I85PREP
⌘ K
IAI CFVE study materials
IAI CFVE study resources

IAI CFVE practice questions

One question at a time. Build your IAI CFVE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Forensic Video

In forensic video work, what does the term 'GOP' refer to when analyzing an H.264 stream?

  1. The physical grouping of frames extracted to a contact sheet for court exhibits
  2. The metadata block that stores camera make and model
  3. The set of audio packets interleaved with video in a transport stream
  4. The group of pictures structure beginning with an I-frame and containing subsequent P- and B-frames Correct answer.

Explanation

A GOP (group of pictures) is the coded structure that starts at an I-frame and continues through the dependent P- and B-frames until the next I-frame. Understanding GOP boundaries matters because a single frame cannot be decoded in isolation from its reference frames.

Question 2Forensic Video

An investigator needs to preserve a DVR's recorded footage before it is overwritten. Which action best follows accepted forensic practice for the acquisition?

  1. Take screenshots of paused frames and save them as JPEGs
  2. Ask the DVR owner to email a clip they think is relevant
  3. Export the native files to a write-blocked, hashed evidence copy Correct answer.
  4. Play the footage on screen and record it with a phone camera

Explanation

Forensic acquisition favors obtaining the native digital files in their original format, ideally with hash verification, so the evidence can be authenticated and examined without alteration. Screen recording and screenshots introduce re-encoding and lose metadata and frame accuracy.

Question 3Forensic Video

What is the primary purpose of computing a cryptographic hash of a video evidence file at acquisition?

  1. To reduce the file size for easier storage
  2. To remove personal identifying metadata automatically
  3. To verify that the file has not changed since acquisition Correct answer.
  4. To convert the video into a court-friendly format

Explanation

A hash produces a fixed-length value that changes if the file content changes, allowing later verification that the evidence copy is bit-for-bit identical to what was acquired. It is an integrity tool, not a compression, conversion, or redaction tool.

Question 4Forensic Video

A file is described as having a variable frame rate (VFR). Why does this complicate frame-by-frame timeline analysis?

  1. VFR files cannot be decoded by any software player
  2. VFR files contain no frame timestamps at all
  3. VFR always implies the audio and video are out of sync
  4. Frame timestamps are not evenly spaced, so frame number does not map linearly to time Correct answer.

Explanation

With VFR, the interval between frames varies, so counting frames does not give a reliable elapsed time. Analysts must use the presentation timestamps to establish when each frame was actually displayed.

Question 5Forensic Video

Which statement best describes the difference between an I-frame and a P-frame in an interframe-compressed video?

  1. An I-frame stores only audio, while a P-frame stores video
  2. An I-frame is coded independently, while a P-frame references earlier frames Correct answer.
  3. An I-frame is encrypted, while a P-frame is not
  4. An I-frame is always higher resolution than a P-frame

Explanation

An I-frame is intracoded and can be reconstructed without reference to other frames, while a P-frame is predicted from previously decoded frames. This dependency is why damage to a reference frame can propagate to later frames in the GOP.

Question 6Forensic Video

During export from a proprietary DVR, the player writes a proprietary container that only its own software can open. What is the most defensible approach for the forensic analyst?

  1. Convert the file immediately and delete the original export
  2. Document the native export, retain the player, and transcode a working copy for analysis Correct answer.
  3. Discard the export because it is proprietary
  4. Rename the file extension so standard tools will open it

Explanation

Best practice is to preserve the native export and the means to render it, documenting the process, while creating a transcoded working copy for analysis. The original is retained for authentication and re-examination.

Question 7Forensic Video

What does the term 'chain of custody' mean in the context of video evidence?

  1. The documented record of who handled the evidence, when, and how Correct answer.
  2. The list of codecs supported by the analysis workstation
  3. The order in which frames are displayed during playback
  4. The sequence of GOPs in the encoded bitstream

Explanation

Chain of custody is the chronological documentation of custody, control, transfer, and analysis of evidence. It supports authenticity and integrity by showing that the item was not altered or substituted.

Question 8Forensic Video

A surveillance system timestamps frames using its internal clock, which is known to drift. What is the most appropriate way to treat these timestamps in a report?

  1. Report them as system times and document any known offset or drift Correct answer.
  2. Present them as exact real-world times without qualification
  3. Adjust all timestamps silently to match the investigator's watch
  4. Ignore the timestamps entirely and estimate times from lighting

Explanation

Embedded timestamps reflect the recorder's clock, which may drift or be misconfigured. The analyst should report them as system times and document any measured offset so the reader understands the uncertainty.

Question 9Forensic Video

When performing a photogrammetric comparison of a suspect's height against a fixed reference in a surveillance image, which factor most directly limits accuracy?

  1. The brand of the video player used for viewing
  2. The color temperature of the lighting
  3. The camera's perspective geometry and the subject's posture relative to the reference plane Correct answer.
  4. The file extension of the exported clip

Explanation

Photogrammetric measurement depends on camera geometry, lens distortion, and the subject's position and posture relative to the reference plane. Without control over these variables, measurements carry substantial uncertainty.

Question 10Forensic Video

An analyst extracts a single frame from an H.264 clip and notices blocky artifacts around a moving subject. What is the most likely explanation?

  1. The frame was captured with the wrong white balance
  2. Compression artifacts from motion prediction and quantization in the codec Correct answer.
  3. The frame was intentionally altered by the suspect
  4. The camera sensor was physically damaged at that instant

Explanation

Interframe codecs use motion prediction and quantization, which can produce blocking and ringing artifacts, especially around fast motion or at low bitrates. These are expected codec behaviors rather than evidence of tampering.

Question 11Forensic Video

A defense challenge claims a video was 'slowed down to change the story.' Which analysis best tests this claim?

  1. Listen to the audio track and judge whether it sounds natural
  2. Count the total number of frames and divide by the file size
  3. Compare the presentation timestamps and frame rate against the container metadata and any reference clock Correct answer.
  4. Ask the person who exported the file whether they slowed it down

Explanation

Testing a speed-alteration claim requires comparing embedded timing information, frame rate, and any reference clock such as a visible time display. Objective timing evidence is more reliable than subjective impressions.

Question 12Forensic Video

What is the purpose of a write blocker when acquiring video evidence from a storage device?

  1. To increase read speed during imaging
  2. To convert the file system to a forensic format
  3. To prevent any write operation to the source device during acquisition Correct answer.
  4. To encrypt the acquired image automatically

Explanation

A write blocker permits read access while blocking write commands, protecting the source from modification during acquisition. This preserves integrity and supports the hash verification of the resulting image.

Question 13Forensic Video

An examiner needs to demonstrate that a specific frame in a submitted clip matches a frame in the original DVR export. Which approach is most rigorous?

  1. Compare the file names of the two clips
  2. Extract the frame from both sources and compare decoded pixel values and per-frame hashes Correct answer.
  3. Visually compare the two frames side by side and state they look the same
  4. Compare the total duration of the two files

Explanation

Decoding both sources and comparing pixel data or per-frame hashes provides an objective, reproducible basis for matching frames. Visual comparison alone is subjective and vulnerable to challenge.

Question 14Forensic Video

Why must an analyst be cautious when using 'enhance' or sharpening filters on a video frame intended for identification?

  1. Filters can introduce artifacts that were not present in the original and mislead the viewer Correct answer.
  2. Filters convert the frame to a lossless format
  3. Filters always reduce the file size below court limits
  4. Filters remove the frame's timestamp permanently

Explanation

Enhancement filters synthesize or amplify detail and can create features that were not in the source, risking false identification. Any processed image should be clearly labeled and accompanied by the unprocessed original.

Question 15Forensic Video

A clip's container reports 30 fps, but the embedded presentation timestamps show irregular spacing. What should the analyst conclude?

  1. The container metadata is authoritative and the timestamps should be ignored
  2. The clip is corrupted beyond analysis
  3. The stream may be variable frame rate, and timing should be derived from timestamps Correct answer.
  4. The clip was recorded on a phone rather than a DVR

Explanation

When container frame rate and timestamp spacing disagree, the timestamps more directly reflect actual display timing, suggesting variable frame rate or a mislabeled container. Analysts should document the discrepancy rather than assume corruption.

Question 16Forensic Video

What does EXIF metadata typically provide when present in a still image extracted from a camera system?

  1. The chain of custody for the evidence item
  2. A guarantee that the image has not been edited
  3. Camera settings and capture details such as make, model, and exposure Correct answer.
  4. The legal jurisdiction where the image was recorded

Explanation

EXIF metadata commonly records camera make and model, exposure settings, and timestamps. It is useful corroborating information but is not a custody record and can be edited.

Question 17Forensic Video

An investigator is told the DVR overwrites footage every 14 days. What is the most time-critical action?

  1. Photograph the DVR's exterior casing
  2. Preserve the relevant footage and native export before the overwrite cycle completes Correct answer.
  3. Request the DVR's user manual
  4. Interview the DVR manufacturer's support line

Explanation

Retention windows determine how long evidence exists before automatic overwrite, so preservation must occur before the cycle completes. Documentation and interviews can follow once the data is secured.

Question 18Forensic Video

When reporting a frame count between two events in a clip, why should the analyst also report the corresponding time interval?

  1. Courts require time values expressed in milliseconds
  2. Frame counts cannot be verified by any tool
  3. Frame counts are meaningless without a time value
  4. Time interval contextualizes the count and accounts for frame rate or timing irregularities Correct answer.

Explanation

A frame count alone can be misinterpreted if the frame rate is variable or unknown. Reporting the derived time interval, with its assumptions, gives the reader a meaningful and verifiable measure.

Question 19Forensic Video

A surveillance camera's field of view shows a person entering and leaving. To establish the direction of travel across overlapping cameras, what is most useful?

  1. The file size of each camera's export
  2. The color of the person's clothing in each view
  3. Synchronized timestamps and known camera positions with overlapping fields of view Correct answer.
  4. The number of frames in each clip

Explanation

Direction of travel across cameras is established by correlating synchronized times with the known geometry and overlap of the camera views. Clothing color is weak corroboration and file size or frame count are irrelevant to spatial reasoning.

Question 20Forensic Video

Which practice best supports reproducibility when an analyst uses a proprietary player to view a DVR export?

  1. Record the player name, version, and settings used, and retain the software Correct answer.
  2. Rely on memory of the settings used at the time
  3. Convert everything to a single universal format and discard the player
  4. Assume future analysts will have the same software

Explanation

Reproducibility requires documenting the tools, versions, and settings used so another examiner can repeat the work. Retaining the software ensures the native export can be rendered again if needed.

Question 21Forensic Video

An analyst observes that a subject's face is visible in only two frames of a clip. What is the most defensible conclusion for a facial comparison report?

  1. Identity is established because the face is visible
  2. The limited number of frames constrains the comparison and conclusions should be appropriately qualified Correct answer.
  3. No conclusion can ever be drawn from two frames
  4. The subject should be identified based on clothing

Explanation

The quantity and quality of available imagery directly constrain what a facial comparison can support. With only two frames, the analyst should state limitations and avoid overstating certainty.

Question 22Forensic Video

A defense expert argues that a frame extracted from an interframe-compressed video cannot be trusted because it is 'predicted.' How should the analyst respond technically?

  1. State that all frames are actually I-frames
  2. Agree that predicted frames cannot be examined
  3. Argue that compression does not affect any frame
  4. Explain that decoding reconstructs the frame deterministically from its references and that the decoded output is what was displayed Correct answer.

Explanation

Decoders reconstruct predicted frames deterministically using the reference frames and residual data, producing the picture that was displayed. The decoded output is therefore valid for analysis, though its quality may be lower than an I-frame.

Question 23Forensic Video

During analysis, an examiner finds that the embedded timestamp jumps backward by several minutes mid-clip while motion continues smoothly. What is the most likely explanation?

  1. The codec lost a group of pictures
  2. The recorder's clock was adjusted or resynchronized during recording Correct answer.
  3. The audio track overran the video track
  4. The video was necessarily edited to hide an event

Explanation

A smooth continuation of motion with a discontinuous timestamp suggests the recorder's clock was reset or synchronized, not that frames were removed. The analyst should document the discontinuity and avoid inferring tampering without further evidence.

Question 24Forensic Video

Two analysts produce different height estimates from the same surveillance image. Which factor is most likely to account for the discrepancy in a rigorous review?

  1. Different brands of monitor used to view the image
  2. Different file names assigned to the exports
  3. Different assumptions about the reference plane, lens distortion, and the subject's posture Correct answer.
  4. Different dates on which the analysis was performed

Explanation

Photogrammetric estimates depend heavily on modeling assumptions such as the reference plane, lens distortion correction, and subject posture. Divergent assumptions, not viewing hardware or naming, typically explain differing results.

Question 25Forensic Video

An examiner is asked whether a clip could have been created by generative AI. Which combination of indicators is most relevant to examine?

  1. Temporal consistency, physical plausibility, compression history, and metadata provenance Correct answer.
  2. The color of the interface of the player used
  3. File size and folder location
  4. The number of frames and the clip's duration

Explanation

Assessing synthetic media requires examining temporal and physical consistency, compression and encoding history, and metadata provenance together. No single indicator is conclusive, so a combination of technical signals is needed.

Question 26Forensic Video

In forensic video work, what distinguishes a 'native' export from a 'transcoded' export of DVR footage?

  1. A native export preserves the original codec, resolution and frame data, while a transcoded export re-encodes the video into a different format Correct answer.
  2. A native export contains no timestamps, while a transcoded export embeds a fresh timestamp overlay
  3. A native export is produced only by the manufacturer's player, while a transcoded export is produced only by open-source tools
  4. A native export always includes audio, while a transcoded export removes all audio streams

Explanation

Native export copies the original encoded stream so the pixel and frame data remain as recorded, whereas transcoding decodes and re-encodes, introducing generational loss and possible frame-rate or resolution changes. Examiners prefer native exports for analysis and reserve transcodes for viewing convenience.

Question 27Forensic Video

Which statement best describes the role of a hash value such as SHA-256 in video evidence handling?

  1. It provides a fixed-length digital fingerprint that changes if the file contents change by even one bit Correct answer.
  2. It records the geographic location where the recording device was operating
  3. It encrypts the video file so that unauthorized parties cannot view the footage
  4. It converts proprietary video into a format readable by any media player

Explanation

A cryptographic hash maps file contents to a fixed-length value; any alteration to the data produces a different hash, so matching hashes support a claim of integrity. Hashing does not encrypt, geolocate, or transcode the file.

Question 28Forensic Video

An examiner must document the software used to decode a proprietary DVR stream. Which detail set is most important to record for reproducibility?

  1. The analyst's workstation wallpaper and screen resolution
  2. The software name, version, codec library build, and any export settings applied Correct answer.
  3. The retail price of the software license
  4. The number of other cases open on the analyst's machine

Explanation

Reproducibility requires recording the exact tool and version plus the decoding libraries and export parameters, because different decoder builds can render frames differently. Workstation cosmetics, licensing cost, and caseload have no bearing on the decoded output.

Question 29Forensic Video

What is the primary forensic concern when a DVR stores video in a proprietary container that generic players cannot open?

  1. The container prevents any hash from being calculated
  2. The proprietary format may require vendor tools, so the examiner must document decoding and consider a verified conversion Correct answer.
  3. The footage is automatically inadmissible in court
  4. The container guarantees the video has been edited

Explanation

Proprietary containers can still be forensically sound, but the examiner must document how the stream was decoded and, if conversion is needed, preserve the original and verify the conversion. Proprietary format alone does not make evidence inadmissible, prove editing, or block hashing.

Question 30Forensic Video

In a video report, what does the term 'frame rate' specifically refer to?

  1. The amount of storage consumed per minute
  2. The number of pixels in each frame
  3. The brightness range of the sensor
  4. The number of frames presented per second of playback Correct answer.

Explanation

Frame rate describes how many frames are displayed or recorded per second and underpins any frame-to-time conversion. Pixel count is resolution, storage use is bitrate-related, and brightness range is dynamic range.

Question 31Forensic Video

A client asks an analyst to 'clean up' a blurry surveillance clip so a license plate becomes readable. What is the correct professional response?

  1. Explain that detail absent from the source cannot be reliably recovered, and avoid asserting characters not supported by the data Correct answer.
  2. Apply aggressive sharpening until characters appear and report them as the plate
  3. Use generative AI upscaling to invent plausible characters and report those
  4. Increase contrast only, then certify the plate as positively identified

Explanation

Enhancement can improve visibility of information that is present, but it cannot create reliable detail that the sensor never captured. Asserting characters from over-sharpening or generative upscaling risks fabricating evidence. The analyst should explain the limits of the source data.

Question 32Forensic Video

Which item belongs in a video evidence examination log?

  1. The examiner's opinion of the suspect's guilt
  2. The defense attorney's billing records
  3. Each transfer, access, and action performed on the evidence with date and handler Correct answer.
  4. The names of unrelated witnesses in the case

Explanation

An examination log records every access, transfer and processing step with dates and responsible persons so the handling history can be reconstructed. Guilt opinions, unrelated witnesses and opposing counsel's billing are outside the scope of an evidence log.

Question 33Forensic Video

What is the practical difference between 'frame extraction' and 'frame capture' in video analysis?

  1. Extraction requires a hash, while capture never does
  2. Extraction produces audio only, while capture produces video only
  3. Extraction is always illegal, while capture is always permitted
  4. Extraction decodes the frame from the video stream at full stored resolution, while capture grabs whatever is displayed on screen Correct answer.

Explanation

Frame extraction pulls the decoded frame directly from the video data, preserving stored resolution and avoiding display scaling. Screen capture records the rendered image, which may be resized, overlaid, or affected by player settings.

Question 34Forensic Video

A DVR clock is set to local time with daylight saving changes, and the analyst must express event times in UTC. What is the correct approach?

  1. Determine the device's time zone and DST rules, document the offset applied, and convert to UTC Correct answer.
  2. Assume the DVR clock is already UTC and report times unchanged
  3. Report only frame numbers and omit any time reference
  4. Add exactly one hour to every timestamp regardless of date

Explanation

Correct conversion requires establishing the device's configured time zone and whether daylight saving was in effect at the recording time, then applying and documenting the offset. Assuming UTC, applying a fixed offset, or omitting time references would misrepresent the timeline.

Question 35Forensic Video

Two cameras cover the same corridor and their clocks differ by 47 seconds. How should the analyst reconcile the recordings?

  1. Delete the camera with the later clock from the analysis
  2. Treat each camera's timeline independently and never correlate events
  3. Establish a common event visible in both views to align the timelines, documenting the measured offset Correct answer.
  4. Average the two timestamps and report a single midpoint time

Explanation

Using a shared visible event as a synchronization reference lets the analyst measure and document the offset between camera clocks, producing a defensible correlated timeline. Ignoring the offset, discarding footage, or averaging timestamps misrepresents the sequence.

Question 36Forensic Video

What does a Group of Pictures (GOP) structure mean for frame-level analysis of an H.264 stream?

  1. GOP length equals the clip duration in seconds
  2. Frames are organized into I, P and B frames, where P and B frames depend on reference frames for decoding Correct answer.
  3. Audio and video are always stored in separate GOPs
  4. Every frame is independently coded, so any frame can be decoded alone

Explanation

In interframe compression, I frames are self-contained while P and B frames reference other frames, so correct decoding requires the reference chain. This matters when an examiner extracts or seeks to a frame in the stream.

Question 37Forensic Video

An analyst needs to present a slow-motion version of an event to a jury. Which practice is most defensible?

  1. Speed up the clip instead so the event appears faster
  2. Present the original-speed clip as primary and clearly label any slowed playback as a demonstrative aid Correct answer.
  3. Present the slowed clip alone without comment so the jury focuses on detail
  4. Remove the timestamp overlay to avoid confusion during slowed playback

Explanation

The original-speed recording is the primary evidence; slowed playback is a demonstrative aid whose altered timing must be disclosed so the jury does not infer a false duration. Presenting slowed footage unlabeled, altering speed without disclosure, or removing the timestamp would mislead.

Question 38Forensic Video

A clip shows a person walking past a doorway of known width. Which information is essential before any speed or distance estimate is attempted?

  1. Camera frame rate, perspective geometry, and the accuracy of the reference measurement Correct answer.
  2. The suspect's shoe size
  3. The color temperature of the lighting
  4. The brand of the door frame

Explanation

Distance and speed estimates depend on frame timing, camera geometry relative to the reference, and the precision of the known measurement. Shoe size, door brand and lighting color are not the controlling variables for such estimates.

Question 39Forensic Video

What is the purpose of creating a working copy of a DVR export while retaining the original untouched?

  1. To allow analysis and processing on a copy while preserving the original as the reference for integrity verification Correct answer.
  2. To reduce the storage space used by the case file
  3. To make the evidence admissible in place of the original
  4. To hide the original from the defense

Explanation

Analysis is performed on verified working copies so the original remains unaltered and available as the integrity reference. The copy is not a space-saving measure, does not replace the original's evidentiary role, and must not be concealed.

Question 40Forensic Video

An analyst extracts a frame and notices the subject's outline shows a jagged 'stair-step' edge along diagonal lines. What is the most likely cause?

  1. Encryption of the video stream
  2. A corrupted file allocation table
  3. An incorrect time zone setting
  4. Aliasing from insufficient sampling relative to scene detail Correct answer.

Explanation

Jagged diagonal edges are the classic signature of aliasing, where the sampling grid cannot resolve fine diagonal detail. Encryption, file system corruption and time zone settings do not produce this spatial artifact.

Question 41Forensic Video

When comparing a questioned clip to a known camera's footage, which characteristic is most useful for establishing source consistency?

  1. The file name assigned by the export tool
  2. The number of folders on the storage drive
  3. Sensor noise pattern and fixed-pattern artifacts unique to the camera Correct answer.
  4. The date the analyst received the evidence

Explanation

Sensor-specific noise and fixed-pattern artifacts act like a fingerprint of the imaging sensor and can support or refute a claim about which camera produced the footage. File names, folder counts and receipt dates are administrative and easily changed.

Question 42Forensic Video

A clip's audio track contains a voice the investigator wants to compare to a suspect. What is the key limitation the analyst should communicate?

  1. Audio tracks in surveillance systems are always synthetic
  2. Voice comparison requires the suspect to speak the same words at the same volume
  3. The recording's codec, microphone, background noise and channel conditions may limit what conclusions are supportable Correct answer.
  4. Audio comparison is impossible unless the recording was made in a studio

Explanation

Forensic voice comparison depends heavily on recording quality, compression, noise and channel characteristics, which constrain the strength of any conclusion. Studio conditions are not required, matching words and volume is not the governing rule, and surveillance audio is not inherently synthetic.

Question 43Forensic Video

An examiner is asked to determine whether a submitted clip is the same file as the DVR export. Which comparison is most direct?

  1. Compare the visual appearance of the first frame in each file
  2. Compare cryptographic hashes of the two files Correct answer.
  3. Compare the file sizes in megabytes
  4. Compare the file creation dates shown in the operating system

Explanation

Identical cryptographic hashes establish that the file contents are bit-for-bit the same, which is the most direct identity test. Visual comparison, operating system dates and file size can coincide without the contents being identical.

Question 44Forensic Video

What is the significance of presentation timestamps (PTS) in a video container?

  1. They record the number of audio channels
  2. They define when each frame should be presented relative to the timeline, independent of decode order Correct answer.
  3. They store the camera's GPS coordinates
  4. They specify the color space of the encoder

Explanation

PTS values place frames on the presentation timeline and can reveal irregular timing even when nominal frame rate is constant. They do not carry location, color space or audio channel information.

Question 45Forensic Video

An analyst must report the elapsed time between two events in a clip recorded at a variable frame rate. What is the most rigorous method?

  1. Sum the presentation timestamp differences between the two frames and document the method Correct answer.
  2. Estimate visually using a stopwatch during playback
  3. Multiply the frame count by the nominal frame rate
  4. Assume a constant 25 fps because it is the most common rate

Explanation

With variable frame rate, frame counts do not map linearly to time, so elapsed time must be derived from the actual presentation timestamps with the method documented. Nominal-rate multiplication, stopwatch estimates and assumed rates would introduce error.

Question 46Forensic Video

A defense expert asserts that a single extracted frame is unreliable because neighboring frames were not examined. How should the analyst respond?

  1. Argue that neighboring frames are irrelevant to any analysis
  2. Explain that the frame was decoded from the full stream and contextualize it with adjacent frames and the coding structure Correct answer.
  3. Concede that any single frame is meaningless without the entire recording
  4. Refuse to discuss the extraction method

Explanation

A frame is decoded in the context of its reference chain, and sound practice contextualizes it with adjacent frames and the GOP structure. Conceding meaninglessness, dismissing context, or refusing to explain the method would weaken a defensible position.

Question 47Forensic Video

During review, an analyst finds that a person appears in camera A and, 3 seconds later by camera A's clock, in camera B located 40 meters away. What is the most appropriate analytical step?

  1. Check camera B's clock offset against a shared reference and evaluate plausible travel time before drawing conclusions Correct answer.
  2. Discard camera B's footage as unreliable
  3. Report that the person teleported between cameras
  4. Conclude immediately that the two appearances are different people

Explanation

An implausible implied speed may reflect clock offset rather than different subjects, so the analyst should verify synchronization and assess realistic travel time before concluding. Immediate conclusions, teleportation claims, or discarding footage are not defensible.

Question 48Forensic Video

An examiner must decide whether a submitted video was re-encoded after the original recording. Which finding most strongly supports re-encoding?

  1. A consistent GOP structure with I frames at regular intervals
  2. A file size larger than one megabyte
  3. Presence of an audio track
  4. Double-compression artifacts and a quantization or encoding signature inconsistent with the claimed source device Correct answer.

Explanation

Signs of a second compression generation, such as double-compression artifacts and encoder signatures that do not match the claimed device, indicate the file passed through another encode. Regular GOP structure, audio presence and file size are ordinary and not diagnostic of re-encoding.

Question 49Forensic Video

An analyst is preparing to testify about a photogrammetric estimate derived from a low-resolution frame. Which practice best supports the testimony?

  1. Report the estimate with an error range, document assumptions, and explain the limits imposed by resolution Correct answer.
  2. Avoid mentioning the method used to derive the value
  3. Present the estimate as an exact measurement confirmed by software
  4. State a single precise value without mentioning uncertainty

Explanation

Defensible testimony communicates uncertainty, assumptions and the constraints of the source data rather than presenting a point estimate as exact. Omitting the method or overstating precision invites successful challenge.

Question 50Forensic Video

Two frames from the same camera show a shadow that appears to fall in different directions relative to fixed objects. What is the most appropriate analytical interpretation?

  1. Consider changes in illumination source, time of day, or camera settings before alleging manipulation Correct answer.
  2. The footage must have been fabricated
  3. Shadows are irrelevant to video analysis
  4. The camera was definitely moved between frames

Explanation

Shadow direction depends on light source position, time of day and camera or scene changes, so these must be evaluated before alleging fabrication. Concluding fabrication, dismissing shadows, or asserting camera movement without evidence are unsupported leaps.