Date: 12-05-202

In the Matter of: XYZ Vs Maharashtra

Subject:

Case Enquiry/ DD/ FIR no.: 11

Officer name and details handing over the evidence: Mr. ABC (ACP, Churchgate Police Station) Summary of the case:

It was a case of video verification of the CCTV footage which was from the GMC Boys Hostel, Churchgate, Mumbai dated 17^th April 2016 when the case was investigated. During the night time, there few of the boys who broke the lock of one of the rooms and stole a laptop from the hostelite staying in that room who had gone for the vacation to his hometown. In spite knowing that the area was under CCTV surveillance, they even tampered footage which got captured during that time. When that victim came back and noticed, he informed to the warden, but the warden after checking the footage as had no knowledge that the footage might even get tampered, he denied the complaint of the victim. the warden was giving justification to the victim that, the area is under surveillance and know one is allowed to enter in to the control room; but had no idea that those suspected boys had given bribe to the watchman and took the keys of the control room to tamper the footage. The boy then just requested the warden to give him the footage of that three nights as he wasn’t there for three nights, took a signature from him on a letter that the warden has no issue for handing over the footage to that victim.

Later, the victim registered a FIR in the nearest police station, where Mr. ABC (ACP,

Churchgate Police Station) requested me to investigate the footage in this purpose. Therefore, on Monday 9^th May 2022, I have received a Video File named “Sample 1.mp4” from Mr. ABC through a Google drive link via Email to check the authenticity of the video file which consisted of CCTV footage. With the standard practices and use of software’s, the video file was thoroughly examined to check is the received video file had any manipulations such as addition, deletion or alteration so as to provide the complainant with thorough forensic report of Video verification.

     Detailed report of the Video file examined: 

Receiving mode                               : Google Drive link via Email

File name                                         : Sample 1.mp4

Video file duration                          : 00:01:38 hours

Modified date                                  : 17^th April 2016 at 21:15:16 PM 

Size of the file                                 : 21.4 MB (2,25,30,910 bytes) 

Size on Disk                                    : 21.4 MB (2,25,36,192 bytes)

Workstation Specification: DELL Precision, Windows 10 (x64), Intel CORE i3.

Software’s used for Examination                      : Video Pad, HashCalc

 One can examine various characteristics of the video recording using an video analyser to determine whether the evidence is altered or not. In this its required to check the integrity of the recording and also to determine whether requested file of examination is has tempered or genuine content. As per the steps of analysing any video file, the requested file was critically viewed many times to check its continuity to examine whether there is any sign of alteration in the file. To confirm the continuity the file was analysed using video analysers.

In following steps the authenticity of the received file was examined.

➢ Physical Handling & Inspection: I checked for the properties of the received video recording with its different general characters. Properties of the file:

Screenshot of video file “Sample 1.mp4” with total recording length 00:01:38 hours.

➢ To examine the Continuity in frame coordinates of the video recording: 

Examination of the signals and frame coordinates and time lag of the video recording confirms the integrity of the video clip. During this examination it was found that there is alteration and tempering in the video file which indicates that there is change in the frame rate or length of the recording. Screenshot of the video file showing frame is as follows:    

Gap found between the frame of the video file “Sample 2.MTS” at “17 s”

➢ To examine enhancement of the recording:

There was no consistency in the contrast, brightness or variation in colour during the entire section of the recording as it is a CCTV footage so there was change in different CCTV coverages. Sign of alteration or traces like irregular variations in the frames rates was observed through entire recording section of the video file marking the file as tempered video recording. 

The first tempering was observed at 00:00:17 hours as shown in the screenshot above. Change of CCTV coverage was found at “00:00:45 hours” where suddenly the time and date is observed of the footage i.e. date as 15/04/2016 and time at 01:57:23 am & again at 00:01:26 hours the CCTV coverage recording was changed to another camera footage. 

Screenshot of the Change in CCTV Coverage of video recording “Sample 1.mp4"

Screenshot of the Change in CCTV Coverage of video recording “Sample 1.mp4” ➢ To examine the audio of the file: No audio for examination. 

Nature of the examination and test conducted:

Video Verification is a scientific examination, comparison and/or evaluation of video files in legal matters. For this there are types of video forensic scientists like technicians (who carry out preliminary examination such as calculation of metadata, hash value), Analyst (who analyse video with the help of software), Expert ( who deals with presenting Report for court proceedings).

Several video recorders are used for evidences like CCTV DVR (Closed circuit television digital video recorder), CCTV NVR (Closed circuit television network video recorder), MDVR (Mobile Digital Video Recorder), Body Camera, Concealed Camera, Mobile Phone, Police Dash-cam.

Digital video evidence is most commonly created by passive & active recording systems. A passive recording system is a recording system that doesn’t store information in its memory system whereas active recording system stores information in its memory system. Active recording systems are most commonly produced with a digital storage medium such as HDD, SSD, or volatile (Flash) memory. Video recorders create digital video recordings in the following types of formats:

•      Open Source Format

•      Proprietary Format

•      Courtroom Ready Format

Acquisition of Video evidence has to be according to the protocols created by community SWGDE. It is conducted in different steps as follows: 

•      Establish the Chain of Custody

•      Request for the original

The authenticity of the video file is questionable in the court like various other types of evidence. In order to provide the video recording as evidence, its authenticity must be confirmed by the expert so that the court can be convinced to accept the evidence. 

To check the authenticity of the file, the lab investigation of the video file includes numerous things:

•      Forensic Image Comparison Investigation: This is the process of comparing digital images, or digital images extracted from the video recordings to determine the probability that the people or objects depicted in these images are same or different. 

•      Video Clarification/Enhancement: In this we enhance the scaling/pixel interpolation, Sharpening, Warp Stabilization, shadow & Highlight adjustments (Exposure), Speed reduction, Pixel aspect ratio calibration, colour correction, etc.

•      Video Analysis/Authentication: The analysis of recording is performed by keeping all the methodology & steps into consideration. The analysis of the video recording is done in various steps which are as follows: 

o   Viewing the recording – to familiarize with the video o Enhancement – Sharpening, video stabilization, masking, interlacing o Video inspection – (if the video quality is good) to check coding, video content analyser, AviSynth, AvsPinod

o   Audio inspection – by extracting audio from the video for audio verification

Audio Verification is a scientific interpretation of audio recordings which are obtained from a civil investigation or criminal legal proceedings. It is prevalent in the investigation of crimes such as: Terrorism, Extortion, Intimidation, etc.

There are several types of digital evidences received in the case of audio verification such as Mobile Phones, External Storage Media (USB drive, Hard drive, Memory Card), Optical Media (CD, DVD), Laptops, etc. 

For examination of the authenticity of the audio-video recording, it can be done through Hash value by utilising the metadata of the file, where several tools can be used for the authentication of hash value like Checksum, HashCalc, Digestit and tools like Exinfinto and metadata 2go for authentication of metadata information. For the Hash value, when we add or delete something from file, Hash value changes otherwise it remains the same if the file data is not altered in any manner. 

To analysis any audio-video file an expert needs to go through some steps. He/she need to do critical listening/viewing the recording at first step to get familiarised with the audio & video. Then carry out the enhancement of the file by checking for the frequency equalisation and then go for electronic inspection and visual inspection in which one is expected to visualise the pattern of the continuous waveforms. Once the analysis of hash value, metadata, critical listening, viewing recording, enhancement, etc. is done it is evident enough to evaluate whether the analysed audio-video file is manipulated or not. And in this manner, audio-video verification helps us to check the authenticity, enhance the speech of the file, etc. and give the report on the requested examination.

         Opinion: 

After thorough examination of the file named Sample 1.mp4, the recording presented that the video frames had presence of gap at 17s and change in CCTV footages and during analysis, there was a sign of tempering found in the video file. The video file presented to be had manipulations in it. 

Therefore, on the basis of my examination of the received video file, I had formed an opinion that the video file was not a genuine one. This prepared report was then submitted to Mr. ABC for further investigation to prove the guilty person and give justice to the victim. 

Written and Examine BY: 

Ms. Sanchita Aher,

AFRS volunteer,

Institute of Forensic Science, Mumbai.