Video Authentication and Integrity Verification

Hash verification is the first step in any video authentication workflow. The examiner calculates the SHA-256 hash of the acquired file and records it. Any subsequent copy of that file can be verified against this hash; a mismatch means the copy has been altered. This is the same chain-of-integrity mechanism used throughout digital forensics.

The limitation for DVR footage is significant. A proprietary DVR export is a file produced by the DVR's own software. If an operator deleted two minutes of footage before the investigator arrived and then exported the remaining footage, the exported file is a complete, unmodified copy of a manipulated recording. The hash of that file is perfectly valid. It certifies that the export has not changed since the investigator took it; it says nothing about whether the underlying recording is complete.

Some DVR systems embed a proprietary watermark in the bitstream at the time of recording. Hikvision, Dahua, and several other major vendors offer watermark verification tools that check each frame's embedded checksum against the frame data. If the checksum fails for any frame, the tool flags it. These systems are useful but depend on the vendor's co-operation and tool availability; they are not universal.

A video file typically carries timestamps in at least three places: the container metadata (the file's creation and modification dates in the filesystem), the stream metadata inside the container (H.264 timing information embedded in the bitstream), and the burned-in on-screen display (OSD) overlaid on the video frames by the recorder. A fourth source exists if the recorder embeds timestamps in a separate metadata track within the container.

In an unmodified export, all four sources should be consistent after accounting for any clock offset. An inconsistency is a red flag. Common scenarios that produce inconsistency: the file was copied and the filesystem timestamps updated by the copy operation (modification date later than recording date); the OSD was manually adjusted without updating the stream metadata; or the recording was re-encoded and the stream timestamps reset to reflect the re-encoding time rather than the original recording time.

The practical takeaway is that an adversary who re-encodes the footage to insert or delete sections will have reset the bitstream timing, but may have forgotten to update the container metadata or the filesystem timestamps. Examining all available sources and looking for inconsistencies between them is more powerful than relying on any single source.

H.264 and H.265 divide footage into groups of pictures (GOP). Each GOP begins with an I-frame: a fully self-contained image. The subsequent P-frames and B-frames encode only the differences from the reference frame. This scheme is efficient but it also makes editing leave marks.

When an editor cuts out a section and joins the remaining segments, the P-frames immediately after the cut are encoded relative to a reference frame that no longer precedes them in the sequence. The decoder tries to apply a motion vector from the old scene to a completely different new scene and the result is a burst of large prediction errors, visible as blocking or ghosting artefacts. A naively edited file shows this at every cut point. A more sophisticated edit re-encodes the joined segments so that the GOPs are consistent, but re-encoding itself leaves a double-compression signature.

Duplicated frames are a different signature. If footage is slowed by repeating frames, or if a static section is artificially extended, the frame difference signal drops to near zero across the repeated section. A real static scene (an unmoving camera pointing at an empty room) also produces near-zero differences, so the examiner must judge whether the duration and content of the zero-difference section is plausible given what is depicted. Inserted frames (a section spliced in from a different recording) show a different noise pattern, camera ID metadata mismatch, or inconsistent compression quality compared with the surrounding footage.

Variable bitrate (VBR) encoding allocates more bits to complex frames and fewer to simple ones. A fight scene produces a higher bitrate than an empty corridor. Graphing the per-second bitrate over the recording duration produces a curve that broadly tracks scene complexity. This curve is a powerful anomaly detector.

A replaced segment compressed at a different quality setting or with a different encoder will typically show a step change in the bitrate level or a different noise texture in the bitrate curve. A deleted section that was re-encoded to join the gap may show an anomalously smooth region where the original encoding variability was lost. These are not proof of tampering in isolation, but they are strong indicators that warrant further investigation.

Tools for bitrate analysis include MediaInfo (free, reads the container and stream headers), Amped FIVE (commercial, designed for forensic video analysis), and ffprobe (command-line, part of the FFmpeg suite). For court presentation, the examiner should export a graph of bitrate over time and annotate any anomalous regions, explaining in plain terms why the deviation is inconsistent with normal recording behaviour.

Re-recording is a low-tech tampering method: the original footage is played on a monitor or television and a second camera records the screen. This allows sections to be skipped during playback, replacing them with a momentary cut. It also introduces a set of physical artefacts that are difficult to avoid.

• Moiré patterns: interference between the pixel grid of the recording camera's sensor and the pixel grid of the display creates a visible interference pattern, particularly in fine-grained regions of the image.
• Temporal aliasing: if the camera and display do not share the same refresh rate, rolling shutter effects or horizontal bands of light or dark appear across the frame.
• Screen geometry: barrel distortion, keystoning, and visible screen edges or bezels appear if the camera was not exactly perpendicular to and centred on the screen.
• Double compression: the original compression artefacts survive into the re-recording and are joined by a second layer, producing DCT coefficient statistics different from any single-compression original.
• Environmental reflections: ambient light reflected in the screen surface may be visible, including the recording camera itself.