Forensic Technologies

by Steve Cain

From OACDL Vindicator 1995

Applied Forensic Technologies, a member of the National Association of Criminal Defense Lawyers, developed Task Descriptions as an educational tool for attorneys in specific areas of forensic evidence analysis:

1) Voice Identification- Comparison of an unknown voice against one or more known suspect voices for identification elimination purposes. The majority of state and federal appellate courts have upheld the scientific reliability and validity of voice comparison opinions.
2) The use of analog and digital filters to improve the intelligibility of various voices appearing on a degraded tape recording (audio or video.)
3) Tape Authentication- The examination of suspect audio and video tapes whenever questions arise concerning alleged editing/tapering of recorded material. The typical signs of alteration include unannounced stop/starts; over-recording (erasure of previously recorded material); pauses; and other suspicious record events.

Task Description:
Video Image Processing
Today many activities are recorded by video cameras. Many times criminal acts are recorded both intentionally and unintentionally. The quality of the video images at times may require some form of image processing to reveal information which may be helpful. Image processing of videotape can be helpful by improving visual images or by verifying that the videotape is authentic.

Theory
Image processing performed to improve the visual qualities of an image by forensic examiners is not image manipulation. The two forms of processing performed by forensic examiners are enhancement and restoration. When enhancement is used, the image is improved visually by traditional photographic techniques. An example of image restoration would be removing the motion blur of an object to produce a sharp image of the object.

Real World Factors
Video images are considered low resolution The fact that an image is low resolution means that only a limited amount of information can ever be obtained from it. The better the equipment used, the better the chances that an image can be processed. Poor images with signal to noise ratios of 30db or better have a good chance of being processed in a positive way.

If a video image is of good visual quality, further processing will only prove to degrade the image. Zooming in on specific areas of a video will not provide additional information in most cases. If a video image is of such poor quality that it is seriously over or under exposed or seriously out of focus, little can be done. Image processing is a tool which can improve quality but it cannot provide information which has not been recorded.

Factors to Consider
To perform image processing on a video image, the original tape must be obtained. Without the original, it is improbable that an image can be improved. Also the original video must be used if an examination for authenticity is to be made.

Many financial institutions have equipped their facilities with real-time or time-lapse video security systems to record crimes such as robbery or ready teller fraud. Accurate identification of persons or objects captured on tape may be compromised, however, by poor picture resolution, poor focus, glare, poor illumination, or by motion of the camera or subject. Digital processing of video tapes can in many cases, enhance or restore such degraded images.

Video images (single-frame or full-motion) can be digitally enhanced with no risk of damage to the original recording. Image processing employs sophisticated computer hardware, high resolution monitors, and specialized printers. Originally degraded video signals are captured and converted to digital formats for storage for subsequent high- speed computations that correct exposure and contrast errors, sharpen or smooth the edges of objects to make them more legible, zoom in or out to reveal detail, filter to emphasize or de-emphasize motion, and selective highlighting of portions of images. Enhanced images can be stored or printed for use in criminal or civil investigations and court presentation.

Image restoration, on the other hand, attempts to recover information lost at the time the recording was made, for example, because of focusing errors or relative motion between the camera and subject. Motion is particularly troublesome in security applications because some video cameras used for security work use combinations of shutter speeds and apertures far less adequate than in broadcast applications. Consequently, restoration of images degraded by motion requires mathematical routines capable of estimating the velocity and acceleration of the subject and compensating for such motion at the level of individual pixels or picture elements.

Success in image enhancement and restoration depends in part upon the technical quality of the original recording, and in part upon the systems available for recovering images. The video imaging analyst can quickly determine whether a video recording can be improved for use as evidence.

Task Description:

Videotape Editing/Tampering Examination Foundation Requirements Videotape evidence must be material, relevant and competent to be admissible. In addition, videotape evidence is demonstrative evidence or evidence that can convey a relevant first-hand sense impression to the viewer. This evidence also must be authenticated or verified and shown to be a genuine, fair and accurate portrayal of what it is purported to reveal. Videotapes are defined as a form of photographic evidence under Rule 1001 (2) of the Federal Rules of Evidence.

Generally the prevailing trend in case law today is clearly in favor of admissibility. The four key elements governing the admissibility of videotapes include:

1. relevance;
2. fairness and accuracy;
3. the exercise of judicial discretion with
respect to probative value; and
4. issues of competency such as hearsay
objections or violations of other exclusionary rules.

Technical Aspects of Videotape
The basic recording process of video information proceeds initially from the capture of light and sound waves to the generation of electrical impulses and later to magnetically stored electrical impulses on the videotape and then, following the playback sequence, converts the signals from the magnetic tape into electrical signals that are capable of producing video and audio output. Most videotape involves a plastic tape coated material with magnetic particles such as iron oxide and other reproduction characteristics. At least four separate types of electrical impulses are stored on the videotape: 1) the luminance signal which deals with the overall brightness of the visual image; 2) the chrominance signal which contains the relative color values of the visual image; 3) the synchronization signal which synchronizes the timing and information from other signals; and 4) the audio signal. Present day videotape and camcorder formats include the VHS and S-VHS (in both Standard and 'C' cassette styles); 8 mm; Hi 8, and various Beta formats

Methods of Alteration
Many camcorders also allow for recording of specific time and date information. Conventional post-production or out of camera videotape editing consists of imposing order of a sequence of scenes previously recorded. This is done by re-recording or "dubbing" sequences from the original videotape onto another videotape known as the "edit master." Traditional editing of videotape through cutting or splicing is rarely done as the effects are readily discernible by the viewer. Distortions resulting from varying playback speeds are very difficult to achieve with either conventional or digital video editing. The videotape may cause a "rolling" or smearing effect on the video portion unless it is played back at exactly 30 frames per second.

It should be noted that the editing or alteration of the audio competent of videotape evidence should be considered separately from the video component. The audio component may be re-recorded onto an edit master. Many videotape formats have at least two separate audio tracks which lend themselves to fairly easy manipulation during any tampering effort. Telltale signs of the editing process of the video signal may involve poor synchronization with the new narration scene to exist with the video component and ambient noise level. The audio signal in videotape is generally much less complex and contains much less information than the video signal and therefore is much easier to manipulate or fabricate. Using audio dubbing technology, it is possible to completely rearrange words, sounds and sentences spoken by an individual to produce audio segments with unintended, opposite and legally detrimental meanings.

Depending upon the skill involved in the editing process, videotape evidence can often be detected by a forensics expert as having been altered. Signs to look for include: significant changes of volume, content, or continuity with either the main speaker's words or background sounds; sudden, strange or unaccounted for sounds; and the audio component not fully synchronized with the relevant video component. The expert should have ready access to appropriate laboratory equipment such as microscopes, special cameras, cross-pulse monitors, waveform monitors, oscilloscopes, and other pertinent laboratory equipment.

Traditionally, the alteration or editing process involved a rearrangement of the analog information contained in the video image although it was practically impossible to move, change or tamper with the actual picture elements or pixels that constitute the video image.

Nowadays, however, digital editing or fabrication of videotape evidence has been made possible by enormous advances in computer video speed, computer memory capacity, computer software and associated advances in the field of electronic imaging and laser scanners.

With respect to audio equipment because of advances in digital audio sampling and editing, it can be readily utilized in conventional dubbing and re-recording techniques.

Fabrication of the video component is normally much more difficult. Depending on the format of the videotape used, and the type of time code information that it may have been recorded, time code can either be erased by re-recording over it on the original tape or the original time code can simply be replaced during the dubbing process with a subsequent time code. Once again as digital editing becomes more widespread, time codes of all types will become more vulnerable to tampering since like all information on a videotape they can be reduced to easily manipulate binary code. It should be noted that even if there is an interruption of the date/time record or time code on a video segment, this is no guarantee that tampering has occurred. Secondly, it is almost always possible to edit a tape and then add a different time code or date/time record as the tampered with videotape is being dubbed onto another tape. The audio and video components of videotape should be considered separately during any necessary review. With respect to the video component, "smears, glitches," rolling lines, "unexplained distortions," and any other type of picture "break up" may indicate tampering. Sudden jumps in action or cuts from one scene to another should also be noted. With respect to the sound component, sudden changes in noise levels, strange or inexplicable sounds, or important statements made while a person's back is turned may also prove significant. Additionally, the synchronized audio and video components of videotape motion provides an indication of reliability/reference point. If there are discrepancies in the synchronization between the picture and the sound as when a person's words do not match their lip movements, this may also indicate a possible edit.

Additional Issues/Methods of Analysis
In all disputed videotape examinations it should be ascertained whether the recording was purportedly made with the equipment specified and if the recorder is available, appropriate tests of that recorder can be made to see if any individual "footprint" can be matched with the accompanying videotape. Next, one should determine if the recording is continuous and is it an accurate representation of the event depicted. The original tape should always be examined for anomalies.

Some of the more obvious indications of possible videotape editing include evidence of the submitted tape being exposed to a processing amplifier with results in improved synchronization patterns. One can also examine such things as head video switching differences or re-recorded time base errors. Other types of visual/electronic footprints would include non-synchronous edits, azimuth insert edits which may require magnetic development, defective pixel/yoke ringing; color filter/color registration errors, and other significant picture aberrations. The focus of the analysis is technically directed at the frequencies of the video and audio signal, as well as an intensive computerized review of the frames as they shift from an operator "stop" and "re-start." Components of the color signal are checked for consistence as well as observing the continuity of the entire event.