsciencesimplified.org/av/how.html#top



;hile some dramatic improvements in clarity are possible, the

results of a forensic audio or video exam are highly dependent on

the uality of the source material.

What are the limitations of the analysis?6nhancement of video and audio are limited by the resolution of the

original recorded image. For video recordings, the higher the pixel

count or resolution of the image, the more detail is present in an

image. 9 recording may depict a suspect walking across the crime

scene, but if the camera optics are poor and the digital video

recorder4s resolution was reduced, then 0ooming into the image may

not provide additional details of the perpetrator4s appearance. !he

information was simply not recorded in the detail necessary toimprove it. !he con1guration of the CC!" system and placement of

the cameras is also imperative.

Common limiting factors include low light conditions for video

recordings or noisy environments for audio recordings. %amage to

the video or audio recording euipment can sometimes be

compensated for: however, this varies widely by circumstance.

How is quality control and qualityassurance performed?

9s with all forensic science disciplines, forensic laboratories, law

enforcement agencies and private agencies put in place policies and

procedures that govern facilities and euipment, methods and

procedures, and analyst uali1cations and training. %epending on

the state in which it operates, a crime laboratory may be reuired to

achieve accreditation to verify that it meets uality standards. !here

are two internationally recogni0ed accrediting programs in the U.*.that are focused on forensic laboratoriesG The A"erican Society

of Cri"e !aboratory #irectors !aboratory Accreditation

Board andANSI;AS< National Accreditation Board 7 F<S

!he *cienti1c ;orking Lroup on %igital 6vidence 2S+0#$3 and the

*cienti1c ;orking Lroup on 3maging !echnology 2S+0IT3 each




http://www.forquality.org/

http://www.swgde.org/

https://www.swgit.org/




http://www.forquality.org/

http://www.swgde.org/

https://www.swgit.org/



publish best practices and guidelines for ensuring uality and

consistency across digital and multimedia examinations. !hey also

incorporate best practice guidelines for managers, supervisors and

uality assurance managers.

What information does the analysis reportcontain?

9 report of 1ndings is usually provided to the investigator or person

who submitted the evidence for examination. !he examination

report may provide the following detailsG

• !he nature of the reuest

• !he results that were obtained

• 3denti1cation of the formattype of audiovideo

• !he type of processing that was performed

• %ates and time stamps that were visible

• %escription of the sub/ects, if visible

• %escription of the 1nal product provided e.g., enhanced video

prints or video recording#

• imitations in the examination

re there any common misconceptions oranything else about this topic that wouldbe important to the non!scientist?

?ot all audio or video evidence can be enhanced to provide clear

details. ;hile enhancements of recorded audiovideo evidence canbe made, those depicted on television crime dramas are often

unrealistic. !he amount of resolution reuired for the extreme

magni1cation used in these shows usually is not recorded with cell

phone or CC!" recordings.


http://www.forensicsciencesimplified.org/av/faqs.html#top

http://www.forensicsciencesimplified.org/av/faqs.html#top





$oon "ers !he following terms are commonly used in the area of forensic audio

and video analysis. !hese de1nitions are provided by the *cienti1c

;orking Lroup on %igital 6vidence *;L%6# and the *cienti1c

;orking Lroup on 3maging !echnology *;L3!#. 9 full

co"prehensive glossary is also available online.

Archive Copy - 9 copy of data placed on media suitable for long-

term storage, from which subseuent working copies can be

produced.

Artifact - 9 visualaural aberration in an image, video or audio

recording resulting from a technical or operational limitation.

6xamples include speckles in a scanned picture or MblockingN in

images compressed using the >6L standard.

Capture - !he process of recording data, such as an image, video

seuence or audio stream.

Co"pression - !he process of reducing the si0e of a data 1le. *eealso, Mossy CompressionN and Mossless CompressionN.#

#e;interlacing - *eparating an interlaced frame into two discrete

1elds.

Field - 9n element of a video signal containing alternate hori0ontal

lines. For interlaced video, the scanning pattern is divided into two

sets of spaced lines odd and even# that are displayed seuentially.

6ach set of lines is called a 1eld, and the interlaced set of the two

sets of lines is a frame.

Fra"e - ines of spatial information of a video signal. For interlacedvideo, a frame consists of two 1elds, one of odd lines and one of

even lines, displayed in seuence. For progressive scan non-

interlaced# video, the frame is written through successive lines that

start at the top left of the picture and 1nish at the bottom right.

https://www.swgit.org/pdf/SWGDE%20and%20SWGIT%20Digital%20and%20Multimedia%20Evidence%20Glossary?docID=60






I"age Analysis - 9 sub-discipline of %igital P Hultimedia 6vidence,

which involves the application of image science and domain

expertise to examine and interpret the content of an image andor

the image itself in legal matters.

I"age Co"parison - !he process of comparing images ofuestioned ob/ects or persons to known ob/ects or persons or

images thereof, and making an assessment of the correspondence

between features in these images for rendering an opinion regarding

identi1cation or elimination.

I"age Content Analysis - !he drawing of conclusions about an

image. !argets for content analysis include, but are not limited toG

the sub/ectsob/ects within an image: the conditions under which, or

the process by which, the image was captured or created: the

physical aspects of the scene e.g., lighting or composition#: andorthe provenance of the image.

Interlaced scan - 9 techniue of combining two television 1elds in

order to produce a full frame. !he two 1elds are composed of only

odd and only even lines, which are displayed one after the other but

with the physical position of all the lines interleaving each other,

hence interlaceQ.

Interpolation - 9 method of image processing whereby one pixel,

block, or frame is displayed or stored based on the di5erences

between the previous and subseuent pixel, block or frame of

information. R!aken from the 6ncyclopedia of >hotography Qrd

6ditionS !his is often done to increase the apparent clarity of an

image.

&ultiple%er7#e"ultiple%er - 9 device used to combine multiple

video signals into a single signal or separate a combined signal.

!hese devices are freuently used in security and law enforcement

applications for recording andor displaying multiple camera images

simultaneously or in succession.

No"inal resolution - !he numerical value of pixels per inch as

opposed to the achievable resolution of the imaging device. 3n the

case of Batbed scanners, it is based on the resolution setting in the

software controlling the scanner. 3n the case of digital cameras, this

refers to the number of pixels of the camera sensor divided by the

corresponding vertical and hori0ontal dimension of the area

photographed.



Sharpening - 9 process used to emphasi0e edge detail in an image

by enhancing the high freuency components.

Ti"e lapse video recording - >rocess by which images are

recorded at less than the standard rate of frames per second ?!*C8

'D.DT: >98'+.((# thus extending the period of time that can becovered by the storage medium.

9ideo stabilization - !he process of positioning individual frames

so that a selected ob/ect or person will remain in the same location

as the video is played.

+ork copy - 9 copy or duplicate of a recording or data that can be

used for subseuent processing andor analysis.Q %am/anovski, ". !!TV "etorking and Digital Technology , &utterworth-@einemannG

;altham, H9, '(((.

akia, 2. %. The Focal ncyclopedia o# $hotography , Qrd 6d., Focal >ress:&utterworth-@einemannG ;altham, H9, )DDQ.



http://www.forensicsciencesimplified.org/av/glossary.html#top

http://www.forensicsciencesimplified.org/av/principles.html#top

http://www.forensicsciencesimplified.org/av/glossary.html#top

http://www.forensicsciencesimplified.org/av/principles.html#top

Documents

ForeNsic Video and Audio Analysis