Mixed Phone and DSLR Files with a Wrong Camera Clock
At 02:14 a patrol officer photographs a shoe print in mud with a department-issued phone. Later you photograph the same print with a DSLR. You discover the DSLR clock is 47 minutes fast and is set to UTC-5 while the scene is in UTC-6; the phone is network-synced. The DSLR files are JPEG only, and the card is exFAT. You copy files to a laptop on scene and then to the lab server. The prosecutor asks for brightness- and contrast-enhanced images to show tread detail, and defense counsel asks for the original. The shoe print is 28 cm long; the mud is drying and beginning to crack.
1. Describe your ingestion and record-keeping steps. What is the original, and how do you answer defense counsel?
Read the worked answer
I would treat the camera card and phone extraction as the originals. At first contact I would write-protect the card or use a read-only adapter, compute a SHA-256 hash for each file and for the card image if one is made, and record the hash, file name, size, and timestamps. I would make two copies, verify the hashes on both, and work only from a copy. For the phone, I would use the department's extraction method or a documented file copy, not a screenshot. The enhanced images are derivatives, not originals. When defense counsel asks for the original, I would provide the original files or a verified forensic copy, plus a log of every derivative and the software and settings used. I would not hand over only the enhanced JPEG, and I would not overwrite the card. The exFAT format does not change the need for hashing and documentation.
2. Reconcile the DSLR time with the phone time. Show the reasoning and explain how you would present the corrected timeline.
Read the worked answer
The DSLR is 47 minutes fast and set to UTC-5 while the scene is UTC-6. To convert a displayed DSLR time to scene local time, subtract 47 minutes and then subtract another hour for the time-zone error, so the total correction is minus 1 hour 47 minutes. For example, a DSLR display of 04:47 corresponds to about 03:00 scene time, which fits after the phone image at 02:14. I would not edit the original metadata. I would create a table mapping each file's displayed time to corrected scene time, state the basis for the correction, and if I produce corrected copies, label them as derivatives and keep the originals. I would also document how the phone time was synced and whether the DSLR clock was checked against a reliable reference. If the correction cannot be verified, the timeline should be presented as approximate rather than false precision.
3. How would you perform and disclose the brightness/contrast enhancement, and where would you draw the line?
Read the worked answer
I would enhance only a copy, using global adjustments such as levels or curves applied to the whole image, and record the sequence, software, and settings. I would retain the unenhanced original and provide both. The enhanced image must be labeled as enhanced, and I must be able to explain that the adjustment changes tone reproduction, not content. I would draw the line at local cloning, content-aware fill, painted-in tread, or sharpening that creates edges that are not in the original. If the tread detail is not present in the original pixels, enhancement cannot legitimately create it. I would also avoid repeated JPEG re-saving. For court, I would bring the original, the derivative, and a written description of the processing, and I would be prepared to demonstrate the steps.