FORENSIC AUDIO

AND VIDEO
ANALYSIS

PREPARED BY:
RAYMOND ROLIN D. HILADO MSCJE 1
Rationale:
 The increased use of digital video systems by the general public has made
digital multimedia evidence (DME) a significant and integral part of modern
criminal and civil investigations. Since there is no standard video recording
system in use, the need for trained individuals who know how to properly
recover this type of evidence has increased. Properly acquiring DME is crucial,
as all other processes or use of the video is impacted by accuracy of the
recovery. Unlike other forms of forensic evidence, audio and video recordings
can provide a real-time, eyewitness account a crime so investigators can
watch or hear what transpired. For instance, a surveillance video captures a
bank robbery in progress, or a hidden camera records an undercover sting
operation. Audio and video evidence can be found at more locations and from
more diverse sources than ever before. From convenience stores to fast food
restaurants, malls to banks, traffic intersections to parks, CCTV systems are
virtually everywhere. And cell phone cameras extend a watchful eye to nearly
every corner of every town. Audio evidence may be available from 911 calls,
telephone answering machines, voicemail recordings, video cameras, cell
phones and computer files.
 Related literatures:
 English v. State of Georgia, 422
S.E.2d 924 (September 28, 1992, Court
of Appeals of Georgia)
 United States v. Mosley, 1994 U.S.

App. LEXIS 23969 (August 31, 1994,

United States Court of Appeals for the
Ninth Circuit)
 Introduction:
Forensic video analysis is the scientific examination, comparison and/or
evaluation of video in legal matters. Unlike other forms of forensic evidence,
audio and video recordings can provide a real-time, eyewitness account of a
crime, so investigators can watch or hear what transpired. For instance, a
surveillance video captures a bank robbery in progress, or a hidden camera
records an undercover sting operation.
Over the past decade, sources of recorded audio and video that can assist
in an investigation have increased exponentially. Closed circuit television
systems (CCTV) and video and audio recorders can be found in businesses, at
traffic intersections, parking lots, bank machines, on police-vehicle dashboards
and of course, in cell phones.
For large-scale events or crimes, the sheer amount of recorded audio and
video evidence can be massive and helpful. For most crimes, however, high-
quality audio and/or video recordings are often not available. This is where
forensic audio and video expertise can help. Forensic experts have many
techniques to enhance recordings that can bring out details and provide a
clearer picture of what occurred, or make an audio recording more audible. This
in turn helps investigators, lawyers and jurors better conduct their duties.
Definition of terms:
 Archive Copy  Interlaced scan
 Artifact  Interpolation
 Capture  Multiplexer/Demultiplexer
 Compression  Nominal resolution
 De-interlacing  Sharpening
 Field  Time lapse video
 Frame  Pixel
 Image Analysis  Video stabilization
 Image Comparison  Write protection
 Image Content Analysis  Work copy
Forensic Audio
&
Video Analysis
 Principles of Forensic
Audio and Video
Analysis:
Repair and Recovery
of Evidence
Evidence

Enhancement
 GENERAL TASKS of
FORENSIC AUDIO &
VIDEO ANALYSIS
Technical preparation
Examination

Interpretation
 Technical Preparation
Tasks may include the following;
 instrument calibration

 visual inspections

 media characterization

 write protection

 organization of files

 playback optimization
 Examination
Examination may include the following;
 demultiplexing  and standards
 decoding digital video conversion
and/or images  Image and video
 duplication enhancement
 capture  frame averaging
 reconstruction  video stabilization
 format conversion
 timeline sequence
reconstruction
Interpretation
 BEST PRACTICES
 Evidence Management
 Quality Control and Quality

How is quality control and

quality assurance performed?
 Security
 Infrastructure
 Work Management
 Documentation
 Who Conducts the Analysis?
TRAINING, COMPETENCY,
AND PROFICIENCY
The analyst should demonstrate:
 An understanding of the scope of work and how it will be applied in the forensic

environment;
 subject matter knowledge and competence;

 working knowledge of image and/or video processing and evaluation techniques;

 working knowledge of applications and tools utilized in the specific agency;

 working knowledge of SWGIT guidelines for capturing, storing, and processing

image/video, including issues relating to topics such as data integrity and

compression artifacts;
 understanding of legal precedent for the use of specific image and/or video

processing techniques;
 knowledge of appropriate case work documentation.
 ANALYSIS,
INTERPRETATION AND
 IDENTIFICATION
Authentication of recordings
 Identifying people or objects on a
recording
 To Corroborate Statements
 To Identify Suspects

Why and when is audio-video evidence

used?
 How the Evidence Is
Collected?
 Digital
video and audio
 Analog video and audio
How the Analysis
Is Performed?
 FORENSIC VIDEO ANALYSIS
WORK FLOW
 Chain of Custody
 Submission Review
What information does the
analysis report contain?
 The nature of the request  Description of the subjects, if
 The results that were obtained visible
 Identification of the format/type of  Description of the final product
audio/video provided (e.g., enhanced video
 The type of processing that was prints or video recording)
performed  Limitations in the examination
 Dates and time stamps that were
visible
 Physical Inspection
 Physical damage to media or housing
 Contaminants (dirt, grease)
 Media characteristics (manufacturer, size, format)
 Device settings (hard drive jumper settings, device switch positions)
 Write protect status
 Existing labels or identifiers

 Evidence Marking
 Never use a ballpoint pen, pencil or other sharp writing
instrument when marking CDs and DVDs
 Do not use markers that contain solvents
 Do not use adhesive labels
 Virus Scan
 Equipment Selection and Playback Optimization
 For tape based media
 For file based digital video recordings
 For Digital CCTV (DCCTV)
 Generation Determination
 Media Review
 Creation of a Work Copy and Verification
When identifying the area of interest for analysis, the following should be
considered:
 There may be relevant information outside the area of interest requested by the

submitter
 Details about the incident not directly related to the subject may be present.

These include;
 Images which could verify the time and/or place of the incident such as; clocks,

signs, scoreboards.
 Potential witnesses or bystanders.
 Processing, Enhancement,
and Examination
 Brightness/Contrast
 Color Correction
 Cropping/Resizing
 Deinterlacing
 Demonstrative Comparison
 Demultiplexing
 Hardware based
 Software based
 Interlacing
 Masking

 Noise Reduction

 Sharpening/Deblurring

 Speed Adjustment
Speed adjustment of forensic video is typically performed for
the following reasons:
 To convert the playback speed of time lapsed video

recordings to a real-time rate.

 To slow the playback speed of video to a less-than-real-time

rate (“slow motion”).

 Timeline Sequencing
 Video Stabilization
 Output
Several factors can reduce output quality;
 High compression rates
 Long record times

 Poor quality equipment and media

 Incorrect settings

 Verification
 Audio Enhancement
Techniques
 FrequencyEqualization
 Compression
What kind of results should be
expected from enhancement or
analysis of video and audio
evidence?

What are the limitations of the

analysis?
 Conclusion:
That video analytics can be immensely
useful in forensics is relatively less known.
However, forensic search capabilities offered
by some modern video analytics solutions can
not only save investigators significant amounts
of time but also help them find results more
accurately. These solutions leverage facial
recognition and advanced object tracking,
demographic analytics, license plate
recognition capabilities and other such
powerful features to take forensic investigation
to a whole new level. 
 Recommendation:
There is a perception, largely undeserved, that digital evidence somehow
alters the true nature of the original evidence and is therefore unreliable. If
Digital Evidence is presented properly, digital evidence is capable of being of
tremendous assistance to the courts. Even though it has been around for a
while, we are still at the forefront in developing and presenting this
potentially valuable evidence.
There must be a Specialized UNIT for FORENSIC VIDEO ANALYSIS for
every police department. And within the unit there should be two sub-
branches. The first branch will be assigned in collecting and procurement of
all the digital evidences found that will be used as evidence, the second
branch is to reduce the workload of the first branch. They will be assigned as
the analyzing and interpreting branch, to enhance evidence and defend it in
court.
There must be also rigid training and specialization and the field of
Forensic Video analysis, so that Digital evidence will be enhanced properly
and be admissible to court as evidence.
Resources:
 Law Enforcement & Emergency Services Video Association (LEVA)
 International Association for Identification (IAI)
 Scientific Working Group on Imaging Technology (SWGIT)
 Scientific Working Group on Digital Evidence (SWGDE)
 American Society of Crime Laboratory Directors Laboratory Accreditation Board (ASCLD/LAB)
 National Technical Investigators Association (NATIA)
References:
 Best Practices for the Acquisition of Digital Multimedia Evidence, Version 3.0 (April 14, 2010), LEVA.
 Cohen N, MacLennan-Brown K. “Retrieval of Video Evidence and Production of Working Copies from Digital CCTV Systems
v2.0,”, Home Office Scientific Development Branch, (accessed 8/25/12).
 “Cracking Watergate’s Infamous 18 ½-Minute Gap”, Philip T. Mellinger, 2/18/11, Forensic Magazine, (accessed 7/19/12).
 Crime Laboratory Evidence Submission Manual, Florida Department of Law Enforcement, Gerald M. Bailey, Commissioner, 2009
 Guidelines for the Best Practice in the Forensic Analysis of Video Evidence, LEVA.
 Housemate tips police to Smith after seeing video (CNN report) (accessed 6/1/2012).
 LEVA Forensic Video Analysis Certification Program, (accessed 4/2/2012).
 “Section 7: Best Practices for Forensic Video Analysis,” SWGIT guidelines document, (accessed 2/3/2012).
 Technical Support Working Group (TSWG). “Best Practices for the Retrieval of Digital CCTV Systems,” Home Office Scientific
Development Branch, (accessed 8/25/12).
 Acknowledgments
 The authors wish to thank the following for their invaluable contributions to this forensic guide:
 Shawn Yao, Senior crime laboratory analyst, Florida Department of Law Enforcement (FDLE)
 David Hallimore, Sergeant, Forensic Audio/Video Unit, Houston Police Department
 https://www.swgit.org/pdf/Section%207%20Best%20Practices%20for%20Forensic%20Video%20Analysis?docID=51