IAI CFVE key terms

A fixed-length digital fingerprint computed from a file's contents. Any change to the file produces a different value, so matching hashes before and after analysis demonstrate that the evidence copy is unaltered.

An exact sector-by-sector copy of a storage device that captures deleted files, slack space, and unallocated areas. It is made with a write blocker and verified against the source using a hash.

A hardware or software device placed between the evidence drive and the workstation that permits reading but blocks any write command, preventing accidental alteration of the original media.

A chronological record documenting who handled an item of evidence, when, where, and for what purpose. Gaps or inconsistencies can undermine the admissibility and weight of the evidence.

A duplicate of the forensic image used for all analysis and processing, leaving the verified master image untouched. Any derived exhibits can then be traced back to the preserved original.

Reviewing a video in the player or codec the file was originally written for, without transcoding. It best preserves original timing and frame structure but may require the originating proprietary software.

Re-encoding a video from one codec or format to another, which decodes and re-compresses every frame. It changes the data and can alter frame counts, timing, and quality, so originals must be preserved.

The wrapper file structure, such as MP4, AVI, or MKV, that holds video, audio, and metadata streams together. The container is separate from the codec used to compress the streams inside it.

The algorithm that compresses and decompresses video or audio, for example H.264 or HEVC. Correct decoding depends on the right codec, and different decoders can output slightly different frames.

The repeating structure of I, P, and B frames in a compressed video. Only I-frames are self-contained; P and B frames reference other frames, which affects seeking, frame extraction, and error propagation.

A frame encoded without reference to any other frame, similar to a still image. It serves as a random-access point in the stream and is often the only frame fully recoverable from a damaged file.

Reducing data by storing only the differences between successive frames rather than each frame in full. It creates dependencies between frames, so a lost or corrupted frame can visibly affect later frames.

The number of frames displayed per second, such as 25, 29.97, or 30. It determines how time is mapped to frame numbers and is essential for calculating elapsed time between events.

A recording mode in which frames are stored with uneven intervals rather than a constant rate, common in phone and screen recordings. Timing must be read from timestamps, not assumed from a nominal frame rate.

The reference clock or tick unit used to express timestamps in a media stream. Converting timestamps to real time requires knowing the time base, and errors here shift calculated event times.

A value attached to each frame indicating when it should be displayed relative to the stream's time base. It supports accurate timing analysis, especially in variable-frame-rate or reordered streams.

The convention used to count frames, such as starting at zero or one, or counting from a player's displayed counter. Stating the convention is essential so others can locate the exact same frame.

Saving a single frame as a still image for analysis or court presentation. The process, decoder, and export settings should be documented because they can subtly change color and detail.

Processing such as brightness, contrast, or sharpening applied to improve visibility of detail. Enhancements must be documented, applied to copies, and disclosed, since they can create or obscure features.

Establishing that a video is what it purports to be and has not been altered since capture. It draws on metadata, hashes, device records, and internal consistency checks rather than visual impression alone.

Data stored within or alongside a media file describing its creation, device, settings, and timing. It can corroborate or contradict a claimed source but is easily edited and must be validated.

The distinction between the first recording as written by the device and any later copy. Best practice is to analyze the earliest available version, since each copy or re-save can lose data and metadata.

Quality degradation that accumulates each time a video is decoded and re-encoded. Repeated copying or exporting can blur detail and alter compression artifacts used in analysis.

A visible byproduct of lossy compression, such as blockiness, ringing, or mosquito noise around edges. Artifacts follow predictable patterns and can help reveal editing or re-encoding history.

A technique that re-saves an image at a known quality and highlights areas with different compression histories. It can suggest manipulation but produces frequent false positives and is not conclusive on its own.

The condition in which a video or image has been encoded more than once, leaving traces of an earlier compression. Detecting it can indicate editing, re-export, or a copy rather than a camera original.

Building a chronological account of events by correlating timestamps from multiple sources such as CCTV, body cameras, and phone records. Clock offsets and drift must be identified and reconciled.

The difference between the time recorded by a device and a reliable reference clock. Measuring and documenting offsets lets investigators place footage accurately on a shared timeline.

The process of exporting selected footage from a digital or network video recorder, often into a proprietary player bundle. Export settings, player version, and any included viewer must be preserved and documented.

Vendor-supplied software required to view exported surveillance footage in its native form. Retaining the player and recording its version is important because generic players may not display all frames or timestamps correctly.

The ratio of image width to height, and the ratio of a single pixel's width to its height. Mismatches between stored and display ratios can stretch images and distort measurements of people or objects.

Deriving real-world measurements or positions from images using camera geometry, references, and perspective. In video work it supports height estimates and distance calculations but carries uncertainty that must be stated.

The arrangement of cameras, cabling or network links, recording devices, and storage that produces surveillance footage. Understanding it helps identify gaps, overwrites, and the true source of an export.

The policy and behavior by which a recorder keeps footage for a set period then recycles storage. Short retention windows make prompt preservation requests critical in investigations.

A written record of what was examined, the methods and tools used, findings, and limitations. It should be reproducible by another examiner and clearly separate observation from interpretation.

Independent scrutiny of an examiner's methods, notes, and conclusions by another qualified person before reporting. It strengthens reliability and is often expected in contested forensic video cases.

Documented checks confirming that a tool or method produces accurate, repeatable results for its intended use. Courts may ask whether the technique used was tested and known to have a reliable error rate.