Video evidence integrity

Integrity checks ask whether the file has changed relative to a documented earlier copy. A cryptographic hash is a calculated value derived from the file. Comparing that value after a transfer helps check whether the copied bytes match. Record the algorithm, value, file identity, date and person performing the check.

That comparison has a starting point. If you first calculate a hash after receiving a forwarded clip, it cannot tell you whether someone trimmed the clip before sending it. You have documented the file you received, rather than established its complete history.

Authentication addresses the account being made about the recording. Was this file produced by the claimed device? Is it a camera original or a later export? Does the file contain changes inconsistent with its described history? Those are different questions, and they may require different examinations.

SWGDE's digital video authentication guidance, version 1.2, also distinguishes an original file from a truthful scene: a camera can record a staged event. File analysis alone cannot settle everything the pictures appear to show.

Ask the owner or authorized custodian for the native export from the recording system. Keep its original folder structure and accompanying metadata or index files. Obtain the manufacturer’s player or codec through a trusted source when it is required for playback. Keep a compatible viewing copy alongside the native material when available.

SWGDE's DVR acquisition guidance, version 1.4, prioritizes native or proprietary data because it is closest to the manner of recording. It also recommends reviewing the relevant cameras and time periods after export. A file being present on a USB drive does not establish that the correct incident was copied or that it plays correctly.

NIST describes conversion as a source of image-quality and metadata loss in CCTV exchange. A phone recording of a monitor adds another capture process. Retain an existing screen recording if it is all you have, but identify it as such and seek the underlying export where possible.

When several versions exist, keep each version and describe how you obtained it. Avoid repeatedly opening and saving the only copy in an editor. Our evidence preservation guide explains the broader handling record.

Keep a short acquisition record with the file:

• Who supplied it and when you received it.
• The recording device or system, if known, and the relevant camera or channel.
• The requested period and the period actually obtained.
• Whether it came from a native export, a cloud download, a messaging app, an editing application or a screen recording.
• Associated filenames, export settings, player requirements and available logs.
• Any known processing, conversion or transfer before receipt.

For CCTV, document the recorder's displayed time against a reliable time source, including the date, time zone and any observed discrepancy. SWGDE advises documenting the difference without changing the recorder's clock during acquisition. The UK Home Office retrieval guidance similarly treats the clock check and contemporaneous notes as part of the audit trail; its police procedures are a technical reference here, not a statement of U.S. legal requirements.

For cloud material, keep download notices, relevant account or clip identifiers and the available receipt history. SWGDE's cloud-acquisition guidance notes that shared links may expire and that service-provider material can contain additional information. Obtain access and preservation assistance through the appropriate authorized person. Do not assume that the camera itself stores another copy.

A qualified examiner begins with the question, rather than applying every available filter. SWGDE describes several complementary evidence classes:

Container and structure. The file format and its internal organization can help assess encoding history or consistency with a claimed recording system.

Metadata. Dates, device information, software identifiers and technical attributes may contribute to the assessment. They can also be altered or interpreted differently by tools. A date field on its own is not a reliable verdict.

Video and audio content. Examination may consider frame sequences, local image changes, compression behavior, audio continuity and the relationship between streams. A visible irregularity is an observation to explain, not automatically proof of deliberate manipulation.

Reference recordings. A suitable sample from the claimed device or a comparable recording process may help test an explanation. The examiner needs to consider the relevant settings and export route when choosing that sample.

SWGDE's canvassing guidance explains why the transfer route matters: messaging, sharing and export choices can affect the acquired file. Describe that route even when the clip looks unchanged. Claims made by an automated detector also need evaluation in the context of the submitted file and the method used. One detector output should not be treated as a complete authentication examination.

Separate the time displayed in the picture from the player's elapsed-time counter and the timing information used to present frames. They describe different things.

A recorder clock may be wrong while the received file remains unchanged. A player may interpret a proprietary file differently from the native application. Variable frame durations can also make an average frame-rate label insufficient for precise timing. SWGDE's core timing concepts and frame-timing guidance explain these distinctions.

If you notice a jump, repeated picture or sound-and-picture mismatch, record where it occurs and which player you used. Preserve the full source and make the observation available to the examiner. Avoid assigning a missing interval or declaring an edit from a screen recording alone.

Frame-timing analysis has format-specific limits. SWGDE's ISO base media guidance, version 1.1, excludes transcoded and screen-captured files from its intended analysis workflow. A specialist may need a better export, a validated decoding method or a suitable reference recording before reaching a timing conclusion.

Brightness adjustments, stabilization, redaction and format conversion can serve legitimate viewing or disclosure needs. Preserve their relationship to the source rather than presenting them as untouched originals.

Create these versions from a working copy. Give each output a distinct filename and record the software, relevant settings, sequence of operations and purpose. Check the exported result, including the start and end, duration, audio, picture proportions and any redacted regions. Retain the source and the processing record.

SWGDE's digital forensic video analysis guidance, version 2.0, calls for documented processing on working copies and disclosure of input/output discrepancies. Its redaction guidance, version 2.3, also emphasizes reviewing the exported result and retaining the original material and project records under the applicable policy.

For picture clarification, see security-camera footage enhancement. Restoration, authentication and identification are separate scopes. Confirm the examiner's capability, deliverables and timing before commissioning an authenticity examination; this guide does not establish that Media Medic offers every technique described.

Describe the issue in neutral terms: “The picture jumps at this point; can the available source establish why?” is more useful than instructing someone to prove that the recording was edited.

Ask which files and reference material are needed, what question the proposed methods can answer and what remains outside scope. Request an explanation of significant observations, conflicting findings and limitations. SWGDE's authentication guidance allows conclusions consistent with an original, inconsistent with an original or inconclusive, according to the examination. A report should explain the basis and strength of its opinion, with independent technical review.

If you also need audio authenticity examined, say so explicitly. The audio stream needs its own consideration; a video conclusion does not automatically cover it. Our audio authentication guide explains that separate question.

This guide compares published SWGDE practices with NIST's CCTV exchange work and UK Home Office retrieval guidance. It explains distinctions in preservation, acquisition, file examination and processing records. No submitted recording was tested, no detector was benchmarked and no legal outcome was assessed. The UK guidance informs the technical handling discussion without being applied as a U.S. legal rule. Actual examination methods depend on the file, recording system, question and qualified examiner.

Keep the best source available, preserve its history and write down the question you need answered. That gives an examiner a firmer basis for deciding which tests are useful and where a conclusion would remain limited.