Detecting Frame Deletion and Insertion in Video

Raw video from a camera sensor produces a new complete image for every frame. At 1080p and 30 frames per second, an hour of uncompressed video requires roughly 560 GB. Practical storage and transmission requires compression. Codecs such as H.264 (AVC) and H.265 (HEVC) reduce this by storing only the first frame of each GOP as a complete image (the I-frame) and representing every subsequent frame as the difference from its reference frame.

A P-frame contains motion vectors describing how blocks of pixels moved from the reference frame, and a residual describing any prediction error. A B-frame uses two references: a frame before it and a frame after it. When the codec decodes a P-frame or B-frame, it reconstructs the image by applying the motion vectors to the reference frame and adding the residual. If the reference frame is missing because it was deleted, the decoder either fails or produces visually corrupted output, and the stored residual values become forensically anomalous.

This dependency structure is what makes frame deletion traceable. The tamperer cannot simply remove a frame from the bitstream without affecting all frames that depend on it in the same GOP. They must either accept the resulting artifacts, re-encode the clip (which leaves double-compression evidence), or carefully reconstruct the codec's state after the deletion point, which requires specialised tools and leaves its own artifacts.

The first step in a frame-tampering examination is to extract the frame type sequence from the bitstream and compute GOP lengths throughout the recording. Tools such as FFprobe, MediaInfo, and ExifTool can output frame type and packet timing data. For a camera recording at a fixed GOP length (a common setting in CCTV encoders), every GOP in an unmodified file has the same length. A single anomalous GOP that is shorter or longer than the rest is the primary indicator of frame deletion or insertion at that point.

Examiners document the expected GOP length from the codec parameters stored in the file header or from analysis of the first 60 seconds of the recording. They then plot GOP lengths across the entire file and flag any that deviate by more than one frame. The position of the anomalous GOP, expressed as a byte offset and a timecode, is recorded in the examination report.

Container formats such as MP4, MKV, and AVI store a presentation timestamp (PTS) and a decoding timestamp (DTS) for each packet. In a camera recording at 30 frames per second with a 90 kHz time base, successive PTS values should differ by exactly 3000 (90000 divided by 30). Any deviation from this interval indicates that the file has been altered or that the camera had a fault.

Frame deletion leaves a gap: instead of PTS values 0, 3000, 6000, 9000, the sequence might read 0, 3000, 9000, 12000, showing that the frame at PTS 6000 is missing. Frame insertion can produce duplicated PTS values or a compressed interval where two frames occupy the space that one would normally occupy. FFprobe with the -show_packets flag outputs PTS and DTS for every packet. A simple script computing the first difference of PTS values and flagging deviations from the expected interval localises tampering to the exact packet position.

A sophisticated tamperer may rebuild the timestamp sequence after deletion to eliminate the gap. In that case, PTS values look continuous, but the inter-frame content is now inconsistent with the stated frame rate: the video appears to skip or jump at the tamper point. Comparing the measured motion between frames against the motion expected at the stated frame rate can detect this. A deleted second of 30 fps content replaced with re-timed timestamps will have the visual motion of skipped frames, which diverges from the motion field measured elsewhere in the recording.

Inter-frame residuals measure how well each P-frame or B-frame was predicted from its reference. In normal video, residuals are highest at natural scene cuts and lowest during slow, predictable motion. The spatial pattern of high residuals at a scene cut is coherent: the entire frame is unpredictable because the reference frame shows a different scene entirely. At a deletion point, the residual pattern is incoherent: the prediction partially succeeds for some regions and fails sharply for others, because the deleted frame was part of a continuous scene, not a cut.

Motion vector consistency analysis looks at the direction and magnitude of motion vectors across consecutive frames. In unmodified video, an object moving across the frame produces a sequence of vectors that trace a smooth path. Deleting a frame creates a discontinuity: the motion vector at the tamper boundary is twice or three times the magnitude expected from the surrounding frames, or changes direction abruptly. This is distinct from natural fast motion because fast motion produces large vectors consistently across several frames, not a single anomalous jump surrounded by normal values.

Re-encoding is the tamperer's most effective countermeasure. Transcoding the edited clip through a new encoding pass replaces the original bitstream with a fresh one, eliminating broken motion-prediction chains, rebuilding GOP structure, and resetting timestamps. A re-encoded clip can pass basic GOP and timestamp checks.

Re-encoding does not, however, eliminate all evidence. Double-compression analysis, covered in detail in the Video Double-Compression Analysis topic, exploits the statistical signature left in the DCT coefficient distribution. When a clip is encoded twice, the quantisation grid of the first encode imposes structure on the coefficients that survives the second encode. Histograms of DCT coefficients in a double-compressed clip show characteristic dips at quantisation step boundaries that are absent in single-encoded material.

If the tamperer re-encodes only a segment of the clip and rejoins it to the original, the splice point between single-encoded and double-encoded segments becomes detectable. The statistical signature of the DCT coefficients changes at the join point. Segment-level analysis, computing the DCT histogram for each GOP or sliding window rather than for the whole file, localises the re-encoded segment and therefore the region of potential tampering.

Before any analysis, the examiner acquires a forensic copy of the original file, records the SHA-256 hash, and stores the original in write-protected form. All analysis is conducted on the working copy. This discipline applies globally: the UK College of Policing Digital Media Advisor framework, the US SWGDE guidelines, and the Bharatiya Sakshya Adhiniyam 2023 in India all require that the integrity of the original exhibit be demonstrable. Working from the original without a hash-verified copy invalidates the chain of custody. See Chain of Custody for Digital Media for the procedural requirements.

Common tools used in frame-tampering analysis include FFprobe for packet-level timestamp and frame-type extraction, ExifTool for container metadata, MediaInfo for codec parameter verification, and custom Python scripts using OpenCV or the FFmpeg API for inter-frame difference computation. Commercial tools such as Cognitech VideoInvestigator and Amped FIVE include automated GOP and timestamp analysis modules. The examiner must document which tool version was used, because tool updates can affect output format.

Examination reports for court presentation must be reproducible: any competent examiner using the same tools on the same file should arrive at the same measurements. Reports state the baseline GOP length, the measured GOP lengths at each anomalous position, the expected and actual PTS delta at each flagged location, and any inter-frame residual values above the threshold established from the unmodified portions of the file. Conclusions are expressed as findings (what was measured) and interpretations (what those measurements indicate), kept as separate sections to aid cross-examination.