The Video That Came Through a Platform
A 47-second video of a fight outside a bar was uploaded to a social-media platform three days after the event. You download it: 1080×1920, 30 fps, H.264, AAC audio, metadata stripped, GOP length 30, and variable quantization. A second copy from another account is 720×1280 and appears sharper in some frames. The clip contains a 0.3-second freeze near the first punch and a change in background noise at 00:19. The defense says the video was 'obviously edited' because the fight starts abruptly and the audio has a click. The prosecutor wants you to authenticate it and identify the first aggressor. You have no original phone. The platform's terms prevent access to the uploader's original file.
1. Can you authenticate the video as the original capture? What can you actually establish?
Read the worked answer
You cannot authenticate it as the original capture. Authentication means establishing that the file is what it purports to be and has not been altered since capture; a platform download is a re-encoded derivative with metadata stripped, so no hash match to the phone is possible. What you can establish is narrower: the file is a platform download with a container and bitstream consistent with a single platform re-encode, and it can be compared with other copies to see whether observed anomalies are common to all copies. Common anomalies are more likely to have been in the uploaded source; copy-specific anomalies point to download or transcoding effects. State this distinction clearly, and do not use 'authentic' to mean 'true' or 'unmodified.'
2. How would you investigate the freeze, the audio click, and the abrupt start for signs of editing?
Read the worked answer
Examine the GOP structure and quantization at the freeze: a true edit often produces a discontinuity in prediction residuals, a change in GOP cadence, or a double-compression signature. Check whether the freeze is a repeated frame or a re-encoded still; inspect motion vectors and block artifacts at its boundaries. For the audio click at 00:19, look at the waveform and spectrogram for a discontinuity or abrupt noise floor change. Compare both copies: if the freeze and click appear in both, they likely came from the uploaded source; if only one, they may be platform or download artifacts. The abrupt start may simply be where recording began. Absence of a detected edit is not proof of authenticity, and presence of an anomaly is not proof of manipulation.
3. The prosecutor asks you to identify the first aggressor. What is your response and report language?
Read the worked answer
Explain that the request is a legal conclusion, not a video-analysis finding, and that the compressed, re-encoded, audio-separated clip does not support a reliable determination of who initiated the fight. Offer instead a frame-by-frame timeline of observable actions-who moved first, contact, retreat-with frame numbers and time ranges, and state uncertainty where the view is occluded or the frame rate is insufficient. In the report, write: 'The video is a platform-derived copy; the original capture is unavailable. No opinion is offered on legal responsibility or first aggressor. The following observations are limited by 30 fps sampling, re-encoding, and the 0.3-second freeze.' This gives the prosecutor useful evidence without exceeding the method.