Post on 07-Jul-2018
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 1/18
A Simplified Guide To
Forensic Audio and Video Analysis
IntroductionUnlike other forms of forensic evidence, audio and video recordings
can provide a real-time, eyewitness account of a crime so
investigators can watch or hear what transpired. For instance, a
surveillance video captures a bank robbery in progress, or a hidden
camera records an undercover sting operation.
Over the past decade, sources of recorded audio and video that can
assist in an investigation have increased exponentially. Closed
circuit television systems CC!"# and video and audio recorders can
be found in businesses, at tra$c intersections, parking lots, bank
machines, on police-vehicle dashboards and of course, in cell
phones.
For large-scale events or crimes, the sheer amount of recorded
audio and video evidence can be massive. %uring the riots thatoccurred in "ancouver, &ritish Columbia after the '()) *tanley Cup
Finals, more than +,((( hours of recordings were captured. aw
enforcement has since brought charges against more than a
hundred rioters using video evidence and more charges are
expected.
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 2/18
For most crimes, however, high-uality audio andor video
recordings are often not available. !his is where forensic audio andvideo expertise can help. Forensic experts have many techniues to
enhance recordings that can bring out details and provide a clearer
picture of what occurred, or make an audio recording more audible.
!his in turn helps investigators, lawyers and /urors better conduct
their duties.
Back to top of page ▲
NFSTC
A Simplified Guide To
Forensic Audio and Video Analysis
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 3/18
Principles of Forensic Audio and
Video Analysis !o assist in an investigation, forensic experts can repair, recover,
enhance and analy0e audio and video recordings using an array of
scienti1c tools and techniues.
Repair and Recovery of Evidence
&efore audio and video evidence can be
analy0ed, it may 1rst need to be repaired or recovered from
damaged media or a damaged recording device.
2epairing evidence is especially common for analog and digital
magnetic tape. 3t may need to be spliced back together or put into a
new audiovideo housing in order to recover the audio or video. 3n
today4s digital world, C%s, %"%s, cell phones, portable cameras and
other sources of digital media and recording devices can be
damaged by heat, misuse, the environmental conditions of a crime
scene, or simply on purpose by an o5ender. 6ven in these situations,
the digital 1les can be recovered and used for analysis.
Evidence Enhancement
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 4/18
!he most common function of forensic video and audio experts is to
clarify a recording so that it is more apparent to investigators,
attorneys and /urors what the evidence demonstrates.
To enhance a video recording, 1lters can be used to ad/ust thebrightness and contrast, correct the color, crop and resi0e an image,
enhance edge detail and reduce visual distortion. !he speed of
playback can also be ad/usted to more accurately display the frame
rate at which it was recorded.
Before Stabilization Courtesy of !arget7 Forensic *ervice#
After Stabilization Courtesy of !arget7 Forensic *ervice#
To enhance an audio recording, 1lters can be employed to
improve clarity. !his may entail removal of unwanted noise or
enhancing the intelligibility of speech. 2ecordings will often be madein less than ideal circumstances, such as when someone is wearing
a body wire. Utili0ing audio engineering techniues may allow faint
voices or events to be heard more clearly on playback.
Analysis, Interpretation and Identification
Authentication of recordings 8 3n many criminal cases, the
authenticity of the recording and the content of the recording may
be called in to uestion. Forensic audio and video experts can
examine a variety of characteristics of the audio or video recordingto determine whether the evidence has been altered. !his includes
con1rming the integrity veri1cation# of the recording, as well as
authenticating that the content of the image or audio is what it
purports to be.
3f the ambient sound present on an audio recording changes
abruptly, this could indicate that the environment where the
recording took place suddenly changed. !he volume and tone of a
voice on the recording can provide clues as to distance and spatial
relationships within a scene. ighting conditions can be examined toestimate the time of day or environmental conditions at the time of
the recording.
!echnical details may also con1rm information about a recording.
For instance, an unnatural waveform present in the audio or video
signal may indicate that an edit has been made. 9 physical identi1er
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 5/18
may be present in the signal on magnetic tape that can identify it as
a copy or indicate that it was recorded on a particular device.
*ometimes, a perpetrator will try to destroy audio or video
evidence: however, using these methods, the recording can be
analy0ed to determine what occurred.
3n the famous ;atergate investigation, a great deal of e5ort was
spent examining an )<=-minute gap in an audio recording of
>resident 2ichard ?ixon discussing the ;atergate break in with his
Chief of *ta5. 9nalysis of the audio signature) left behind in this
erased portion allowed investigators to determine which ;hite
@ouse tape recorder made the erasure and how many di5erent
erasures were made. 6xamining the level of 9C hum recorded to
tape even provided details on whether the recording took place in?ixon4s secretary4s o$ce or in another location.
9nd new techniues are constantly being developed. 9 uniue
approach employed in the United Aingdom examines the low-
freuency hum captured when a recorder is plugged into an
electrical outlet or near a strong electrical current. !his freuency
will alternate slightly depending on the power load experienced at
that time of day. &y examining minute Buctuations of this freuency,
analysts can determine whether a recording took place at the stated
time and whether the recording is continuous and unaltered. !his
techniue has been in use in the UA for over eight years: in the
United *tates, this techniue is still being researched and databases
are being built for comparison.
Identifying people or obects on a recording 8 3dentifying a
person or ob/ect from an image on a video or voice on an audio
recording reuires training in 3mage Content 9nalysis or speech
science. !hese examinations are detailed comparisons of an
unknown recording to a known recording, or an unknown ob/ect to a
known ob/ect in an attempt to make a positive identi1cation. For
instance, an image of a hat at the crime scene may be compared
with a hat found on a suspect. !he comparison techniues used in
image analysis follow the same detailed comparison techniues as
Fingerprint and %ocument examiners. !earn "ore about
Fingerprints and#ocu"ent $%a"ination !he analysis and
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 6/18
comparison of voices is an evolving area of practice that can be
controversial in criminal cases.)&ellinger' (hilip T)' *Cracking +atergate,s Infa"ous -./ &inute
0ap1' Forensic Magazine 2online3 February -.' 45-- 2accessed Septe"ber
6' 45-43
A Simplified Guide To
Forensic Audio and Video Analysis
Why and when is audio-videoevidence used?3n the movie, The Fugitive, %r. 2ichard Aimble, played by @arrison
Ford, is on the run from police. @e calls the Chicago >olice
%epartment to proclaim his innocence. @e ends the phone call
before it can be traced, but there was one thing he didn4t anticipate
the sound of the train can be heard in the background. &yanaly0ing the recording, the police know he4s calling from Chicago.
;hile most audio evidence won4t launch a city-wide manhunt, it
may aid the investigators in piecing together the facts of a case.
9udio from a recorded D)) phone call, for instance, can provide key
informationnot only from the words of the caller, but from sounds
in the background. Can the assailant be heard in the distanceE @ow
many parties are audible on the tapeE
To Corroborate Statements
3n many cases, audio and video evidence can be used to corroborate
sub/ect or witness statements. For instance, video from a security
camera can provide information on the direction or means of travel
into or away from the crime scene. %id the sub/ect Bee in a -door,
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 7/18
red FordE %id he depart the scene heading north or southE !he
recorded footage can con1rm a witness statement.
*ometimes a video surveillance camera is the only eyewitness to a
crime. "ideo evidence was key in 1nding and identifying theperpetrator in the abduction and killing of ))-year-old Carlie &rucia
of *arasota, F. "ideo from security cameras showed her being
taken from a carwash parking lot and led away by a middle-aged
man wearing a work uniform. !he video of the abduction circulated
nationwide on television and a housemate of the perpetrator called
police when she saw the footage.
Upon enhancement of the video recording, investigators were able
to provide clearer images of the man4s face, tattoos on his forearms,and even the name tag on his uniform.
To Identify Suspects
!he power of video evidence in aiding an investigation is illustrated
by a website created by the "ancouver >olice' to identify suspects
from the infamous '()) *tanley Cup riots. 9fter painstakingly
reviewing the video evidence, photos of rioters have been extracted
from these videos and posted on the site for identi1cation by thegeneral public.
6ven if video or audio evidence does not capture key actions of the
crime, the recording may be able to add information or provide
additional details such as the appearance of the perpetrator or what
they were wearing.
A Simplified Guide To
Forensic Audio and Video Analysis
How It’s Done
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 8/18
Audio and Video Evidence That May e Analy!ed
9udio and video evidence can be found at more locations and from
more diverse sources than ever before. From convenience stores to
fast food restaurants, malls to banks, tra$c intersections to parks,CC!" systems are virtually everywhere. 9nd cell phone cameras
extend a watchful eye to nearly every corner of every town. 9udio
evidence may be available from D)) calls, telephone answering
machines, voicemail recordings, video cameras, cell phones and
computer 1les.
"o# the Evidence Is Collected
%epending on the circumstance, the
surroundings, and the witnesses who may have been present,
several di5erent recordings of an event may be available. !he
responding o$cers or crime scene investigators should 1rst identify
all video or audio evidence that may exist. 3n addition to surveillance
cameras at the scene, surveillance systems nearby may provide
valuable footage, such as recordings of a perpetrator approaching or
Beeing a scene.
6ven if the recording does not appear to be very clear or useful, all
relevant footage should be collected. Forensic enhancement may
recover details that aren4t noticeable when viewing or listening to
the unprocessed recording.
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 9/18
#igital video and audio - ;ell over half of all closed-circuit
television evidence sei0ed by police today is digital and 1le-based,
although some systems can record to digital magnetic tape. %igital
video recorders come in two general typesG embedded stand-alone
and >C-based. &oth types generally record the audio and video tohard drives: however, some systems record to secure digital *%#
cards and other removable media.
%igital video and audio evidence from CC!" systems are generally
proprietary in nature and reuire a special software player produced
by the manufacturer to play back the collected recordings properly.
;hen the video and audio is collected from the device it needs to be
retrieved in a manner that produces the best uality possible, which
is usually the proprietary recorded 1les. !here are numerous types
of digital video and audio recording devices, with a variety ofmethods of exporting these 1les. *ome will have C%%"% writing
capabilities, some use U*& for output, and some, although digital,
may only have analog outputs. Find further infor"ation on
proper collection "ethods
Analog video and audio - 9nalog video systems are rapidly
becoming a recording technology of the past: however, many are
still in use today. 3f a system uses analog tape, the investigator
should bear in mind that every playback of the tape will degrade the
recorded images. >rior to e/ecting the tape, the investigator will
make sure the tape is stopped, document everything on the display,
then e/ect the tape and remove the write protection tab to prevent it
from being recorded over. 9 copy of the tape should then be made
for all future viewing, preserving the original video evidence.
2egardless of whether the evidence was recorded by a digital or
analog system, the investigator should note the make and model of
the recording device and important details about the recording
system e.g., how many cameras are connected and recording,
whether it is recording in time-lapse mode, the current timedate,
and the timedate on the recorder4s display#. 3t is also preferable to
sketch the cameras4 positions.
$ho Conducts the Analysis
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 10/18
!he disciplines of forensic audio analysis, forensic video analysis,
image analysis and computer forensics are recogni0ed as four
separate disciplines by the 9merican *ociety of Crime aboratory
%irectors aboratory 9ccreditation &oard 2ASC!#7!AB3. Hany
Federal, *tate and local law enforcement and private agencies arenow developing %igital and Hulti-Hedia *ections within their
agencies that may include some or all of these disciplines. 3n some
agencies, examinations may be conducted by the same person. 3n
large agencies, and on the Federal and *tate level, most examiners
speciali0e in one discipline and become a sub/ect matter expert
after years of experience.
9gencies may have an in-house training program that includes
vendor-based training, training with senior examiners and
competency testing. !his ensures analysts have the speci1c skills tomatch the services their agency provides. 9dditional information on
training reuirements is available from guidelines of the Scienti8c
+orking 0roups on #igital $vidence and I"aging Technology.
!wo certi1cation programs currently exist in the discipline of "ideo
9nalysisG aw 6nforcement and 6mergency *ervices "ideo
9ssociation 2!$9A3 and the 3nternational 9ssociation for
3denti1cation 2IAI3. 3n the 1eld of forensic audio, training courses are
available, but no speci1c certi1cation currently exists.
Courtesy of !argetI Forensic *ervices
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 11/18
"o# the Analysis Is %erformed
!he 1rst step of an analysis is for the examiner to simply listen to or
view the recorded footage. !he examiner will then begin to locate
the area of interest to be enhanced and examined in closer detailusing speciali0ed devices and software.
&efore processing audio and video evidence, a working copy of the
evidence may be created. !his assures that the original evidence is
always available in its unaltered state. 3n addition, the original will
always be available for comparison to the processed copy.
9ll examination procedures are carefully constructed so that the
image or video is a true and accurate representation of the scene.3nvestigators never change the recorded datathey only enhance
what is already present.
9ideo $nhance"ent Techni:ues - 9 variety of enhancement
techniues can be employed on video evidence. 3t is important that
the best video recording be submitted to obtain the best
enhancement results. imitations on the enhancement process may
exist if an analog copy or digital 1le that has undergone additional
compression is submitted for analysis. !echniues can includeGSharpening 8 Hakes edges of images in the recording become more
clear and distinct.
Video stabilization 8 2educes the amount of movement in the video,
producing the smoothest possible playback.
Masking 8 Covers the face or areas of the video that may protect a
witness, victim or law enforcement o$cer.
Interlacing 8 3n an analog system, interlaced scanning is used to
record images a techniue of combining two television 1elds in
order to produce a full frame of video#. 9 process called de-interlacing may be used to retrieve the information in both 1elds of
video.
Demultiplexing 8 9llows for isolation of each camera. 3n CC!"
systems, a device called a multiplexer is used to combine multiple
video signals into a single signal or separate a combined signal.
!hese devices are freuently used in security and law enforcement
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 12/18
applications for recording andor displaying multiple camera images
simultaneously or in succession.
Audio $nhance"ent Techni:ues - For audio recordings, a variety
of 1lters can be applied to enhance the material, bringing out
speci1c aspects or events contained in the recording.Frequency qualization J @ighly precise euali0ers can be used to
boost or cut speci1c bands of freuencies. !o help make speech
more intelligible, the freuency band containing most speech
content, '((@08+(((@0, can be ampli1ed or isolated. 3f ampli1cation
is applied to a freuency range, other information residing in this
freuency range will be boosted as well. 3f noise resides in this same
range, this noise will also be increased, limiting the ability to clarify
voices.
oud background noises may be analy0ed by a spectrum analy0erand the corresponding freuencies reduced so that these noises are
less noticeable.
!ompression J Faint sounds in the recording can be boosted by
compressing or leveling the signal so that the dynamic range of the
material is reduced, making soft sounds more apparent.
;aveform of a recording made at a low volume with signi1cantly loud ambient noise
that is masking the speech content of the recording.
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 13/18
!he same recording after enhancement. !he noise is attenuated and the volume of
the speech is increased.
Back to top of page ▲
A Siplified !uide "o
Forensic Audio and Video Analysis
FA#sClick each uestion to show or hide the answers.
What kind of results should be expectedfrom enhancement or analysis of video and audio evidence?
3n most cases, the goal of the forensic audio or video professional is
to provide the absolute best representation possible of the video or
audio evidence. ow-lit video might be enhanced to provide more
details, and muKed audio may be clari1ed so that the words are
intelligible. @owever, each circumstance and recording is uniue.
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 14/18
;hile some dramatic improvements in clarity are possible, the
results of a forensic audio or video exam are highly dependent on
the uality of the source material.
What are the limitations of the analysis?6nhancement of video and audio are limited by the resolution of the
original recorded image. For video recordings, the higher the pixel
count or resolution of the image, the more detail is present in an
image. 9 recording may depict a suspect walking across the crime
scene, but if the camera optics are poor and the digital video
recorder4s resolution was reduced, then 0ooming into the image may
not provide additional details of the perpetrator4s appearance. !he
information was simply not recorded in the detail necessary toimprove it. !he con1guration of the CC!" system and placement of
the cameras is also imperative.
Common limiting factors include low light conditions for video
recordings or noisy environments for audio recordings. %amage to
the video or audio recording euipment can sometimes be
compensated for: however, this varies widely by circumstance.
How is quality control and qualityassurance performed?
9s with all forensic science disciplines, forensic laboratories, law
enforcement agencies and private agencies put in place policies and
procedures that govern facilities and euipment, methods and
procedures, and analyst uali1cations and training. %epending on
the state in which it operates, a crime laboratory may be reuired to
achieve accreditation to verify that it meets uality standards. !here
are two internationally recogni0ed accrediting programs in the U.*.that are focused on forensic laboratoriesG The A"erican Society
of Cri"e !aboratory #irectors !aboratory Accreditation
Board andANSI;AS< National Accreditation Board 7 F<S
!he *cienti1c ;orking Lroup on %igital 6vidence 2S+0#$3 and the
*cienti1c ;orking Lroup on 3maging !echnology 2S+0IT3 each
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 15/18
publish best practices and guidelines for ensuring uality and
consistency across digital and multimedia examinations. !hey also
incorporate best practice guidelines for managers, supervisors and
uality assurance managers.
What information does the analysis reportcontain?
9 report of 1ndings is usually provided to the investigator or person
who submitted the evidence for examination. !he examination
report may provide the following detailsG
• !he nature of the reuest
• !he results that were obtained
• 3denti1cation of the formattype of audiovideo
• !he type of processing that was performed
• %ates and time stamps that were visible
• %escription of the sub/ects, if visible
• %escription of the 1nal product provided e.g., enhanced video
prints or video recording#
• imitations in the examination
re there any common misconceptions oranything else about this topic that wouldbe important to the non!scientist?
?ot all audio or video evidence can be enhanced to provide clear
details. ;hile enhancements of recorded audiovideo evidence canbe made, those depicted on television crime dramas are often
unrealistic. !he amount of resolution reuired for the extreme
magni1cation used in these shows usually is not recorded with cell
phone or CC!" recordings.
Back to top of page ▲
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 16/18
A Simplified Guide To
Forensic Audio and Video Analysis
$oon "ers !he following terms are commonly used in the area of forensic audio
and video analysis. !hese de1nitions are provided by the *cienti1c
;orking Lroup on %igital 6vidence *;L%6# and the *cienti1c
;orking Lroup on 3maging !echnology *;L3!#. 9 full
co"prehensive glossary is also available online.
Archive Copy - 9 copy of data placed on media suitable for long-
term storage, from which subseuent working copies can be
produced.
Artifact - 9 visualaural aberration in an image, video or audio
recording resulting from a technical or operational limitation.
6xamples include speckles in a scanned picture or MblockingN in
images compressed using the >6L standard.
Capture - !he process of recording data, such as an image, video
seuence or audio stream.
Co"pression - !he process of reducing the si0e of a data 1le. *eealso, Mossy CompressionN and Mossless CompressionN.#
#e;interlacing - *eparating an interlaced frame into two discrete
1elds.
Field - 9n element of a video signal containing alternate hori0ontal
lines. For interlaced video, the scanning pattern is divided into two
sets of spaced lines odd and even# that are displayed seuentially.
6ach set of lines is called a 1eld, and the interlaced set of the two
sets of lines is a frame.
Fra"e - ines of spatial information of a video signal. For interlacedvideo, a frame consists of two 1elds, one of odd lines and one of
even lines, displayed in seuence. For progressive scan non-
interlaced# video, the frame is written through successive lines that
start at the top left of the picture and 1nish at the bottom right.
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 17/18
I"age Analysis - 9 sub-discipline of %igital P Hultimedia 6vidence,
which involves the application of image science and domain
expertise to examine and interpret the content of an image andor
the image itself in legal matters.
I"age Co"parison - !he process of comparing images ofuestioned ob/ects or persons to known ob/ects or persons or
images thereof, and making an assessment of the correspondence
between features in these images for rendering an opinion regarding
identi1cation or elimination.
I"age Content Analysis - !he drawing of conclusions about an
image. !argets for content analysis include, but are not limited toG
the sub/ectsob/ects within an image: the conditions under which, or
the process by which, the image was captured or created: the
physical aspects of the scene e.g., lighting or composition#: andorthe provenance of the image.
Interlaced scan - 9 techniue of combining two television 1elds in
order to produce a full frame. !he two 1elds are composed of only
odd and only even lines, which are displayed one after the other but
with the physical position of all the lines interleaving each other,
hence interlaceQ.
Interpolation - 9 method of image processing whereby one pixel,
block, or frame is displayed or stored based on the di5erences
between the previous and subseuent pixel, block or frame of
information. R!aken from the 6ncyclopedia of >hotography Qrd
6ditionS !his is often done to increase the apparent clarity of an
image.
&ultiple%er7#e"ultiple%er - 9 device used to combine multiple
video signals into a single signal or separate a combined signal.
!hese devices are freuently used in security and law enforcement
applications for recording andor displaying multiple camera images
simultaneously or in succession.
No"inal resolution - !he numerical value of pixels per inch as
opposed to the achievable resolution of the imaging device. 3n the
case of Batbed scanners, it is based on the resolution setting in the
software controlling the scanner. 3n the case of digital cameras, this
refers to the number of pixels of the camera sensor divided by the
corresponding vertical and hori0ontal dimension of the area
photographed.
8/19/2019 ForeNsic Video and Audio Analysis
http://slidepdf.com/reader/full/forensic-video-and-audio-analysis 18/18
Sharpening - 9 process used to emphasi0e edge detail in an image
by enhancing the high freuency components.
Ti"e lapse video recording - >rocess by which images are
recorded at less than the standard rate of frames per second ?!*C8
'D.DT: >98'+.((# thus extending the period of time that can becovered by the storage medium.
9ideo stabilization - !he process of positioning individual frames
so that a selected ob/ect or person will remain in the same location
as the video is played.
+ork copy - 9 copy or duplicate of a recording or data that can be
used for subseuent processing andor analysis.Q %am/anovski, ". !!TV "etorking and Digital Technology , &utterworth-@einemannG
;altham, H9, '(((.
akia, 2. %. The Focal ncyclopedia o# $hotography , Qrd 6d., Focal >ress:&utterworth-@einemannG ;altham, H9, )DDQ.
Back to top of page ▲
Back to top of page ▲