Forensic working copy
Definition
A verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The original is never altered. Any enhancement is performed only on the working copy after authentication of the original is complete.
Related terms
- Authentication forensics
- The examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the...
- Enhancement forensics
- The processing of a media file to improve the perceptibility of its content, such as denoising, contrast adjustment, or frame interpolation. Enhancement...
- Provenance
- The documented origin of a media file: the device that captured it, the time and location of capture, the chain of custody...
- Scope statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...
- Tamper artefact
- A signal in a media file that indicates manipulation: a discontinuity in compression parameters, an inconsistency in noise profile, a gap in...
Explained in
- Authentication Versus Enhancement: Defining the Examiner's ScopeA verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The original is never a...