Concepts Flashcards
Workflow for image analysis
Nondestructive - maintains integrity
Precise - filters used in a logical order to achieve best results
Reproducible - ensure each step can be repeated
Verifiable - must PROVE someone can obtain the same results
Name some techniques to clarify digital images
Aspect ratio corrections
Level adjustments
Frame averaging (layer stacking)
Frame averaging on moving target
Pattern removal
Difference
Interpolation selections and their applications
Nearest neighbor - no new visual info created; maintains edge patterns and original pixels and uses same pixel values as neighboring pixels to create redundant pixels
Bilinear - average values of four surrounding pixels are used to estimate new pixel values
Bicubic - smoothest interpolation, good for when details aren’t important
Steps in DME analysis
Preservation - process of insuring evidence is not lost or altered
Extraction - process of recovering data from native environment so it can be further processed if necessary
Analysis - process of performing clarification techniques/drawing conclusions from clarified images
Seven methods of extraction
- Using built-in functionality of DVr to export native file format
- Using built-in functionality of DVR to export a universal file format
- Using a multimedia capture utility to transcode video to a usable format (omnivore, amtas)
- Copy out logical files related to relevant video
- Creating binary images of hard drives holding digital video
- Seizing the DVR
- capturing digital video using an analog recorder
Steps to verify integrity
- Ensure evidence cannot be tampered with
- Maintain a chain of custody
- Hashing/digital signatures to insure evidence is unaltered
- Verify and Calibrate aspect ratio
- Visually compare extraction against original (check for compression, artifacts, dropped frames, etc)
- Remain on scene until you can verify you have the correct data
Scientific method
Observe and describe
Form hypothesis
Predict results
Experiment and test hypothesis
Form conclusion/validate
13 requirements for recovery reports
- How did you become involved? Who requested/contact info of agency/how you were contacted/when
- What is being requested? Need a specifics related to content/date/time/vehicle/person/event; also what you are supposed to do with it
- Legal authority? Who provided consent/search warrants/etc
- Where DVR/NVR is located? Location/address/how many recorders/cameras/diagram of cameras
- Contact info at recovery location? Who is giving you consent
- Specifics about recording device - make/model/serial number
- Time/date calibration
- Extraction method used - USB/network/CD/screen capture/DVR examiner
- What was recovered? Date/time extractions, which cameras were exported, which are most relevant
- Any further clarification processes done?
- Was derivative evidence created? Stills/clips/etc
- Steps taken for integrity verification?
- Disposition of recovered video/recovered evidence? What you did with recovered video/derivative evidence
JPEG compression algorithm
- Color transform from RGB to YCbCr
- Subsample CbCr
- Discrete Cosine Transform
- Quantization
- Encoding
- Entropy encoding (RLE and Huffman)
Blocking artifacts
Blocking - a result of macro locks used during video compression
Mosaic - blocks which contain only low frequency info mayb show blocks caused by encoding blocks independent of each other
Staircasing - blocks which usually appear around diagonal lining in video
False edges - appear near true edge and caused by motion prediction during intraframe compression
Ringing - error caused by quantization of high frequency areas so DCT reconstruction isn’t accurate
Authentification of clarified evidence
All steps to clarify evidence must be documented/easily reproduced/based on generally accepted scientific principles
Must positively impact the evidences ability to answer the issue in question
Can be authenticated by knowing/explaining AR/compression/timing/frame rate issues; must demonstrate clarification does not prevent the evidence from answering the courts question
Must use sound scientific methodology
How to verify the integrity of DME
Maintain a chain of custody
Use tamper-evident packaging
Visually or aurally verify
Use mathematical base verification techniques
3 things necessary to play a video file
- Media player with compatible operating system
- Container file supported by media player
- Correct codec
Tools to read info from containers
Mediainfo
ExifTool
Ffprobe
Rewrapping
Changing file container
