video frame comparisons in digital video authenticity … · preparation of camcorder test samples...

Journal of Forensic Identification62 (2), 2012 \ 165

1 BEK TEK LLC, Clifton, VA2 Richards’ Forensic Services, Laurel, MD

Received November 9, 2010; accepted May 11, 2011

Article

Video Frame Comparisons in Digital Video Authenticity Analyses

Bruce E. Koenig 1Douglas S. Lacey 1

Gerald B. Richards 2

Abstract: The scientif ic authentication of digital video-audio recordings involves the examination of both the visual and acoustic information through a number of analysis steps. One step in this pro-tocol is determining whether any of the individual images are identical to any other images within the same digital recording. Additionally, in some examinations, it is necessary to identify nonmatching pixels from nearly identical images. These duplicate, or nearly duplicate images, could be indicative of editing, an irregularity of a specif ic recording device, or just identically captured and processed images. In this paper, three questions involving video frame comparisons are addressed:

(1) Does a specif ic, commonly available, consumer-quality camcorder produce any identical images with a static visual view in standard and high definition modes?

(2) Are there accurate methodologies for determining whether two recorded digital images are identical?

(3) What digital analysis procedures are available for compar-ing two nearly identical images?

These questions are answered with the analysis of more than 147,100 frames from a consumer camcorder using digital data analyses and Photoshop routines.

Journal of Forensic Identification166 / 62 (2), 2012

IntroductionAuthenticat ion of digital video-audio recordings of ten

involves the examination of both the visual and acoustic [1, 2] information through a number of analysis steps. One step in this protocol is the determination of whether any of the individual video images are bit-for-bit identical with any other images within the same digital recording, which could be indicative of editing (e.g., a copy and insert or overlay process) [3, 4], an irregularity of a specific camcorder or recording device [5], or just identi-cally captured and formatted views. Often the examiner can visually identify differences between adjacent frames because of camera movement, lighting, human or other activity, compres-sion artifacts, and so on. However, if the changes are subtle, with differences due only to limited compression changes, minor sensor artifacts, and other in-camera signal modifications, or are nonexistent, an examiner may not be able to visually assess these slight pixel differences or even whether any interframe variations have occurred between adjacent images. Additionally, if the video recording contains repetitive pictorial information or is lengthy, it would be difficult and very time-consuming for an examiner to visually compare every image to every other recorded image to ensure there are no duplications. Though some digital formats allow the examiner to determine duplicity through a direct analysis of the digital video data [5], most do not. As an example, it would be difficult to visually determine whether there are any matching images from a lengthy recording produced on a securely mounted surveillance camera contain-ing no motion or obvious changes within its view, such as a unit located on the interior wall of a bank building in the middle of the night.

On digital video recorders using highly compressed formats, of ten utilized in surveillance systems, the ar tifacts of the compression usually produce visual differences between fields and frames containing identically received images from a camera. However, not all digital video recordings submitted for authenticity examination are of low quality; some contain higher quality, standard definition (SD) NTSC [National Television System (or Standards) Committee], PAL (phase-alternation line standard), or SECAM (séquentiel couleur avec mémoire, which is French for “sequential color with memory”) formatted recordings with limited compression and “full” pixel resolution (720 by 480 for NTSC, for example). Additionally, low-priced, high-definition (HD) consumer camcorders, which can produce


high-quality images with resolutions up to 1920 by 1080 pixels, are rapidly replacing the SD camcorders.

In some digital video authenticity examinations, slight differences between images can also be important indicators of the recording system characteristics or possible signs of more sophisticated editing. Examples include when two frames are identical except for differing embedded text information, or when slight changes are produced between known identical images due to an added compression step, possibly ref lecting duplication, editing, or transcoding processes.

In this article, three questions involving video frame compar-isons are addressed:

(1) Does a specif ic, commonly available, consumer-quality camcorder produce any identical images with a static visual view in standard and high definition modes?

(2) Are there accurate methodologies for determining whether two recorded digital images are identical?

(3) What digital analysis procedures are available for comparing two nearly identical images?

These questions are answered with the analysis of more than 147,100 frames from a consumer camcorder using digital data analyses and Photoshop routines.

Preparation of Camcorder Test SamplesUsing a consumer Sony Handycam HDR-CX100 camcorder

(Sony Corporation, Tokyo, Japan), video test recordings were prepared of two indoor views: (1) a light-color, blank wall lit only with overhead, recessed f luorescent lighting and (2) a very detailed stained-glass mosaic with overhead, incandescent lighting. This color NTSC camcorder has three SD and four HD record modes, all with variable video bit rates (based on the effects of compression) and 59.94 interlaced f ields (29.97 frames) per second, as ref lected in Table 1.

In Table 1, the pixel resolution column ref lects the dimen-sions of each full frame (two fields) image. The pixel aspect ratio column ref lects the factor by which the horizontal dimension of the pixels is scaled to achieve the respective display aspect ratios for the NTSC-based video formats. The nominal bit rate column provides the megabits per second (mbps) data rates provided by the camcorder manufacturer and show increasing quality from


LP to HQ for the SD modes, and LP to FH for the HD modes. The moving picture experts group (MPEG) lossy compression encoding formats are heavily used in the consumer video field, with MPEG-2 being older and less eff icient compared to the MPEG-4 standard. The AVC (advanced video codec)/H.264 AVCHD configuration is commonly used in smaller camcorder units. A thorough explanation of these compression schemes is well beyond the scope of this article, but many excellent texts are available on the subject [3, 4, 6, 7]. Figure 1 provides an example of one frame from the HD FH test recording of the stained-glass mosaic.

Test video recordings of both views were prepared using the following procedures:

1. The recordings were all produced at night with only the artificial light sources present, in rooms where the air conditioning and ventilation systems were turned off.

2. The camcorder was mounted on a sturdy tripod and powered with its AC/DC adaptor.

3. The camcorder controls were set as follows: manual focus, manual exposure, fader off, automatic white balance off, automatic slow shutter mode off, automatic back lighting correction off, SD formats in the 4:3 aspect mode, and image stabilization off.

4. Five-minute recordings were prepared onto Memory Stick PRO Duo (16 GB) media using all seven record modes available on the camcorder: HD FH, HD HQ, HD SP, HD LP, SD HQ, SD SP, and SD LP.

5. Additionally, 12-minute recordings were prepared of just the blank wall view, onto the Memory Stick PRO Duo media using all four HD modes.


Record Mode Pixel Resolution

Pixel Aspect Ratio

Display Aspect Ratio

Nominal Bit Rate

Video Encoding

SD LP 720 x 480 0.91 4:3 3 Mbps MPEG2-PSSD SP 720 x 480 0.91 4:3 6 Mbps MPEG2-PSSD HQ 720 x 480 0.91 4:3 9 Mbps MPEG2-PS

HD LP 1440 x 1080 1.33 16:9 5 MbpsMPEG4-

AVC/H.264 AVCHD

HD SP 1440 x 1080 1.33 16:9 7 MbpsMPEG4-

AVC/H.264 AVCHD

HD HQ 1440 x 1080 1.33 16:9 9 MbpsMPEG4-

AVC/H.264 AVCHD

HD FH 1920 x 1080 1.00 16:9 16 MbpsMPEG4-

AVC/H.264 AVCHD

Table 1A listing of the seven recording modes on the Sony Handycam HDR-CX100 camcorder and their display, bit rate, and video encoding characteristics.

Figure 1Sample frame from the HD FH test recording of the stained-glass mosaic.


Digital Data Analyses to Identify Identical Digital Video Frames

Using a nonlinear, digital video editing system, all of the recordings were impor ted in their native formats, thereby preserving the video encoding, pixel dimensions and aspect ratio, display aspect ratio, and frame rate. The ability to preserve these characteristics and avoid transcoding of the recorded video was crucial, because visual changes may be introduced during such processes.

After being imported, each of the 5-minute recordings was trimmed to 3 minutes, with the first and last minutes removed; the 12-minute recordings were trimmed to 10 minutes, again with the f irst and last minutes removed. This trimming was done to avoid any camera movements, shadows, or other artifacts that may have been added during the manual record start and stop procedures. Using the same software, the individual frames from the trimmed files were exported as separate, uncompressed image files in a bitmap file format (BMP), using the appropriate image characteristics (Table 1). All of these exported color BMP files contained a 54-byte header followed by the image data. As ref lected in Table 2, these headers included two portions of administrative information: the first 14 bytes listed the American Standard Code for Information Interchange (ASCII) designator “BM”, the total f ile size in bytes, and the header size; the last 40 bytes of the header are designated as a “device-independent bitmap” (DIB) and included the size and structure of the image data. A review of Table 2 ref lects that all of the exported SD image files had a size of 1,036,854 bytes, no compression, and dimensions of 720 by 480 pixels; the three lower-quality HD exported files (HQ, SP, and LP) were 4,665,654 bytes, with no compression, and dimensions of 1440 by 1080 pixels; and the HD FH exported files were 6,220,854 bytes, with no compression, and dimensions of 1920 by 1080 pixels.

The data portion of the BMP image files allocated three bytes to define each pixel in the frame, representing the colors blue, green, and red, respectively, with each color having an intensity range of 8 bits [28 or 256 values from 0 (darkest) to 255 (lightest)]. Therefore, for example, the 720 by 480 pixel SD files consisted of 1,036,800 bytes (720 x 480 x 3) of image data plus the 54 bytes of header information. Compared to the actual image, the digital data bytes are listed in an inverted style, starting with the three color values for the pixel in the lower left corner of the image, then proceeding from left to right across the image, and finally


going row by row from the bottom to the top of the image. In other words, the digital data starts at the beginning of the last row of the image, proceeds to the end of that row, jumps to the beginning of the row above, and continues in this fashion to the end of the top row of the image [8].

Header Bytes Description SD HQ, SD SP,

& SD LPHD HQ, HD SP,

& HD LP HD FH

1–2 File Identifier ASCII “BM” ASCII “BM” ASCII “BM”3–6 File Size in Bytes 1,036,854 4,665,654 6,220,8547–10 Reserved 0 0 0

11–14 Header Size in Bytes 54 54 54

15–18 DIB Header Size in Bytes 40 40 40

19–22 Image Width in Pixels 720 1440 1920

23–26 Image Height in Pixels 480 1080 1080

27–28 Color Planes (always 1) 1 1 1

29–30 Number of Bits per Pixel 24 24 24

31–34 Compression (0 = none) 0 0 0

35–38 Image Data Size 1,036,800 4,665,600 6,220,800

39–46 Resolution Parameters 0 0 0

47–54 Color Palette Parameters 0 0 0

Table 2A summary of the header information in the extracted BMP files from the

Sony camcorder.

Using a f ile comparison program, the exported BMP f ile sets from each of the 18 trimmed recordings were analyzed to determine whether any of the images were identical to any other images within a particular recording. This software first analyzed the extracted BMP files to compute a unique numeri-cal representation (totaling 256 bits), which is often referred to as a hash value, for each file’s contents [1]. The program then compared all of the separate hash values to one another and provided a listing of any files with identical values, indicating that the files were duplicates.


The process of hashing files is a widely accepted practice not only in the computer forensics field, but also in examinations of f ile-based, digital video and audio recordings [1, 9–14]. For a hash process using a 256-bit value, as was the case with the file comparison program used here, there are 2256 or approximately 1.18 x 1077 possible hash values. Taking into account the number of files compared or hash values computed (k), the probability (P) that two nonidentical files will result in identical hash values of n size is calculated as follows [9]:

Generally, as the number of bits comprising the hash value increases and the number of files being compared decreases, the probability that nonidentical f iles will falsely be attributed as being identical (referred to as a “collision”) drops significantly [9]. As an example of the robustness of the hashing process, the 256-bit hash value of one of the extracted BMP image files from the SD HQ was computed as

(hexadecimal notation). Then, the blue color value of a single pixel was changed from 61 to 60, which resulted in a 256-bit hash value of

This example ref lects that the smallest possible modification (one bit) within an image file resulted in a completely different hash value.

Digital Data Analyses to Identify Nearly Identical Digital Video Frames

In some digital video authenticity examinations, slight differ-ences between images can be important. Examples include when two frames are identical except for differing embedded text information or when slight changes are produced between known identical images because of an added compression step, possibly ref lecting a transcoding or editing process. Such images will not be identified using the file hashing and comparison method above, because the slight variances in the images will produce different hash values.

CAA5E70502B29E62D3882DFA7B2D4F4A071FBC95A6244645B4B124D05EBFD413

9E43ADB1A43A6AF1989BE1EC239A5F29909C8F4E7E0C7EC0964E8AD4ED051029.


One direct way to identify differences is to use a digital data analysis program that performs a bit-for-bit comparison between the selected uncompressed images. These software programs highlight all of the byte value differences between the f iles, allowing for the identification of specific pixels and their exact color or gray scale differences through an understanding of the BMP file format. However, if there are a large number of pixel differences that need to be reviewed, the process of translat-ing the digital data to pixel locations and color changes can be quite time-consuming. Figure 2 is an example of a data analysis comparison, in hexadecimal notation, of the 106th through 190th pixels in the bottom-most rows of two consecutive images from the SD LP mosaic test recording. The separate image portions are in a vertically stacked arrangement with identical bytes having a white background and different-valued bytes having a black background.

Figure 2Byte-value differences (with black background) for the same portion of consecutive images from the SD LP mosaic test recording using X-Ways

Forensics (X-Ways Software Technology AG, Cologne, Germany).


Another technique is to use a Photoshop routine to visually identify and compare the pixels that are different [15]. This method readily identifies the pixels that vary between the images and their relative differences; however, it does not directly specify the individual bytes that differ. Using Photoshop CS3 Extended and CS5 Extended (the CS4 version was not evalu-ated), the procedure is as follows:

1. The two video frames that are to be compared must be in the same noncompressed image format, including identical pixel dimensions, color profile, and so on.

2. In Photoshop, open copies of the two images to be compared. Select “Window” on the menu bar, then “Arrange ►”, and then either “Tile Horizontally” or “Tile Vertically” (“Tile” in CS5 Extended), as appro-priate for the images’ dimensions. This will allow both images to be seen simultaneously on the computer screen.

3. Place a duplicate layer of one of the images into the Layer palette of the other. This can be done in at least four different ways, after selecting one of the images (the “first”):a. Lef t click “Layer” on the menu bar, and then

“Duplicate Layer...”. Type in a new name for the layer, such as the name of the first f ile, change the destination document to the second image, and then click “OK”.

b. In the Layer palette of the first image, right click the “Background” layer and select “Duplicate Layer...”. Type in a new name for the layer, such as the name of the f irst f ile, change the destination document to the second image, and then click “OK”.

c. In the Layer palette of the first image, left click the “Background” layer and drag and drop it onto the second image.

d. Press the <Ctrl> and “A” keys to select the entire first image, hold down the Shift key, left click on the first image, and then drag and drop it onto the second image.

4. In the Layer palette of the two-layer image, select the non-“Background” layer, set Opacity and Fill controls at 100%, and the Blending Mode to “Difference” (from the drop down menu). The “Difference” blending


mode subtracts one layer from the other, on a pixel-by-pixel basis for each of the colors in the profile, and then combines them for the final result. The ordering of the layers does not affect the result because the absolute values of the differences are used. A resultant pixel that is a black “0” means the two corresponding pixels of the two images were identical. If the pixels are different, the result will be a color pixel (grayscale for black and white images) [16].

5. Combine the two layers by selecting “Layer” in the menu bar and then “Flatten Image”.

6. On the menu bar select “View” and then “Actual Pixels”. When the images are identical, all of the pixels will be black. If the images are not identical, there will be colored pixels (or grayscale for black and white images) showing all the areas in the image with differences.

7. If it is not visually obvious whether all of the pixels in the image are totally black, the following three proce-dures can be utilized:a. Using the “Histogram” palette, select its menu using

the upper right corner icon, and choose both “Show Statistics” and “Expanded View”. Select “Entire Image” as the source in the main histogram palette. If the Cache Level is not “1”, left click the Uncached Refresh button ( just above the upper right corner of the histogram). The number of “Pixels:” should now equal the total number of pixels in the displayed image. In succession choose red, green, and blue as the “Channel:” source and place the mouse pointer in the far left end of each histogram so that the “Level:” reads “0”; if all the pixels in the image are of value “0”, then the “Count:” number will be identical with the “Pixels:” number for each color.

b. Select “Image” on the menu bar, then “Adjustments” and finally “Levels”. In “Levels”, view the histo-gram to determine whether there are any obvious values above “0” (total black); if not, adjust the highlights slider to a low value such as “10”, which should visualize most of the pixels that are not totally black.


c. Select “Image” on the menu bar, then “Adjustments”, and finally “Threshold”. The f lattened image will be conver ted to a “two-value” black and white image, with an adjustable crossover point for which pixels will display as black or white. By moving the slider to a “Threshold Level” setting of “1”, only those pixels that contained a difference of one or greater in any of the RGB values (indicating a difference in the pixels between the two images) will become pure white. Those pixels that were pure black in the f lattened image (indicating identical pixels between the two images) will remain black.

Figure 3 i l lust rates the Photoshop rout ine using the “Threshold” adjustment method for the production of a differ-ent image for two generated source images.

Figure 4 displays the Photoshop routine, again using the “Threshold” adjustment method, for the same consecutive images utilized (in part) for Figure 2.

Results and DiscussionIn answer to the first question – does a specific, commonly

available, consumer-quality camcorder produce any identical images with a static visual view in standard and high defini-tion modes? – the answer is yes for the tested Sony Handycam HDR-CX100, but only using the static blank wall view and when recording in the two lowest-quality HD modes (Table 3).

In answer to the second question – are there accurate method-ologies for determining whether two recorded digital images are identical? – the answer is yes. The hashing and compari-son software accurately identified the duplicate images within the test recordings, using a 256-bit hashing process, and then provided a detailed listing of the f indings. A review of these duplicate frames revealed that all occurred in pairs of consecu-tive frames, always separated by multiples of 30 frames (Table 4 lists the 36 pairs and the number of frames between them for the three-minute HD SP recording of the wall view). There were no sets of identical frames that were not adjoining or that contained more than two images in a sequence.


Figure 3Pixel difference analysis of two generated images using layering,

difference blending, and threshold adjustment in Photoshop CS5 Extended.

Figure 4Pixel difference analysis of two consecutive images from the SD LP

mosaic test recording using layering, difference blending, and threshold adjustment in Photoshop CS5 Extended.


Mode Trimmed Length View Frames Actual Bit

Rate Duplication Results

SD LP 3 Minutes Mosaic 5395 2.963 Mbps No duplicate frames

SD SP 3 Minutes Mosaic 5395 5.385 Mbps No duplicate framesSD HQ 3 Minutes Mosaic 5395 9.253 Mbps No duplicate framesHD LP 3 Minutes Mosaic 5395 4.569 Mbps No duplicate framesHD SP 3 Minutes Mosaic 5395 5.981 Mbps No duplicate frames

HD HQ 3 Minutes Mosaic 5395 10.831 Mbps No duplicate frames

HD FH 3 Minutes Mosaic 5395 17.073 Mbps No duplicate frames

SD LP 3 Minutes Wall 5395 2.476 Mbps No duplicate framesSD SP 3 Minutes Wall 5395 4.901 Mbps No duplicate framesSD HQ 3 Minutes Wall 5395 8.474 Mbps No duplicate frames

HD LP 3 Minutes Wall 5395 4.459 Mbps 248 duplicate frames (124 pairs)

HD SP 3 Minutes Wall 5395 6.544 Mbps 72 duplicate frames (36 pairs)

HD HQ 3 Minutes Wall 5395 7.509 Mbps No duplicate frames

HD FH 3 Minutes Wall 5395 17.084 Mbps No duplicate frames

HD LP 10 Minutes Wall 17,983 4.453 Mbps 992 duplicate frames (496 pairs)

HD SP 10 Minutes Wall 17,983 6.837 Mbps 116 duplicate frames (58 pairs)

HD HQ 10 Minutes Wall 17,983 6.611 Mbps No duplicate frames

HD FH 10 Minutes Wall 17,983 17.114 Mbps No duplicate frames

Table 3List of the trimmed test recordings with their corresponding total number of

frames and the number of duplicated frames.


Pair # Duplicate Pair (frame #s)

Relative offset from previous

pair (# of frames)1 0061 / 0062 -2 0361 / 0362 3003 0571 / 0572 2104 0751 / 0752 1805 0811 / 0812 606 1021 / 1022 2107 1081 / 1082 608 1141 / 1142 609 1351 / 1352 21010 1411 / 1412 6011 1471 / 1472 6012 1651 / 1652 18013 1771 / 1772 12014 1981 / 1982 21015 2131 / 2132 15016 2221 / 2222 9017 2881 / 2882 66018 2911 / 2912 3019 3421 / 3422 51020 3481 / 3482 6021 3511 / 3512 3022 3541 / 3542 3023 3721 / 3722 18024 3781 / 3782 6025 3811 / 3812 3026 3841 / 3842 3027 3871 / 3872 3028 3961 / 3962 9029 4081 / 4082 12030 4231 / 4232 15031 4441 / 4442 21032 4561 / 4562 12033 4591 / 4592 3034 4621 / 4622 3035 4771 / 4772 15036 4921 / 4922 150

Table 4List of the 36 duplicate frame pairs found in the three-minute HD SP test recording of the wall view and the number of frames between each pair.


Based on the number of images compared in the test sets and the program’s use of a 256-bit hash value, the probabilities (based on the previously listed formula) that collisions occurred are approximately 1.26 x 10-70 for 5395 images and 1.40 x 10-69 for 17,983 images. These probabilities are infinitesimally small, due mostly to the large hash value (2256). As a real world example, even a 12-hour video recording at 29.97 frames per second (producing a total of 1,294,704 images) would have a collision probability of only 7.24 x 10-66.

In answer to the third question – what digital analysis proce-dures are available for comparing two nearly identical images? – there are two different techniques that provide the same information, but in different formats. The first uses digital data analysis software to identify all of the different byte values between the two images, allowing for the identif ication of the specif ic pixels and their exact color or gray scale differences through an understanding of the uncompressed image f ile format. The second uses Photoshop software routines to visually identify and compare the pixels that are different. Details of both of these techniques have been set forth previously in this article.

Conclusions and RecommendationsBased on this research and routines, the following conclu-

sions and recommendations are set forth by the authors:A viable hash methodology was identif ied to determine

whether there are any identical images within digital video recordings. The only practical limitations are (1) the ability of the specific nonlinear, digital video editing system being used by an examiner to import a particular recording in its native format (with no transcoding) and (2) sufficient computer storage space for the exported image files. With regard to the latter, the separate BMP images from a one-hour HD FH recording would, for example, total about 670 gigabytes. Because such an exami-nation would provide valuable information to an examiner, it is highly recommended that, whenever possible, this analysis step be included in the authenticity protocol when a complete video authenticity analysis is conducted of a digital recording.

If identical images are identified, an examiner should utilize the information to help determine whether this occurred because of editing (e.g., a copy and insert or overlay process), an irregu-larity of a specific camcorder or recording device, identically


captured and processed views (as found for certain recording modes on the tested Sony Handycam HDR-CX100), or for some other reason.

There are digital data analysis and Photoshop routines that can accurately reveal the differing bytes and pixels between two images. These procedures allow an examiner to determine when two frames are identical except for differing embedded text information, compression artifacts, or when slight changes are produced between known identical images due to an added compression step, possibly ref lecting duplication, editing, or t ranscoding processes. Therefore, whenever possible, these procedures should be followed to identify nearly identical images within the data stream of the video recording under examination.

Based on this research, the authors have shown that a consumer camcorder can produce identical pairs of frames in an unaltered recording, and the authors have provided proto-cols to identify identical and nearly identical video frames. Examinations involving digital video authenticity can use this information and the procedures set for th previously, along with other recognized scientific steps, to accurately determine whether a submitted file is original, continuous, or unaltered.

AcknowledgmentsThe authors would like to thank the following individuals who

reviewed this paper prior to submission and provided important technical and grammatical improvements: Suzana Galić Price (BEK TEK LLC, Clif ton, VA); John Brunetti (Connecticut State Police Forensic Laboratory, Meriden, CT); Jason Ferridge (Victor ia Police Forensic Services Depar tment, Victor ia, Australia); Carl Kriigel (U.S. Army Crime Laboratory, Forest Park, GA); and Joel Zlotnick (Homeland Security Investigations, U.S. Immigration and Customs Enforcement, McLean, VA).

For further information, please contact:Bruce E. Koenig and Douglas S. LaceyBEK TEK LLC12115 Sangsters CourtClifton, VA USA 20124-1947(703) [email protected]


References1. Koenig, B. E.; Lacey, D. S. Forensic Authentication of Digital

Audio Recordings. J. Audio Eng. Soc. 2009, 57 (9), 662–695.2. Koenig, B. E.; Lacey, D. S. An Inconclusive Digital Audio

Authenticity Examination: A Unique Case. J. For. Sci. 2012, 57 (1), 239–245.

3. Weise, M.; Weynand, D. How Video Works, 2nd ed.; Focal Press: Amsterdam, 2007; pp 164–176, 253–254.

4. Watkinson, J. The Art of Digital Video, 4th ed.; Focal Press: Amsterdam, 2008; pp 276– 277, 317–396.

5. Lacey, D. S.; Koenig, B. E. Identif ication of Identical and Nearly Identical Frames from a Lawmate PV-500 Digital Video-Audio Recorder. J. For. Ident. 2012, 62 (1), 36–46.

6. Jack, K. Video Demystif ied: A Handbook for the Digital Engineer, 5th ed.; Newnes: Amsterdam, 2007; pp 257–387, 578–763.

7. Shi, Y. Q.; Sun, H. Image and Video Compression for Multimedia Engineering: Fundamentals, Algorithms, and Standards, 2nd ed.; CRC Press: Boca Raton, FL, 2008; pp 345–528.

8. Microsoft Corporation. Bitmap Header Types-Developer Net work . ht t p: //msd n.mic rosof t .com /en-us / l ib ra r y/dd183386%28v=VS.85%29.aspx (accessed January 2012).

9. Swenson, C. Modern Cryptanalysis: Techniques for Advanced Code Breaking; Wiley Publishing, Inc.: Indianapolis, IN, 2008; pp 32–38.

10. Koenig, B. E.; Lacey, D. S.; Kil l ion, S. A. Forensic Enhancement of Digital Audio Recordings. J. Audio Eng. Soc. 2007, 55 (5), 352–371.

11. SWGDE. SWGDE Data Integrity Within Computer Forensics (ver. 1.0). http://www.swgde.org. pp 2–3 (accessed January 2012).

12. SWGDE; SWGIT. SWGDE and SWGIT Digital & Multimedia Evidence Glossary (Version 2.4). http://www.swgde.org (accessed January 2012).

13. Marcella, A. J. Jr. Cyber Forensics: A Field Manual for Collecting, Examining, and Preserving Evidence of Computer Crimes, 2nd ed.; Auerbach Publishing: Boca Raton, FL, 2008; pp 56–57.

14. Caloyannides, M. A. Computer Forensics and Privacy; Artech House: Boston, MA, 2001; pp 172–174.

15. Brunetti, J. Analyzing Pre- and Post-Event Surveillance Video Frames. J. For. Ident. 2007, 57 (3), 338–347.

16. Doyle, M.; Meek, S. Photoshop CS3 Layers Bible; Wiley Publishing, Inc.: Indianapolis, IN, 2008; pp 283–284, 302–303.

video frame comparisons in digital video authenticity … · preparation of camcorder test samples...

Documents