Enhancement Forensics
Definition
The processing of a media file to improve the perceptibility of its content, such as denoising, contrast adjustment, or frame interpolation. Enhancement assumes the file is genuine and does not assess whether it has been tampered with.
- Assumes
- The media file is genuine, unaltered
- Typical steps
- Denoising, contrast adjustment, frame interpolation
- Excludes
- Tamper assessment of the source file
Common questions
Why must an examiner keep enhancement and authentication separate?+
Enhancement changes pixel values to make existing content easier to see, which would corrupt the traces an authentication examination relies on. Doing both on the same working copy risks the examiner later being unable to say whether an anomaly was original or introduced.
Can an enhanced image still be used as evidence?+
Yes, provided the original file is preserved unaltered, the enhancement steps are logged and reproducible, and the enhanced version is presented as a processed derivative rather than as the primary exhibit.
Related terms
- Authentication Forensics
- The examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the...
- Forensic Working Copy
- A verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The...
- Provenance
- The documented origin of a media file: the device that captured it, the time and location of capture, the chain of custody...
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...
- Tamper Artefact
- A signal in a media file that indicates manipulation: a discontinuity in compression parameters, an inconsistency in noise profile, a gap in...