Date: 12-05-202
In
the Matter of: XYZ Vs Maharashtra
Subject:
Case Enquiry/ DD/ FIR no.:
11
Officer name and details handing over the
evidence: Mr. ABC (ACP, Churchgate Police Station) Summary of the case:
It was a case of video verification of the
CCTV footage which was from the GMC Boys Hostel, Churchgate, Mumbai dated 17th
April 2016 when the case was investigated. During the night time, there few of
the boys who broke the lock of one of the rooms and stole a laptop from the
hostelite staying in that room who had gone for the vacation to his hometown.
In spite knowing that the area was under CCTV surveillance, they even tampered
footage which got captured during that time. When that victim came back and
noticed, he informed to the warden, but the warden after checking the footage
as had no knowledge that the footage might even get tampered, he denied the
complaint of the victim. the warden was giving justification to the victim
that, the area is under surveillance and know one is allowed to enter in to the
control room; but had no idea that those suspected boys had given bribe to the
watchman and took the keys of the control room to tamper the footage. The boy
then just requested the warden to give him the footage of that three nights as
he wasn’t there for three nights, took a signature from him on a letter that
the warden has no issue for handing over the footage to that victim.
Later, the victim registered a FIR
in the nearest police station, where Mr. ABC (ACP,
Churchgate Police Station)
requested me to investigate the footage in this purpose. Therefore, on Monday 9th May 2022, I have
received a Video File named “Sample
1.mp4” from Mr. ABC through a
Google drive link via Email to check the authenticity of the video file which
consisted of CCTV footage. With the standard practices and use of software’s,
the video file was thoroughly examined to check is the received video file had
any manipulations such as addition, deletion or alteration so as to provide the
complainant with thorough forensic report of Video verification.
Detailed
report of the Video file examined:
Receiving mode : Google Drive
link via Email
File name : Sample 1.mp4
Video file duration : 00:01:38 hours
Modified date : 17th April 2016 at
21:15:16 PM
Size of the file : 21.4 MB
(2,25,30,910 bytes)
Size on Disk : 21.4 MB
(2,25,36,192 bytes)
Workstation
Specification: DELL Precision, Windows 10 (x64),
Intel CORE i3.
Software’s
used for Examination : Video Pad, HashCalc
One can examine various characteristics of the
video recording using an video analyser to determine whether the evidence is
altered or not. In this its required to check the integrity of the recording
and also to determine whether requested file of examination is has tempered or
genuine content. As per the steps of analysing any video file, the requested
file was critically viewed many times to check its continuity to examine
whether there is any sign of alteration in the file. To confirm the continuity
the file was analysed using video analysers.
In following steps the authenticity of
the received file was examined.
➢ Physical Handling & Inspection: I checked for the properties of
the received video recording with its different general characters. Properties
of the file:
|
Sr.
No.
|
Name of
the File
|
Hash Value
(MD5)
|
|
1.
|
Sample
1.mp4
|
ec250f1e2f4691a86fcf02d7a8609436
|
|
General
|
|
|
File name
|
Sample
1.mp4
|
|
Format
|
MP4 file
|
|
Duration
|
00:01:38
hours
|
|
Overall
Bit Rate
|
1834 kb/s
|
|
Audio
|
|
|
Overall
Bit Rate
|
189 kb/s
|
|
Channel(s)
|
2
Channel
|
|
Sample
rate
|
48.0 kHz
|
Screenshot
of video file “Sample 1.mp4” with total recording length 00:01:38 hours.
➢ To examine the Continuity in frame coordinates of the video
recording:
Examination of the
signals and frame coordinates and time lag of the video recording confirms the
integrity of the video clip. During this examination it was found that there is
alteration and tempering in the video file which indicates that there is change
in the frame rate or length of the recording. Screenshot of the video file
showing frame is as follows:
Gap found between the
frame of the video file “Sample 2.MTS” at “17 s”
➢ To examine enhancement of the recording:
There was no consistency
in the contrast, brightness or variation in colour during the entire section of
the recording as it is a CCTV footage so there was change in different CCTV
coverages. Sign of alteration or traces like irregular variations in the frames
rates was observed through entire recording section of the video file marking
the file as tempered video recording.
The first tempering was
observed at 00:00:17 hours as shown
in the screenshot above. Change of CCTV coverage was found at “00:00:45 hours” where suddenly the
time and date is observed of the footage i.e. date as 15/04/2016 and time at 01:57:23 am & again at 00:01:26 hours the CCTV coverage
recording was changed to another camera footage.
Screenshot
of the Change in CCTV Coverage of video recording “Sample 1.mp4"
Screenshot
of the Change in CCTV Coverage of video recording “Sample 1.mp4” ➢ To
examine the audio of the file: No audio for examination.
Nature of the examination and test
conducted:
Video Verification is a
scientific examination, comparison and/or evaluation of video files in legal
matters. For this there are types of video forensic scientists like technicians
(who carry out preliminary examination such as calculation of metadata, hash
value), Analyst (who analyse video with the help of software), Expert ( who
deals with presenting Report for court proceedings).
Several video recorders
are used for evidences like CCTV DVR (Closed circuit television digital video
recorder), CCTV NVR (Closed circuit television network video recorder), MDVR
(Mobile Digital Video Recorder), Body Camera, Concealed Camera, Mobile Phone,
Police Dash-cam.
Digital video evidence
is most commonly created by passive & active recording systems. A passive
recording system is a recording system that doesn’t store information in its
memory system whereas active recording system stores information in its memory
system. Active recording systems are most commonly produced with a digital
storage medium such as HDD, SSD, or volatile (Flash) memory. Video recorders
create digital video recordings in the following types of formats:
• Open Source Format
• Proprietary Format
• Courtroom Ready Format
Acquisition of Video
evidence has to be according to the protocols created by community SWGDE. It is
conducted in different steps as follows:
• Establish the Chain of Custody
• Request for the original
The authenticity of the
video file is questionable in the court like various other types of evidence.
In order to provide the video recording as evidence, its authenticity must be
confirmed by the expert so that the court can be convinced to accept the
evidence.
To check the
authenticity of the file, the lab investigation of the video file includes
numerous things:
• Forensic Image Comparison Investigation: This is the process of
comparing digital images, or digital images extracted from the video recordings
to determine the probability that the people or objects depicted in these
images are same or different.
• Video Clarification/Enhancement: In this we enhance the
scaling/pixel interpolation, Sharpening, Warp Stabilization, shadow &
Highlight adjustments (Exposure), Speed reduction, Pixel aspect ratio
calibration, colour correction, etc.
• Video Analysis/Authentication: The analysis of recording is
performed by keeping all the methodology & steps into consideration. The
analysis of the video recording is done in various steps which are as
follows:
o Viewing the recording – to familiarize with the video o Enhancement – Sharpening, video stabilization,
masking, interlacing o Video inspection – (if the video quality is good) to check coding,
video content analyser, AviSynth, AvsPinod
o Audio inspection – by extracting audio from the video for audio
verification
Audio Verification is a
scientific interpretation of audio recordings which are obtained from a civil
investigation or criminal legal proceedings. It is prevalent in the
investigation of crimes such as: Terrorism, Extortion, Intimidation, etc.
There are several types
of digital evidences received in the case of audio verification such as Mobile
Phones, External Storage Media (USB drive, Hard drive, Memory Card), Optical
Media (CD, DVD), Laptops, etc.
For examination of the
authenticity of the audio-video recording, it can be done through Hash value by
utilising the metadata of the file, where several tools can be used for the
authentication of hash value like Checksum, HashCalc, Digestit and tools like
Exinfinto and metadata 2go for authentication of metadata information. For the
Hash value, when we add or delete something from file, Hash value changes
otherwise it remains the same if the file data is not altered in any
manner.
To analysis any
audio-video file an expert needs to go through some steps. He/she need to do
critical listening/viewing the recording at first step to get familiarised with
the audio & video. Then carry out the enhancement of the file by checking
for the frequency equalisation and then go for electronic inspection and visual
inspection in which one is expected to visualise the pattern of the continuous
waveforms. Once the analysis of hash value, metadata, critical listening,
viewing recording, enhancement, etc. is done it is evident enough to evaluate
whether the analysed audio-video file is manipulated or not. And in this
manner, audio-video verification helps us to check the authenticity, enhance
the speech of the file, etc. and give the report on the requested examination.
Opinion:
After thorough
examination of the file named Sample
1.mp4, the recording presented that the video frames had presence of gap at
17s and change in CCTV footages and
during analysis, there was a sign of tempering found in the video file. The
video file presented to be had manipulations in it.
Therefore, on the basis
of my examination of the received video file, I had formed an opinion that the
video file was not a genuine one. This prepared report was then submitted to
Mr. ABC for further investigation to prove the guilty person and give justice
to the victim.
Written and Examine BY:
Ms. Sanchita Aher,
AFRS volunteer,
Institute of Forensic Science, Mumbai.