|
|||||
|
|||||
FAQ - Glossary of terms
Free evaluation...what's the catch? Glossary of terms Authentication - With regards to forensics, it is the ability to discern fact from fiction using verify-able and known facts. For example, camera imagers are made from Silicon which, like all organic materials, include impurities. The random pattern of those impurities embeds a unique identical watermark into every image captured by that same camera. The relative watermark pattern can substantively survive cropping, resizing and editing, and can be used to prove which images originated from one specific camera. Similarly, the imager's Bayer pattern and lens dimples can be used to determine a specific camera model, and noise pattern deviations can prove editing or dubbing. There are dozens of such established tests in active forensic use. Bandwidth - Modern DVRs use a single local network shared by all connected cameras. Each camera is a assigned fixed values for resolution, quality and frame rate. Increasing any of these values will increase the network bandwidth required by that camera, which could result in data collisions that distort all camera images, so settings tend to be conservatively defined. The typical configuration is to use megapixel (high) resolution, 5 to 10 frames per second (medium) frame rate, and low to medium quality. The interactions between these values influence the potential improvements from video clarification. Calibration - The process of using an uncontested portion of the target recording to determine the optimal clarification and enhancement settings for the entire recording. Clarification - A generally accepted process wherein the visual or auditory elements of a recording are made clearer, while the overall content remains continuous and otherwise identical to the originating recording. Calibration settings are automatically or consistently applied across the entire recording. Speed changes are permitted so long as an on-screen timer exists that is reasonably calibrated to real time. Resolution may be increased, but never reduced except by cropping, and added annotations must not obscure substantive content from the originating recording. With video, content redaction is allowed when a solid foundation exists for determining what is substantive. With audio, clarification should not alter speed or pitch, and amplitude shifts should not be selectively applied, but channels can be merged if they are indistinguishable identical duplicates. Codec - Short for “Compression-Decompression”, codecs are computer instructions on how to compress audio and/or video data to occupy less space, and then how to best automatically reverse that process. Codecs are usually lossy, and thus introduce generally imperceptible errors. While irreversibly destructive, such errors act as a watermark that document post-production data modifications. Colorspace - If a video or image RGB (Red, Green, Blue) values, or the luminosity value (with planar or Black-White content), of a given pixel are zero then that pixel appears pure black. If this same pixel values are at their maximum, then that pixel appears white. RGB color space is truest to lossless data, while YV12 requires half the data and best approximates how human vision works. Compression - A method of squeezing data into a smaller file size. With video, this is commonly accomplished by retaining periodic complete reference moments (known as "i" frames) along with adjacent moments that only retain what has changed (known as "p" and "b" frames). The resulting "ipb" data is represented by tokens, which significantly reduces file size versus the uncompressed data it represents. Comparable methods are used with audio and image files. While this compression is lossless, file size is often further reduced through a lossy process that reduces the pallet depth, by treating similar data values as being the same value. Contrast - Contrast is the intensity difference between adjacent pixels. Changing video contrast is a destructive process that can cause objects to have an unrealistic or washed out appearance. Increasing contrast can amplify otherwise imperceptible subtle object motion or boundaries. A Curves filter skews pixel lighting toward a brighter or darker appearance while attempting to preserve relative contrast. Enhancement - A process wherein the visual or auditory elements of a recording are made clearer, while the retained content remains representative of the originating recording. The recording may have selective improvements and may be saved in a lossy codec. Enhancement has the potential to create or destroy factual representations, and any such changes must be documented to be evidentiary compliant. Since the terms clarification and enhancement have not been formally adopted, both terms are used and abused interchangeably. Evaluation - Information provided by the expert regarding the specific recording at issue. Optimally, each quote is accompanied by a brief enhanced or analyzed portion to facilitate an informed purchase decision. Technological advances have sped up the evaluation process and eliminated the practice of labs charging an evaluation fee. Expert - Within forensic fields, an expert is a qualified legal trier-of-facts as validated by peer reviewed processes, with forensic associations and certifications acting as the gate keepers. Frame rate - The recorded and/or playback speed of a recording. To determine video frame rate accuracy, one must examine: hidden speed related metadata, un-manipulated on-screen time stamps, naturalism of movement of people and objects, and speed consistency comparisons to other camera recordings depicting portions of the same scene. Some video codecs support variable frame rates, thus allowing the video playback to keep pace with the recorded video, as frame with complex motion require greater time for the recorder to encode. Frequency - Measured in Hertz (Hz), an adult with healthy hearing can detect frequencies from 20 Hz up to about 20 kHz, which is the range limits of most microphones. Human vision frequencies span from about 430 THz (Red) up to about 750 THz (Violet). Audio frequency is commonly referred to as “tone” while video frequency is known as “color”. Most of what we hear and see is composed of different overlapping frequencies. Computer software can electronically isolate and clarify such frequencies. Generation - An audio or video recording saved upon a recording device is called 1st generation and, in the case of video, typically requires proprietary viewing software. If the file can be digitally copied from the recorder, then that copy is also a 1st generation version, and remains an exact copy of the originating native recording. Each video frame of a 1st generation video will always represent the greatest native clarity, and a unique moment in time. If a 1st generation recording must be resaved lossy to exist beyond the recorder (e.g. a video DVD or MOV file), then that file is a 2nd generation version, and its recompression introduces some irreversibly destructive visual defects. If a DVR video must be screen captured to exist in an open format, significant visual defects will be introduced (e.g. frame blending, resolution modification, motion distortion, Moiré pattern, focus drifting, speed errors, etc...), and while this too is called a 2nd generation copy, if this screen capture is also saved lossy, then it becomes a 3rd generation file. 3rd generation video recordings significantly deviate from the original recording and rarely respond to authentication testing or clarification-enhancement processing. By contrast, audio is typically more robust and less affected by iterations of lossy compression. Histogram - A graph of data frequencies and intensities defined over time. A balanced Histogram curves these intensities to span from absolute black to pure white in a minimally destructive method to make a seemingly black nighttime video more viewable. iFrame - A video frame that contains the entire scene and thus is the truest to what the camera captured. All other types of video frames are composites made by adding or subtracting pixel data with the closest iFrames. If the video codec is lossy, non-iFrames will introduce a higher level of visual defects. Interlaced - Images from two consecutive but independent moments in time (called fields) are simultaneously displayed as one frame by weaving both fields to double the resulting vertical resolution. While newer systems use progressive systems that avoid this (e.g. 1080i is interlaced and 1080p is progressive), older security systems record interlaced video. Improperly performed, deinterlacing can blend both moments in time, which creates distortion and a false set of facts. Intensity - Audio intensity is called “volume” and video intensity is called “brightness”. Audio and video frequencies at any moment in time can be at nearly any available level of intensity. Lab vs company - Forensic labs perform all forensic work in-house, charge by the job, and rarely require a retainer. Forensic companies perform most work in-house, but sub-contract as needed and thus must use open-ended hourly billing to cover potential external expenses. While forensic companies offer a wider range of services, forensic labs provide faster processing, lower costs and direct contact with the forensic expert. Our company, "Forensic Protection", is a forensic lab. Letterbox - When a video is vertically and horizontally centered into a larger frame (typically a black frame), thus creating vertical and/or horizontal borders to force a video resolution beyond the true resolution of the visual contents. Such a process occurs in post-production and generally results in content loss or blending from changes if frame rate, reduced lossy compression). Lossless - When referring to a codec, the recording maintains all of its available data, albeit in a more compact file size. Repetitive lossless compressions will maintain the generation classification and not alter the faithfulness of the recording audio or video data to its originating source, but may alter the recording's metadata. Lossless processing and deliverables are the forensic industry's "best practice". After numerous lossless resaves, the resulting audio or video will remain visually identical to the originating recording. Lossy - When referring to a codec, the recording is compacted at the expense of mostly imperceptible data loss. DVR default settings typically remove some viewable details to further reduce file size. Each time a file is re-saved using a lossy codec, it becomes a later generation in an irreversibly destructive process that discards additional audio or visual details. Except in the rarest of cases (e.g. clarified by a forensic expert), videos are saved lossy to reduce file size. Lossy compression can be an effective forensic countermeasure to disguise content tampering, and after numerous iterations of lossy resaves, the resulting video will be devoid of all its originating audio-video details. Margin-of-error - Scientific calculations and processes have a margin-of error, which is the plus and minus (±) variance used to define a range for the target calculation. Absent other data, a bell curve is used to define the confidence in that range, with sigma-2 (95%) being the industry standard for beyond a reasonable doubt (Sigma-3 at 99.7% is considered definitive, while Sigma-1 at 68% represents more-likely-than-not). Measurements absent a definable margin-of-error require a strong foundation to be considered factual. Metadata - Data about data. Obvious data includes file size, date of file creation, and the hash value of a file's contents. Metadata may originate from witness testimony, correlations to other files, and facts that become obvious as the file is played or reviewed. Metadata may be present in specially allocated areas of the target file, but this is not always present, especially with certain audio or video recordings. The absence of metadata is rarely proof of tampering or resaving, although that can the cause. Metadata analysis is a complex topic. Motion Recording - Security video recorders typically include the option to limit recording to when motion is detected. The recorder can be configured to only consider motion occurring within a defined masked region (e.g. to ignore vehicles passing outside of a window). In its simplest form, motion is defined as the quantity and significance of pixel changes occurring over a pre-determined time interval, motion recording includes a sensitivity threshold setting to help prevent false positives. Since sensitivity settings can result in missed subtle motion, it is common for recorders to begin recording prior (pre-record), and continue after (post-record) to the detected motion event. The lay person may misinterpret legitimate motion time gaps as a sign of post-production editing. The behavioral consistency of the resulting time gaps allows an expert to work backwards to calculate motion settings and verify content authenticity. Noise - Distracting artifacts resulting from less than optimal recording conditions is called noise. Noise artifacts overlap, and often replace, the intended audio or video data. Even though noise usually occupies within a narrow frequency over a narrow time period, its intensity and quantity may be so extreme so as to prevent interpretation of the underlying audio or visual content. The existence of erratic changes in noise can be an indicator of file editing or content manipulation. Pixel - A pixel is a single dot on a display screen or printed page. Each visual dot is of a specific color and brightness (or just brightness for B/W images), represented by a numeric value. When enough of these dots are placed close together, our brain perceives an image. A video is a sequence of such images displayed over time. Photogrammetry - is when a reference object of measurable size is used to determine the unknown size of another object or person depicted in the same scene. The pixel resolution of the reference object determines the base margin-of-error for the unknown object. Because the two objects cannot occupy the same space, additional geometry is required to compensate for distance, camera angle, and optical distortion, thus impacting measurement accuracy. When determining a person's height; body posture, shoe sole height, and hair/hat style introduce additional variables that can result in a margin-of error useless for identification purposes. Proprietary - Nearly all security videos are saved using an open common method, but with its data contents in a non-standard order that requires proprietary software for playback. By relying upon a proprietary format, the recorder's manufacturer can ensure the integrity of the recording's audio, visual, and metadata contents. Forensic tools can extract simpler proprietary formats but, as the name implies, proprietary formats are designed to remain the manufacturer's secret. Recognition - As facial and voice recognition science advances, it's accuracy remains dependant upon the input data. If the evaluated recording is of poor quality, or the expert selects a specific moment as comparative data, the result can be a devastating false positive. Furthermore, different software programs can examine the exact same data and come to very different conclusions, which is one definition of the term "junk science". As with the polygraph, media hype has bypassed peer review, thus bestowing an extraordinary level of credibility and acceptance upon face and voice matching results in the minds of judges and juries. Resolution - The total number of uniformly sized image or video pixels expressed in either Megapixels (one million pixels) or as a grid of horizontal rows by vertical columns (e.g. 640x480). Higher resolutions result in a higher quality recordings and larger file sizes. With audio, resolution refers to its sample rate. Reductions in resolution, or non-integer increase multiplications, relative to the originating resolution, are irreversibly destructive. Videogrammertry - is a subset of Photogrammetry used to calculate object speed from a video. The margin-of-error will be affected by distances, viewing and travel angles, optical distortion, motion blur, land geometry, and the video's framerate. Acceleration, and changes in acceleration, can be calculated from multiple speed calculations, and accuracy can be improved by integrating on-screen (e.g. time stamp) and external (e.g. Google maps) data. Have a question or suggestion? Contact us |
 |
||
|