Forensic Video Analysis
Forensic Video Analysis
This domain tests recovery and interpretation of video evidence: preserving the native file, understanding compression and frame structure, and making measurements that survive cross-examination.
Acquisition
Recover the original recording in its native format, along with the player and codec if proprietary. Hash the source at acquisition and document every conversion. Do not transcode before hashing; export a working copy and keep the original read-only. Record time-base information, camera identity, and any clock offset between the recorder and real time.
Analysis
Frame rate and interlacing affect what a "frame" contains; deinterlace only on a copy. Enhancement - stabilization, contrast, filtering, super-resolution - must be documented step by step and must not invent detail. Photogrammetry uses known reference dimensions in the scene to estimate height, speed, or distance, with perspective and lens distortion corrected first.
Worked example
Estimate a subject's height from a doorway of known height. Measure the doorway in pixels in the same frame and depth plane as the subject, correct for perspective, measure the subject's pixel height from the same ground plane, then scale: subject height = (subject pixels ÷ doorway pixels) × known doorway height. Report a range and state assumptions - footwear, posture, lens distortion - rather than a single figure.
Traps
Working from a transcoded copy while the original is unavailable; hashing after conversion; over-enhancing until artifacts appear; measuring across different depth planes; and ignoring the recorder's clock drift.