Authentication forensics
Definition
The examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the claimed time, and has not been altered since capture. The question under examination is integrity and provenance, not content intelligibility.
Related terms
- Enhancement forensics
- The processing of a media file to improve the perceptibility of its content, such as denoising, contrast adjustment, or frame interpolation. Enhancement...
- Forensic working copy
- A verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The...
- Provenance
- The documented origin of a media file: the device that captured it, the time and location of capture, the chain of custody...
- Scope statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...
- Tamper artefact
- A signal in a media file that indicates manipulation: a discontinuity in compression parameters, an inconsistency in noise profile, a gap in...
Explained in
- Authentication Versus Enhancement: Defining the Examiner's ScopeThe examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the claimed time, and has not been altered...