Tamper Artefact
Definition
A signal in a media file that indicates manipulation: a discontinuity in compression parameters, an inconsistency in noise profile, a gap in Electric Network Frequency data, or an anomaly in metadata timestamps. These artefacts are the evidence authentication analysis seeks. Enhancement processing can eliminate them.
- Examples
- Compression discontinuity, noise-profile inconsistency, ENF gap, metadata anomaly
- Role
- The evidence multimedia authentication analysis seeks
- Risk
- Enhancement processing can eliminate these artefacts
- Field
- Digital media authentication
Common questions
Why does the order of authentication versus enhancement matter for preserving tamper artefacts?+
Enhancement processes such as denoising, resampling, or recompression can smooth over or erase exactly the discontinuities and inconsistencies an authentication examination relies on, so best practice is to perform authentication analysis on the original file before any enhancement is applied, and to keep the original preserved regardless.
Can a single tamper artefact conclusively prove a media file was manipulated?+
Rarely on its own; a single anomaly such as one metadata field being unusual can have an innocent explanation like device software updates or file transfer processes, so examiners typically look for multiple converging artefacts across compression, noise, and metadata before concluding manipulation occurred.
How does Electric Network Frequency (ENF) analysis reveal a tamper artefact specifically?+
Recordings made near mains-powered equipment can pick up a faint hum locked to the local power grid's frequency, which fluctuates in a documented pattern over time; a gap, discontinuity, or mismatch in that ENF trace against the expected grid record can indicate the recording was cut, spliced, or is not continuous.
Related terms
- Authentication Forensics
- The examination of a media file to determine whether it is genuine: whether it was created by the claimed device, at the...
- Enhancement Forensics
- The processing of a media file to improve the perceptibility of its content, such as denoising, contrast adjustment, or frame interpolation. Enhancement...
- Forensic Working Copy
- A verified duplicate of the original file, created by hashing the original and confirming hash match, on which processing is performed. The...
- Provenance
- The documented origin of a media file: the device that captured it, the time and location of capture, the chain of custody...
- Scope Statement
- The formal declaration at the start of a forensic report that defines what question the examiner was asked to answer. A scope...