Wednesday, July 10, 2019

What is "official training?"

Years ago, sitting in LEVA's old class, Forensic Video Analysis and the Law, Grant Fredericks stood at the front of the class room and delivered a module on the use of Photoshop to a room full of civil servants. To the best of my knowledge, Grant is not, nor has he ever been, an Adobe Certified Expert (ACE) in Photoshop. Very few forensic video analysts are ACEs as we only utilize about 1/3 of what Photoshop can do, and the ACE test is comprehensive. Thus, the ACE isn't necessarily a good metric or barometer of a forensic video analyst's grasp of Photoshop.

Years later, sitting in another LEVA facilitated class, George Reis and Casey Caudle presented a deeper dive into Photoshop. George might be / have been an ACE, but Casey wasn't.

I have presented countless Photoshop training classes and have written a book on Photoshop for forensic analysts.

None of this was ever "official" Adobe activity. Even when I presented two days of Photoshop training in the main training room at Adobe in San Jose, it wasn't "official" Adobe training. It was Adobe being nice and gracious in their sponsorship of NaTIA, under whose banner I was teaching.

Has a lack of "official" Adobe training every been a problem for you in your testimonial experience? I've been asked about my training. I've listed it on my CV. Syllabus files are available for the courses I teach. But, case law can't be found where an analyst was excused due their having been trained in Photoshop, but not during an "official" Adobe training event.

Professional photographers and digital artists know the name, Scott Kelby. Scott has an amazing record of training photographers and artists in the intricacies of Photoshop and the various Adobe tools. He's assembled the best and brightest to his brand, offering amazing value. Prior to Beckley in California, I was a member his National Association of Photoshop Professionals. NAPP is not an "official" Adobe endeavour. It's a group of likeminded individuals, supported by Adobe. But it's Kelby's thing, not Adobe's.

Elsewhere in our tool set, countless analysts have sat through Larry Compton's FOSS tool lectures and courses. With FOSS tools, there's really no possibility of an "official" training. If you use the popular ffmpeg, did you travel to France to get training from the originators of the tool? Likely not. You may have read a bit on the net, browsed the wiki, reached out to someone like Larry for advice, then hit the command line with gusto. Are your results invalid because Larry isn't authorized to deliver training on his basket of  tools? Validity isn't a function of the "officialness" of the instruction you've received.

In the period between 2012 and early 2019, I was in the employ of Amped Software, Inc. I delivered training on Amped's product line in the US, Canada, and South Africa. I went on site to teach a single agency's staff. I hosted courses in our offices with a mix of people from over 40 countries. The curriculum that I delivered was (and still is) informed by the context in which the courses were presented.

I'm in a unique position, being a trained (CA POST) and educated (WGU MEdID) curriculum designer. The focus of my training sessions has always been "tool-assisted training to competency," as defined by the ASTM and informed by my years of experience in law enforcement. I've focused on the discipline, which is enabled by a toolset. In this way, the only real change from Photoshop to any other tool was the platform. In my Introduction to Forensic Multimedia Analysis courses, the tool is incidental to the delivery of knowledge around the standards, practices, laws, and procedures. Sure, certain platforms make the job easier. In teaching a toolset, like Photoshop or FIVE, I always frame the curriculum around standards compliance and best practices - and present the tool-specific portions after the foundation has been set.

I've written about the new freedom that I'm enjoying now that Amped have retreated to their mail box in Brooklyn. The plethora of classes now on my calendar are not "new." The curriculum development was done years ago. I've wanted to offer these for quite some time to the general market. I have presented them to select US federal service staff on several occasions - causing problems in the process. You see, I was not "allowed" to do so by Amped. Their thinking was simple, I was the only one offering these classes. It would cause a business problem for them if their customers in Russia, for example, wanted to take the courses given that I, as a US citizen, would not be able to deliver them. Amped, having been founded in the epicenter of Italian Marxism, wanted a standard offering at a standard price. Amped, being an Italian company, is free to offer it's products and services to agencies in countries prohibited to US based businesses, like Russia.

If you want to pay a premium to receive your information from a person with an "" email address, please do so with my blessing. If you want real-world guidance, training to competency, and an emphasis on science and standards, designed and delivered by someone who has been there and is still doing that, I'd love to see you in one of my classes. You can find our training calendar here.

Until then, have a great day my friends.

Tuesday, July 9, 2019

FRE Rule 26 asks, where are your notes?

Remember your math teacher demanding that you "show your work." Forensic science is no different. We want to see your process, your thoughts, your notes ...

"The law, however, expects expert witnesses to write reports for the court, outlining their opinions on the matters about which they are testifying. In the eyes of the law, the expert's testimony is allowed by the court only to the extent that the expert adequately documents the basis for it in a report and makes it available to the opposing party before the trial." - from A Guide to Forensic Testimony: The Art and Practice of Presenting Testimony As An Expert Technical Witness (link).

The key to understanding how the legal process requires you to document your opinions lies in FRE Rule 26.

(2) Disclosure of Expert Testimony.
In addition to the disclosures required by paragraph (1), a party shall disclose to other parties the identity of any person who may be used at trial to present evidence under Rules 702, 703, or 705 of the Federal Rules of Evidence.

Except as otherwise stipulated or directed by the court, this disclosure shall, with respect to a witness who is retained or specially employed to provide expert testimony in the case or whose duties as an employee of the party regularly involve giving expert testimony, be accompanied by a written report prepared and signed by the witness. The report shall contain a complete statement of all opinions to be expressed and the basis and reasons therefore; the data or other information considered by the witness in forming the opinions; any exhibits to be used as a summary of or support for the opinions; the qualifications of the witness, including a list of all publications authored by the witness within the preceding ten years; the compensation to be paid for the study and testimony; and a listing of any other cases in which the witness has testified as an expert at trial or by deposition within the preceding four years.

These disclosures shall be made at the times and in the sequence directed by the court. In the absence of other directions from the court or stipulation by the parties, the disclosures shall be made at least 90 days before the trial date or the date the case is to be ready for trial or, if the evidence is intended solely to contradict or rebut evidence on the same subject matter identified by another party under paragraph (2)(B), within 30 days after the disclosure made by the other party. The parties shall supplement these disclosures when required under subdivision (e)(1).

You see the emphasis made on turning over everything in discovery. Notes, reports, and your complete CV. In the world of e-discovery ... this also means notes and reports generated by the programs that we use - if any are created.This means the History Log, in Photoshop or Amped FIVE, is more than likely discoverable. It's a record of the steps the software has taken (at your direction) on an image or series of images, video, or ...

Bottom line, take good notes. If you'd like to know more about taking good notes, standards compliance, and other foundational aspects of forensic video analysis, check out our on-line course Introduction to Forensic Multimedia Analysis.

Monday, July 8, 2019

New Course Announcement

Today marks the beginning of a new era in our training business. I'm happy to announce that Introduction to Forensic Multimedia Analysis is now available on-line as micro learning.

What is Introduction to Forensic Multimedia Analysis? What does it cover?

This class serves as the entry point for those analysts involved in forensic image and video analysis, aka Forensic Multimedia Analysis. It features a detailed overview of the technological, legal, and personnel aspects of working with multimedia evidence in a forensic science setting. Graduates will acquire an introductory level education in the knowledge necessary to evaluate and analyze multimedia evidence in a forensic science setting. With an emphasis on standards compliance, students will also learn the best practices of reporting, packaging, delivering, and presenting their findings and evidence in the criminal / civil court context.

The curriculum is presented with strong emphasis on the work flow required to process this unique type of evidence. Beginning with the end in mind, each example is presented and students learn from the standpoint of an eventual testimonial experience.

In focusing on fundamental knowledge, the information in this course is not specific to any analysis platform or software solution.

Yes. That's right. Regardless of the tools you use, this class can help contextualize the work. It fills in the gaps that often happen with tool-specific training courses.

You've learned which buttons to press. You've learned how the tools work. Now learn the standards and the science behind the discipline. This knowledge - being able to answer "why" type questions, is essential on your career path as an analyst.

As an example, from the course's content, do you know the fundamental difference between the HSL and HSB colour spaces? HSL was designed to closely align with the way human vision perceives colour-making attributes. HSB was designed as a way to try to describe colour more intuitively than with RGB numbers. This level of detail will help you understand the tools that you use at a deeper level, as well as help flavour your testimony - proving plain meaning to industry jargon.

In the next few months, we'll be rolling out other courses in our online portal ... starting with Introduction to Image Authentication. Then, we'll bring out our offerings around the Amped and Adobe tools, followed by deep dives into some of the more popular freeware tools, like ffmpeg.

Here's why:

Many who have been given the task to work on this incredibly valuable evidence type live in states that restrict travel. Others work in cities, counties, and states with budget problems. Traveling to training thus becomes a problem. For every dollar spent on training, two or more dollars must be spent on logistics. That formula isn't sustainable.

Often times, analysts in small towns are disadvantaged as they lack the funds to travel and they lack the population density to attract a training company to their location. Additionally, many municipalities have strict rules prohibiting private companies from profiting off of government resources (no more trading seats for space). Some training companies have thresholds of attendance that must be met in order to hold the training. Signing up, only to have the class cancelled a few weeks out, can cause chaos with your training office.

Another issue that our learning portal solves is the disparity between public and private labs in terms of training opportunities. The majority of training classes are held at government / law enforcement facilities and restricted to those types of employees.  Thus, how are those in private practice supposed to train? With us, they can. Everyone can. Remember, there really are no "sides" in science. We all serve the Trier of Fact in interpreting, analyzing, and explaining the issues around this vital type of evidence.

We've worked hard to check all of the boxes in delivering these offerings to you:

  • Affordable
  • Convenient
  • Relevant
  • Feature Packed
Our introductory education courses are priced below $500. This means that approvals will be easier. This means that you can likely justify the expense and use your purchase card to sign up for classes. Also, given the nature of on-line micro learning, this course is priced to be affordable wherever in the world you happen to be.

Yes, we've designed the course with the world in mind. So many courses are designed with a specific country's context informing the development. We've blended relevant standards and procedural information from Australia, Canada, India, Europe, New Zealand, South Africa, the United Kingdon, and the US ... as well as international standards from the ASTM the world wide working groups.

Having a world wide context, and a platform available on all major device types (even iOS and Android), makes this course ... and all of our courses ... incredibly convenient.

As for relevance, we're filling in the gaps and providing context to what you may already know. We're diving deeper than you've likely gone before. We're setting the scientific foundation for the work. Given that forensic science is the systematic and coherent study of traces to address questions of authentication, identification, classification, reconstruction, and evaluation for a legal context, this course presents the system and leads the way to a coherent study of traces to address the questions that come up in your inquiries. It will provide valuable information and knowledge that will help you make sense of the tools and processes used in this complex discipline.

The course is presented as a 16 hour experience - meaning this course would normally fill two full days of instruction. But, with the use of interactive text, you can dive as deep into topics as you desire. If you dive deep on all topics in the course, this course expands to beyond 40 traditional classroom hours of instruction. As a self-directed learner, the choice is yours.

The beauty of micro learning is that you learn at your own pace and on your own schedule. All too often, the "death by Powerpoint" section of class puts students to sleep. In sleeping through the lessons, they miss vital information. Micro learning lets you explore topics in depth, or in small bites, as your schedule and energy level permits. Once enrolled, you have 60 days to complete the course.

I invite you to examine the syllabus for this course. Then, please click over to the web site and sign up. I look forward to seeing you in class.

Tuesday, July 2, 2019

Yep! They Did It Again.

I've been teaching classes on multimedia analysis for a while now. Almost a decade ago, I created a curriculum and began teaching classes for Amped Software, Inc. in the US and elsewhere. One of the things I made sure to focus on was the specific use case for my students. If I was in Georgia, I would focus on Georgia law. Likewise for Ontario Provence or South Africa.

In taking a walk through the program, I would point out the Program Options within FIVE (View>Program Options), and we'd spend the better part of the morning going over each setting and it's implications for the analyst's work.

What took the most time to explain was the Log Files option. By default, Amped SRL's FIVE creates a log file that records every step from the moment you launch the program to the time you shut it down. It has since Build 4376, as I noted in this old post from 2012.

Amped SRL's Marco Fontani explains, in this recent blog post, what a wonderful thing the log files are - in his opinion. It's important to remember that Marco is in Italy, where the rules and laws are quite different from elsewhere in the world.

What is a log file? What's in it? Marco explains:

We open the file and find an impressive amount of information. The file begins with the product info: release number and build date, info about the computer and operating system, info about installed applications that may influence report creation (Microsoft Word in this case). Then, we have a full history log of every move we made while using Amped FIVE: which filter we added, how we configured (and possibly re-configured) it, which filter we deleted, and so on.

Wait. What?

You read that right. In case you missed my 2012 blog post, everything about your operating environment. Every single step. The time each step was performed. Everything. Recorded.

Did you know that FIVE was doing that?

If you have been to one of my classes, you do. If you're a long time reader of this blog, you do. I'm the one that told you to turn off this feature and only activate it under one of two very specific situations.

  1. If you were having an issues with FIVE and you were specifically told by an Amped Software, Inc, employee to activate it in order to step through the problem.
  2. Outside of troubleshooting - if you have specific permission from your chain of command to generate / create this type of potentially exculpatory information for your case work
If you received a discovery request for any / all files related to the case in which you were a part, and you didn't disclose this information (that you didn't know existed). Once created, they have to be saved with the case. Please don't delete potentially exculpatory or other case related info unless specifically directed to by your chain of command (or by statute). This isn't legal advice as such, it's just my experience as an analyst in government service who also served as a Union Rep & Shop Steward.

The other little Jack-in-the-Box to Marco's post, the one he hints at but doesn't say explicitly, is that the log is a record of everything from Open of FIVE to Close. Why would that be important?

If you've been in my classes, you'll remember me saying (rather regularly) to shut down FIVE after processing your case and restart it to begin a new case. Yes. I told you about the log files. But, just in case you forgot later, and FIVE resets itself or you move to a different computer, I wanted to get you in the habit of refreshing FIVE between cases. Why?

Because if the log is a record of everything done, every step accepted or rejected, from Open of FIVE to Close, AND don't shut FIVE down between cases, you've just mixed cases on the same log file.

Yes, you did that and you didn't know it.  

Now, each case gets the record of what you did on the other case(s). Did you just work 30 cases without closing FIVE. Surprise, all 30 cases are on the same log file. All 30 cases' attorneys get to know what you did or didn't do on the other cases. Can you imagine the cross examination nightmare?

In case you're wondering what this might look like, here's a peek from 2009 - FRE Rule 26 and the History Log.

Before you say it, I'm not suggesting you hide anything. What I am saying is that you should, you must, seek your chain of command's counsel before activating that feature. When I did, I was told very frankly to shut it off. You see, at the LAPD, someone of my rank/pay grade did not have permission to create a new "form," which is essentially what the log file is.

Friday, June 28, 2019

Junk Science?

Great news from Texas has brought out a bunch of people with conflicting agendas. The great news? The George Powell case has moved to retrial after the Texas Court of Criminal Appeals vacated the conviction and ordered a new trial.

Whilst the media buzzes about the evidence used in the original trial, and throws "junk science" in the same sentence as "forensic video analysis," most in the media commit journalistic misconduct in their reporting of the case and the circumstances around the re-trial.

Take this article (link) for instance, "George Powell has maintained his innocence the entire time he's been behind bars. Now, he will have a chance to prove it."


In vacating the conviction, George Powell's status has returned to Innocent as the "proof" of his guilt has been vacated or struck down. Powell, under US law, is innocent until proven guilty in a court of law. As a presumed innocent man, he should be afforded the opportunity to make bail and to prepare for his defense.

When the trial begins, it's for the prosecution to offer the evidence that links Powell to the crime, if such evidence exists. It perverts the course of justice to require Powell to prove his innocence. Why? Not only is it the way our system works, innocent until proven guilty, but it's impossible to prove a negative.

Thus, when the trial begins, it's not "forensic science" that will be on trial. It's not "forensic video analysis" that will be on trial. What will be on trial is the evidence, offered up as proof of some condition. Then, it's up to the Trier of Fact to evaluate that evidence.

Forensic science and forensic video analysis are scientific, when performed scientifically by educated, trained, and proficient practitioners utilizing valid tools and an appropriate and valid methodology.

As regards Photogrammetry specifically, a measurement shouldn't be used to "identify" an object or a subject. Rare is the case that there is nominal resolution in the evidence item sufficient to measure with an output range that is so very precise. If the measurement's range of values in this case, properly employed, is between 5'6" and 5'10", as an example, then more than 65% of the population of the area will fit within that range. It's hardly an identifying characteristic. It does, however, help prioritize tips as well as to help exclude from the enquiry those subjects more than a standard deviation away from that range. This is why it's important to engage in valid methods when performing an analysis.