Recognizing Evidence Tampering in Criminal Cases
Criminal lawyers often receive evidence in the form of photographs, audio recordings, and video recordings.
In order to be admissible in court the image or recording must be authentic. Today, easy-access to software allows even the unskilled computer user to create a new reality in minutes.
Image-audio-video tampering is the addition, removal, or relocation of content in a previously authentic recording. Contrasting resolutions within an image, audio interruptions, and additional video components (e.g. picture-in-picture) can call the evidentiary authenticity into question. Science permits different methods to review whether evidence has been tampered with.
Photo Response Non Uniformity (PRNU)
PRNU is the unique noise profile imprinted by a recording device onto the produced file. The PRNU can be extracted from the recording and compared with the devices known PRNU. Unmatched profiles can indicate the evidence has been altered.
Electric Network Frequency (ENF)
By measuring the underlying frequencies from a recording, ENF allows the analyst to determine where and when a recording was created. This assists in finding if the recording was created where and when it was purported to be.
File Name Extensions
File name extensions are unique to the equipment manufacturer and if an image or recording has been altered the new file name extension may reveal bad faith.
Metadata
Metadata (e.g. GPS coordinates) can reveal facts about the recorder’s model number, user settings, physical location, and more. These values can then be compared by the attorney’s known case facts. A useful tool for criminal defense.
Light Test
Light travels in a straight line, until an object throws off it’s intended path. For an image the light test involves drawing a straight line that touches upon an object and it’s corresponding point on the shadow. This is repeated for each point on all objects casting a visible shadow from the light source. All the lines should intersect at the same point. If any line does not intersect at the light source, then the object touching this line may have been added.
Ear Test
With audio recordings, incomplete words, sudden audio background changes, vocal fluctuations, pauses, clicking sounds and repeated phrases may all indicate edit points and tampering.
Eye Test
Is the resolution of an image or recording consistent with the recording device? Video-dvd’s created via post recording leave open the possibility of altercation. Also, the appearance of title screens, picture-in-picture (PIP), zooming and speed changes on a video can be proof of the video has been altered.
Error Level Analysis (ELA) and Video Error Analysis (VELA)
This test recompresses image and video files to identify affected areas. Postproduction changes will be disproportionally affected greater. The results can also identify which editing software was used.
The testing methods above provide reliable tactics if authenticity of an image-audio-video is at issue. Even if the evidence has not been altered, information obtained can provide powerful tools for a trial lawyer to use in defending the case.