Authentication Forensics
Definition
The examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the claimed time, and has not been altered since capture. The question under examination is integrity and provenance, not content intelligibility.
- Core question
- Is the media genuine, unaltered and correctly attributed?
- Focus
- Integrity and provenance, not content clarity
- Distinct from
- Enhancement, which improves intelligibility
Common questions
How does authentication forensics differ from enhancement work?+
Enhancement assumes the recording is genuine and tries to make an already-accepted file clearer to see or hear. Authentication asks the prior question of whether the file itself is what it claims to be.
What kinds of evidence support an authentication finding?+
Examiners look at file metadata, compression and encoding artifacts consistent with the claimed source device, and a documented chain of custody, rather than only the visible or audible content.
Related terms
- Enhancement Forensics
- The processing of a media file to improve the perceptibility of its content, such as denoising, contrast adjustment, or frame interpolation. Enhancement...
- Forensic Working Copy
- A verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The...
- Provenance
- The documented origin of a media file: the device that captured it, the time and location of capture, the chain of custody...
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...
- Tamper Artefact
- A signal in a media file that indicates manipulation: a discontinuity in compression parameters, an inconsistency in noise profile, a gap in...