Audio Video Media Forensics

Brian Prendergast, Senior Consultant, Cyber Risk Advisory - Forensics, Coalfire

Our media forensics practice is a fast growing part of Coalfire.  We’re often asked what we can do, and this post is intended to be a quick primer to provide some background if you’re in need of this service and what you can expect from us and others in the field.

Why does anybody need “Media Forensics”?
You don’t have to look very far to see how oversaturated our lives are with digitally recorded media.  Daily life is being recorded visually and audibly at all times through some means somewhere.  There are surveillance cameras in malls, banks, fast food restaurants, city streets, and on people’s homes.  Social media websites are plastered with smartphone photos and videos.  There are also voicemails, traffic cams, cockpit voice recorders (CVR), VoIP recordings, depositions, webcams, and “this call may be recorded for quality assurance.”  Everything from amateur selfies to professionally produced terrorist organization videos can offer much more information than they intend to.  It is typical for recordings of many types to be involved in an investigation, whether the recordings were created for that purpose or not.  A forensic analyst with specialized training is able to provide insight into audio/visual recordings that may not be apparent on the surface.

I’ve seen CSI – they just click a button!    
The right blend of various forensic enhancement techniques can be applied to poor quality recordings to allow for the perception of more information or to zero in on specific information.  This can be used to significantly increase the intelligibility of dialogue or restore detail to images.  This goes far beyond clicking “enhance.”  A forensic specialist can compensate for many issues that contribute to the degradation of quality, but there are additional aspects that can be investigated to gain more information from a recording.  For example, it is possible to determine the distance and height of objects, trajectory and speed, colors, location, time of day, correct lens aberration, and to employ video and image comparison for the identification of individuals or objects.  Analysis of audio recordings can allow for the identification of people, offer clues about the circumstances or the actions taking place, and provide evidence about the recording device, time, and environment.

What makes this hard?
An in-depth understanding of the recording medium itself is required to best understand which techniques are best used for each scenario in order to overcome the issues that obscure the desired information contained within the recording.  The various sources of recorded media result in widely varying degrees of quality.  Digital recordings also come in a wide variety of standard and non-standard formats, each which present new and unique challenges.  The ability to playback a non-standard format recording at all can sometimes present the greatest challenge since they typically require the appropriate proprietary video players or codecs (further reading here).  To determine how much or how little of each parameter to adjust and which methods are most appropriate to use requires extensive training and experience.

What if somebody alters the recording (really, really well)?  What do you do then?
The authenticity of a recording involved in litigation is often called into question which requires expert analysis to determine whether the evidence is, in fact, an honest and true representation of what it purports to be.  Types of manipulation or editing can be as subtle as timestamp alteration, or as blatant as entirely removing an object form a picture.  A forensic specialist who is well-versed in the medium should be able to properly employ techniques to detect the manipulation of audio, video, or image content.  There is highly specialized research that has been conducted in this field that is rooted in science.  Some of the earliest groundbreaking research in audio forensics dates back as far as the Watergate scandal where the infamous audio recording gap called into question the authenticity of the audio recordings.  The research dedicated to the authentication of recordings continues to evolve to keep up with rapidly changing recording technology.

We hope this is helpful to understand the capabilities of a media forensics offering.  

<shameless plug> Coalfire employs forensic techniques that have undergone empirical testing, have been subject to peer review, are controlled by standards, and have general acceptance in the relevant scientific community.  Maintaining the integrity and provenance of audio/visual evidence upon seizure and throughout processing ensures that any AV evidence examined by Coalfire is admissible in a court of law. <shameless plug>

Learn more about Coalfire’s AV Forensic services.

Brian Prendergast


Brian Prendergast — Senior Consultant, Cyber Risk Advisory - Forensics, Coalfire

Recent Posts

Post Topics