PROBLEM: Video content manipulation is extremely difficult to detect.

SOLUTION: Video Error Level Analysis (VELA)

VELA can definitively identify and document video cropping and the addition, removal, relocation or alteration of an object, weapon, person, vehicle or text. Since VELA software is virtually non-existent, I will share my free open-source software solution. First, let me explain how VELA works.

With rare exception, video compression is lossy and thus creates an imperfect copy of the original video data. Each time a video is resaved, additional video quality losses occur, even in the absence of any editing or alterations. Furthermore, since most video CoDecs compress utilizing data from adjacent frames, and within pixel blocks, video cropping will disproportionably affect perimeter pixels.

Modern CoDec compression causes quantization data errors, often seen as visual artifacts, as the data extremes are suppressed to reduce the overall video file size. Each subsequent compression reduces the variance extremes between adjacent, and blocks of, pixels by a lesser amount. After a nearly infinite number of compressions, the minimal error level will be reached and the video may appear as a homogeneous blur.

If an object is added to, or relocated in, an already compressed video, it will be at the earlier stages of this process. As such, when the altered video is compressed again, any recent viewable alterations will incur larger changes in quantization data errors than the remainder of the video content. This can be visually represented by subtracting a re-compressed video from the version that you began with. The resulting video will appear black with areas of brightness (luminosity) indicating the differences in error levels between both videos.

Boundaries of high contrast (e.g. a bright pixel adjacent to a dark pixel) will have higher VELA values and thus appear relatively brighter. Points of video alteration will be depicted as pixels which are brighter than their relative contrast would suggest. If a video has been cropped to reduce the field of view, the altered perimeter edges will appear abnormally bright. These are the suspected points of manipulation.

If the points of manipulation are colored differently than the underlying objects, this information can aid in fingerprinting the software that was used to alter the video. Additional clues can be deduced from analyzing the video’s visual consistency (reflections, clarity, shadows, etc…), metadata and chain of custody. Principal Component Analysis (PCA), Discrete Cosine Transform (DCT), and Wavelet analysis can further identify the exact points of manipulation. My prior writings address many of these complimentary topics.

Required tools to replicate our results:    (or use VideoCleaner for a simple and free VELA method)

1. Install VirtualDub, AVISynth and the XVID CoDec.
2. Run VirtualDub and open (under the FILE menu) the video named "BEFORE.avi".
    The altered object is a 4th logo moving from the upper left corner until it disappears in the lower right.
3. Under the VIDEO menu, set compression to XVID (use the "configure" button to set quantizer to 8)
4. Use the Save command (under the FILE menu) to save this video with the name "AFTER.avi".
5. Create a new text file named “TEST.avs” with the following text:
 BEFORE=directshowsource("BEFORE.avi")
 AFTER=directshowsource("AFTER.avi")
 Overlay(BEFORE,AFTER,mode="Subtract")
 Levels(0,5,100,0,255)
 stackhorizontal(BEFORE,last)
6. Right click to open "TEST.avs" with VirtualDub, and then save the resulting video as "RESULTS.avi”.

The files described above:

As the RESULTS video plays, the VELA value of the added (aka manipulated) fourth company logo will nearly always be larger, and thus appear brighter, than the original three logos. By comparison, detecting video tampering through a visual inspection would be nearly impossible, especially when the depicted objects are of varying size, color or brightness.

NOTE: The resulting VELA view of the original three moving logos will briefly become brighter as they overlap the altered logo. This is a side effect of the CoDec’s predictive frames algorithm, and this issue was intentionally encouraged to demonstrate the power of VELA, even under worse-case scenarios.

I invite you to try VELA on your own videos. If you rename your video to "BEFORE.avi", the above steps will work without any modifications. For a printer friendly version, download the VELA technical notes abstract. If you would like a more in depth VELA description, I would suggest the peer review version HERE.

If you would like a free hands-on training workshop, recommend me and this topic to the educational committee of any national group that you belong to. Upcoming training dates are listed in my CV.

The above work is the original creation and intellectual property of Doug Carner, president of Forensic Protection, Inc. with special thanks to Dr. Neal Krawetz at the 2007 Black Hat conference.

UPDATE June 5th, 2013, Dr. Neal Krawetz commented that {down sampled videos are a "resave" and can obscure the ability to detect modifications. For example, if a video uploaded to Youtube gets resaved at a very low quality it is unlikely to have detectable modifications under VELA.} 

UPDATE February 25th, 2017, As of 2016, VELA and DCT tests (along with additional authentication-tamper detection tools) are now built into VideoCleaner, a free open-source forensic enhancement and authentication application.  Thus eliminating the need for the user to write code or understand programming to detect and document video tampering or image tampering.