I've had a few questions come in about reading the automatically generated report from Amped Software's FIVE. Today, we'll deal with the report as it deals with the Crop command.
First, it's important to remember that things in the Amped world go clockwise from the top left of the screen. Thus, the position at the top left of your image is X=0, Y=0.
The report features a set of four numbers. These are X=, Y=, W=, H=. This can be read as, from the X,Y position, the crop is W,H.
As an example, 463, 176, 272, 376 can be read as from X=463, Y=176, the cropped area is 272 wide by 376 high. Remember, the X,Y position is the top left of the cropped area. Thus, the 272 goes to the right of the image and the 376 goes down.
Enjoy.
Thursday, April 3, 2014
Wednesday, April 2, 2014
The importance of SOPs
Standard Operating Procedures. Do you know the term? Does your agency have SOPs for digital multimedia forensics?
Judging on the amount of questions I receive, and the amount of questions received by friends in the field, agencies are trying to get their house in order as regards SOPs. Folks are asking around, "hey, does anyone have an SOP for analyzing mobile phones?" Audio analysis and video analysis are other frequent topics.
But what happens if you don't have an SOP, and your asked about it in testimony? How will you respond? Does your agency allow you to create your own SOP without getting appropriate permissions and sign-offs?
Here's an example of an SOP from NIST. It's not for video, audio, or mobile phones ... but it lays out the important elements. There's an introduction, a list of steps, forms, tables, etc. Another good item to include is a log of changes to the SOP.
It doesn't have to be complicated, but you should at least have something on paper that governs your work.
Judging on the amount of questions I receive, and the amount of questions received by friends in the field, agencies are trying to get their house in order as regards SOPs. Folks are asking around, "hey, does anyone have an SOP for analyzing mobile phones?" Audio analysis and video analysis are other frequent topics.
But what happens if you don't have an SOP, and your asked about it in testimony? How will you respond? Does your agency allow you to create your own SOP without getting appropriate permissions and sign-offs?
Here's an example of an SOP from NIST. It's not for video, audio, or mobile phones ... but it lays out the important elements. There's an introduction, a list of steps, forms, tables, etc. Another good item to include is a log of changes to the SOP.
It doesn't have to be complicated, but you should at least have something on paper that governs your work.
Tuesday, April 1, 2014
Scientific Method
Here's a helpful reminder of the steps involved in the Scientific Method.
If you are a "forensic scientist," do you follow this method of enquiry?
Thursday, March 20, 2014
Training Update
Amped Software has released the order form for their training session in Ft. Worth, Tx.
Intermediate Forensic Multimedia Analysis with Amped FIVE Professional is being presented in Ft. Worth, Tx (home of the #1 downtown in the US in 2014), May 5-9, 2014.
I hope to see you there.
Intermediate Forensic Multimedia Analysis with Amped FIVE Professional is being presented in Ft. Worth, Tx (home of the #1 downtown in the US in 2014), May 5-9, 2014.
I hope to see you there.
Tuesday, March 18, 2014
FIVE in the news
Click here to check out the Gendarmerie on FranceTV using Amped FIVE to calculate the height of suspects (begins about 17:00). How cool is that?!
Friday, March 14, 2014
Training Opportunity In Texas
Course: Intermediate Forensic Multimedia Analysis
Instructor: Jim Hoerricks
Location: Ft. Worth, Tx.
Dates: May 5-9, 2014 (40 Hours)
Expectations and Goals: Graduates will acquire intermediate level training in the techniques and skills necessary to perform examinations, clarifications, and analyses on digital multimedia evidence in a “forensic science” setting as well as to package, deliver, and present those findings in their local court room context.
Sponsors: Amped Software North America and GP SIFT.
Skill Level: Intermediate. It is assumed that the student will have a basic knowledge of Forensic Multimedia Analysis and be able to navigate comfortably within the Windows computer environment.
While the registration page is being put together, click here to send your contact information to Amped Software. The registration page should be up in a few days and will contain information about the venue, host agency, costs, and hotel recommendations. I just wanted to get the word out about the opportunity as quick as possible. Also, you'll note that the class is oriented towards a Friday travel day with an afternoon departure time.
See y'all there.
Instructor: Jim Hoerricks
Location: Ft. Worth, Tx.
Dates: May 5-9, 2014 (40 Hours)
Expectations and Goals: Graduates will acquire intermediate level training in the techniques and skills necessary to perform examinations, clarifications, and analyses on digital multimedia evidence in a “forensic science” setting as well as to package, deliver, and present those findings in their local court room context.
Sponsors: Amped Software North America and GP SIFT.
Skill Level: Intermediate. It is assumed that the student will have a basic knowledge of Forensic Multimedia Analysis and be able to navigate comfortably within the Windows computer environment.
While the registration page is being put together, click here to send your contact information to Amped Software. The registration page should be up in a few days and will contain information about the venue, host agency, costs, and hotel recommendations. I just wanted to get the word out about the opportunity as quick as possible. Also, you'll note that the class is oriented towards a Friday travel day with an afternoon departure time.
See y'all there.
Thursday, March 13, 2014
An interesting use of crowd sourcing
Please consider taking a few minutes on March 28th to participate in the LEEDIR Operational Test!
What: LEEDIR (Large Emergency Event Digital Information Repository) Operational Test
When: Friday, March 28, 2014 - 9:00am - Noon PDT
How: Simply upload a random 1-3 minute video or still images shot with your cell phone. The video can be of anything, but we encourage video of people in public places, malls, shopping centers, convenience stores, vehicle traffic, etc.
The LEEDIR Eyewitness Platform INVITES YOUR PARTICIPATION!
The LEEDIR technology enables law enforcement and relief agencies to receive and rapidly analyze eyewitness videos and photos submitted by citizens during large emergency events.
Your participation in this exercise is being requested to help simulate a level of eyewitness photo and video submissions that would be expected during a major emergency event.
Law enforcement agencies around the nation have been invited to submit photos and videos to the LEEDIR platform through the LEEDIR website (leedir.us), iPhone app (available now at the App Store)
or the Android app (available March 23rd at the Google Play Store).
As submissions are uploaded, investigators at the LASD Cyber Investigations Center (CIC) will review, manage, analyze and distribute the photos and videos as they would during a real major emergency event, to better inform their emergency response teams and gather evidence. During the event, analytics and statistics will be published, followed by a press conference at SHB to broadcast the results.
More info at: http://www.leedir.us/about
What: LEEDIR (Large Emergency Event Digital Information Repository) Operational Test
When: Friday, March 28, 2014 - 9:00am - Noon PDT
How: Simply upload a random 1-3 minute video or still images shot with your cell phone. The video can be of anything, but we encourage video of people in public places, malls, shopping centers, convenience stores, vehicle traffic, etc.
The LEEDIR Eyewitness Platform INVITES YOUR PARTICIPATION!
The LEEDIR technology enables law enforcement and relief agencies to receive and rapidly analyze eyewitness videos and photos submitted by citizens during large emergency events.
Your participation in this exercise is being requested to help simulate a level of eyewitness photo and video submissions that would be expected during a major emergency event.
Law enforcement agencies around the nation have been invited to submit photos and videos to the LEEDIR platform through the LEEDIR website (leedir.us), iPhone app (available now at the App Store)
or the Android app (available March 23rd at the Google Play Store).
As submissions are uploaded, investigators at the LASD Cyber Investigations Center (CIC) will review, manage, analyze and distribute the photos and videos as they would during a real major emergency event, to better inform their emergency response teams and gather evidence. During the event, analytics and statistics will be published, followed by a press conference at SHB to broadcast the results.
More info at: http://www.leedir.us/about
Wednesday, March 12, 2014
Get the original
This just in from George Reis, "The March 2014 issue of California Lawyer magazine includes an article I wrote, titled, "Images: Get the Original." The original version I submitted had to go through quite a bit of editing (I wrote it before checking for length requirements, so it was too long). The points I tried to make are that when an attorney is provided with photographs or video evidence from opposing counsel, the best evidence is a bit-for-bit copy of the original, in it's original format. And, that when providing images to opposing counsel, providing bit-for-bit copies of the originals can result in fewer claims of file manipulation. The article is on page 24 of the on-line edition (link) and page 13 of the printed version."
Well done, George.
Well done, George.
Tuesday, March 11, 2014
Cell phone with a camera, or camera with a phone?
John Riddell's Data Recovery Blog poses this curious question, how do you view your mobile device and how to you maintain it?
"With the increasing popularity of built in cameras with our cell phones today, it’s no longer a question as to whether you’ll use it at all but how often you’ll use it. It seems as though there is as much emphasis on the cameras in the phones today as there is memory, battery length and amount of apps we can store. I recently saw a TV commercial for a phone with a camera and the only thing they talked about were the features of the camera, nothing else."
That being said, how are you processing video/image evidence retrieved from mobile devices? Do you have the ability to safely acquire the images? Do you use your own iTunes account? With the cost of "forensic" software being relatively high, folks are "just doing what they can" to get images from phones and tablets. Some are even e-mailing images off the evidence to their own e-mail account.
Whatever you are doing, have a sound policy / practice document … and follow it.
"With the increasing popularity of built in cameras with our cell phones today, it’s no longer a question as to whether you’ll use it at all but how often you’ll use it. It seems as though there is as much emphasis on the cameras in the phones today as there is memory, battery length and amount of apps we can store. I recently saw a TV commercial for a phone with a camera and the only thing they talked about were the features of the camera, nothing else."
That being said, how are you processing video/image evidence retrieved from mobile devices? Do you have the ability to safely acquire the images? Do you use your own iTunes account? With the cost of "forensic" software being relatively high, folks are "just doing what they can" to get images from phones and tablets. Some are even e-mailing images off the evidence to their own e-mail account.
Whatever you are doing, have a sound policy / practice document … and follow it.
Monday, March 10, 2014
Traditional Finger Printing Could Be A Thing Of The Past
This just in, "Computer scientists at Michigan State University have built the first three-dimensional model of a human fingerprint.
They say it will not only help today’s fingerprint matching technology do its job better, but could eventually lead to improvements in security.
The method, developed by Anil Jain, his MSU colleagues and research collaborator Nick Paulter at the National Institute of Standards and Technology, takes a two dimensional image of a fingerprint and maps it to a 3-D finger surface.
The 3-D finger surface, complete with all the ridges and valleys that make up the human fingerprint, is then made using a 3-D printer.
It creates what Jain’s team called a fingerprint "phantom."
They say that tools like this would help improve the overall accuracy of fingerprint matching systems, which eventually leads to better security in applications ranging from law enforcement to mobile phone unlock."
They say it will not only help today’s fingerprint matching technology do its job better, but could eventually lead to improvements in security.
The method, developed by Anil Jain, his MSU colleagues and research collaborator Nick Paulter at the National Institute of Standards and Technology, takes a two dimensional image of a fingerprint and maps it to a 3-D finger surface.
The 3-D finger surface, complete with all the ridges and valleys that make up the human fingerprint, is then made using a 3-D printer.
It creates what Jain’s team called a fingerprint "phantom."
They say that tools like this would help improve the overall accuracy of fingerprint matching systems, which eventually leads to better security in applications ranging from law enforcement to mobile phone unlock."
Saturday, March 8, 2014
RIP LAPD Officer Nicholas Lee
LAPD Police Officer III Nicholas Lee, Serial No. 34980.
A man of greatness and selflessness. Nick was a great cop.
May he rest in peace. #EOW 3/7/14
- LAPD Chief Charlie Beck
Friday, March 7, 2014
Send images from Amped FIVE to Word and PowerPoint
This just in from the folks at Amped Software:
"We just released an update to FIVE with a lot of improvements, bug corrections and customer requested features.
Despite FIVE having very advanced and automated reporting capabilities, it’s undeniable that most of us use very often Word, PowerPoint and other programs to show our results to courts, customers and colleagues. They could be simple investigative reports or some tutorials for explaining how to work with images and video.
I do it daily and I was sick of saving pictures and importing them in other various applications, so we added a very convenient way to interact with third party programs.
In the latest version of Amped FIVE (release 5989), if you right click on the Save Snapshot button in the Player Panel of FIVE you will have access to new settings for the Save Snapshot button.
These are the available options:
The last selection is kept in memory so the next time you simply click the button Save Snapshot it will be reapplied.
Imagine how useful it is the combination of these features: you can show and explain step by step in a document or presentation, all the operations done with FIVE."
It's amazing to have a company respond to suggestions by implementing changes in such a speedy fashion. For those agencies with pre-made report templates in MS Word, or who use MS PowerPoint extensively, this is a huge time saver.
"We just released an update to FIVE with a lot of improvements, bug corrections and customer requested features.
Despite FIVE having very advanced and automated reporting capabilities, it’s undeniable that most of us use very often Word, PowerPoint and other programs to show our results to courts, customers and colleagues. They could be simple investigative reports or some tutorials for explaining how to work with images and video.
I do it daily and I was sick of saving pictures and importing them in other various applications, so we added a very convenient way to interact with third party programs.
In the latest version of Amped FIVE (release 5989), if you right click on the Save Snapshot button in the Player Panel of FIVE you will have access to new settings for the Save Snapshot button.
These are the available options:
- Save Image (Automatic Filename): the displayed image is saved in the default path, along with the current project file needed to recreate the image from scratch.
- Save Image (Selected By The User): like above, but the user can select the filename and folder of the file.
- Send Image To Clipboard: the displayed image is copied to the system clipboard to be pasted in other applications.
- Send Image To Word: the displayed image is copied in the currently opened Word document.
- Send Image to PowerPoint: the displayed image is copied in the currently opened PowerPoint document.
- Current Image: saves the currently displayed image alone.
- Current Window: saves the full Amped FIVE interface.
- Full Screen: saves the whole screen.
The last selection is kept in memory so the next time you simply click the button Save Snapshot it will be reapplied.
Imagine how useful it is the combination of these features: you can show and explain step by step in a document or presentation, all the operations done with FIVE."
It's amazing to have a company respond to suggestions by implementing changes in such a speedy fashion. For those agencies with pre-made report templates in MS Word, or who use MS PowerPoint extensively, this is a huge time saver.
Wednesday, February 26, 2014
Supreme Court of Canada halts use of expert opinions
Here's an amazing story from the Globe and Mail.
"… He said that Canadian courts had in effect been “contracting out” questions of guilt or innocence to experts. From here on, though, “any time ‘experiential’ evidence points the finger directly at the accused, that’s going to be offside. It’s not just drug cases – it’s any serious case …"
"… Ben Berger, a criminal-law specialist at Osgoode Hall Law School in Toronto, said the ruling is an attempt by the court to rein in expert witnesses, part of a trend since Ontario’s 2008 Goudge inquiry into more than a dozen wrongful convictions in baby deaths, stemming from the testimony of disgraced Toronto pathologist Charles Smith.
The Supreme Court found that “police experience on its own is something that has to be looked at with suspicion and a critical eye,” Prof. Berger said. “That’s important not just in a drug setting but in pretty much any criminal investigatory setting ...”
"… He said that Canadian courts had in effect been “contracting out” questions of guilt or innocence to experts. From here on, though, “any time ‘experiential’ evidence points the finger directly at the accused, that’s going to be offside. It’s not just drug cases – it’s any serious case …"
"… Ben Berger, a criminal-law specialist at Osgoode Hall Law School in Toronto, said the ruling is an attempt by the court to rein in expert witnesses, part of a trend since Ontario’s 2008 Goudge inquiry into more than a dozen wrongful convictions in baby deaths, stemming from the testimony of disgraced Toronto pathologist Charles Smith.
The Supreme Court found that “police experience on its own is something that has to be looked at with suspicion and a critical eye,” Prof. Berger said. “That’s important not just in a drug setting but in pretty much any criminal investigatory setting ...”
Tuesday, February 25, 2014
The $200 4TB HD for DVRs
Western Digital recently announced it's new line of hard drives built specifically for the surveillance (dCCTV) market. The new WD Purple HDD is available now in 1TB, 2TB, 3TB and 4TB capacities that are slated to cost $90, $120, $160, and $200, respectively. That's a lot of video to manage. Given the long budgeting cycle for government agencies, you better start planning on increasing your storage capacity soon.
Monday, February 24, 2014
Sony's Audio Master Suite for Mac is on sale this week
I've been using Sound Forge since it was a Sonic Foundry product. It's great for quick edits and for dealing with difficult file types. It's now available for OSX in the Audio Master Suite. The suite contains Sound Forge Pro Mac 2, SpectraLayers Pro 2, Convrt™ Batch Processing Automation Tool, Mastering and Repair Suite powered by iZotope®, and a few other goodies for only $499. This week, they've taken $100 off the price.
This is an awesome opportunity for those who are using Macs, but love Sony's audio products.
This is an awesome opportunity for those who are using Macs, but love Sony's audio products.
Friday, February 21, 2014
Amped FIVE update: load subtitles and a lot of other improvements
The folks at Amped Software just updated FIVE. Here's what's new:
New Load Subtitles filter
Sometimes DVR systems save timestamp information in a separate subtitle file. With this new filter you can finally view the exact timestamp printed on the video, if they are encoded as smi or srt files. The timestamp appearance can be fully customized by the user: location on the picture, size, font, style and color are fully configurable. Load Subtitles is located in the group Presentation.
Quick information on the current file
This is something very simple, but that will certainly make your life easier. Basically we added in the status bar the name of the current file and the pixel resolution of the currently displayed image, so you can always know what you are working on.
New Load Subtitles filter
Sometimes DVR systems save timestamp information in a separate subtitle file. With this new filter you can finally view the exact timestamp printed on the video, if they are encoded as smi or srt files. The timestamp appearance can be fully customized by the user: location on the picture, size, font, style and color are fully configurable. Load Subtitles is located in the group Presentation.
Quick information on the current file
This is something very simple, but that will certainly make your life easier. Basically we added in the status bar the name of the current file and the pixel resolution of the currently displayed image, so you can always know what you are working on.
Wednesday, February 19, 2014
Tuesday, February 18, 2014
Project S-Five
I received an invitation to take a survey being run by Project S-Five. It's an EU based study, not to be confused with Amped Software's FIVE. Here's what the project is about.
"About Project S-Five
Throughout the last decade, the digital video and surveillance industry has developed and expanded at an ever increasing pace. Unfortunately, the images and video recordings that are most often provided to forensic investigators are composed of rather low quality image data. Analysing such data requires considerable knowledge and tuning of different parameters in various software tools. As a consequence, forensic laboratories are most often overloaded with image and video analysis casework, and have experienced considerable difficulty in keeping up with recent developments both in terms of (academic and commercial) R&D and available software tools. Additionally, from an organizational point of view, an overview of the methods and procedures that are currently being used across the ENFSI member institutes is lacking. This hinders a unified methodology of dealing with this type of evidence and the development of standardization and quality assurance issues in general. Finally, there exists an urgent need for reference input material that can be used for evaluation and training of (new) investigators, for testing and validation of existing and new software tools, etc.
S-FIVE
This project will study various issues related to the Standardisation of Forensic Image and Video Enhancement (S-FIVE). The main focus of the project is oriented towards techniques that are used for improving the quality of surveillance video data and other types of images that portray persons and objects at the macroscopic level.
The S-FIVE project is a project funded by the European Commission through the European Network of Forensic Science Institutes (ENFSI) Monopoly 2011 programme "Improving Forensic Methodologies across Europe"(IFMAE).
The core S-FIVE project team is formed by researchers and investigators from BKA (Germany), CAST (UK), CSCP (Cyprus), MPS (UK), NFI (The Netherlands) and NICC-INCC (Belgium)."
As I'm filling out the survey, I could't help but remember the mantra from working with the SAPS in Pretoria - easy things should be easy. When the survey asked about difficulty, there wasn't a single question that I couldn't answer as "easy." For enhancement and analysis tasks, I use Amped's FIVE. Easy/simple things should be easy, and fast.
Here's the link to the survey: https://www.s-five.eu/limesurvey_9/index.php?sid=5
"About Project S-Five
Throughout the last decade, the digital video and surveillance industry has developed and expanded at an ever increasing pace. Unfortunately, the images and video recordings that are most often provided to forensic investigators are composed of rather low quality image data. Analysing such data requires considerable knowledge and tuning of different parameters in various software tools. As a consequence, forensic laboratories are most often overloaded with image and video analysis casework, and have experienced considerable difficulty in keeping up with recent developments both in terms of (academic and commercial) R&D and available software tools. Additionally, from an organizational point of view, an overview of the methods and procedures that are currently being used across the ENFSI member institutes is lacking. This hinders a unified methodology of dealing with this type of evidence and the development of standardization and quality assurance issues in general. Finally, there exists an urgent need for reference input material that can be used for evaluation and training of (new) investigators, for testing and validation of existing and new software tools, etc.
S-FIVE
This project will study various issues related to the Standardisation of Forensic Image and Video Enhancement (S-FIVE). The main focus of the project is oriented towards techniques that are used for improving the quality of surveillance video data and other types of images that portray persons and objects at the macroscopic level.
The S-FIVE project is a project funded by the European Commission through the European Network of Forensic Science Institutes (ENFSI) Monopoly 2011 programme "Improving Forensic Methodologies across Europe"(IFMAE).
The core S-FIVE project team is formed by researchers and investigators from BKA (Germany), CAST (UK), CSCP (Cyprus), MPS (UK), NFI (The Netherlands) and NICC-INCC (Belgium)."
As I'm filling out the survey, I could't help but remember the mantra from working with the SAPS in Pretoria - easy things should be easy. When the survey asked about difficulty, there wasn't a single question that I couldn't answer as "easy." For enhancement and analysis tasks, I use Amped's FIVE. Easy/simple things should be easy, and fast.
Here's the link to the survey: https://www.s-five.eu/limesurvey_9/index.php?sid=5
Monday, February 17, 2014
NIST Webcast on New Forensic Scientific Area Committees Set for Feb. 18, 2014
February 14, 2014
Contact: Linda Joy
301-975-2757
The NIST forensics science team is holding a public presentation and live webcast on its new Organization of Scientific Area Committees (OSAC) at the American Academy of Forensic Sciences annual meeting in Seattle, Feb. 18, 2014, 5:00 to 7:00 p.m. PST.
The establishment of OSAC is a result of a NIST and Department of Justice memorandum of understanding signed last year with the aim of improving standards and practices in forensic science laboratories.
NIST envisions uniform administration of development, promulgation and adoption of standards through the OSAC as well as supporting communication flow between the scientific area committees and the forensic science community. The intent is to bring structure, scientific rigor and increased communication among forensic scientists, research scientists, academicians, statisticians, attorneys, managers and quality assurance specialists.
The presentation will take place at the Washington State Convention Center, Ballroom 6C, Seattle, Wash.
Agenda
5:00 to 5:10: Introduction – Mark Stolorow
5:10 to 5:15: Background – Rich Cavanagh
5:15 to 5:30: Notice of Inquiry Responses – Susan Ballou
5:30 to 6:00: OSAC Plan – Barbara Guttman and John Butler
6:00 to 6:15: OSAC Membership – John Paul Jones II
6:15 to 7:00: Questions
Webcast Link: http://psav.mediasite.com/mediasite/Play/8e65ad3f9958440b8eab9da0831e3b1d1d
The presentation slides will be posted here on Tuesday, Feb. 18.
Important notes about Live Webcast:
This webcast will be streamed from Mediasite by sonicfoundry, individuals logging in from personal computers/laptops may need to:
Install Microsoft Silverlight prior to logging on – this is needed in order to view the program.
If any participants use Safari on Mavericks, they will need to disable plugins power saver option. That should be turned off so that it does not prevent the media player from loading.
Contact: Linda Joy
301-975-2757
The NIST forensics science team is holding a public presentation and live webcast on its new Organization of Scientific Area Committees (OSAC) at the American Academy of Forensic Sciences annual meeting in Seattle, Feb. 18, 2014, 5:00 to 7:00 p.m. PST.
The establishment of OSAC is a result of a NIST and Department of Justice memorandum of understanding signed last year with the aim of improving standards and practices in forensic science laboratories.
NIST envisions uniform administration of development, promulgation and adoption of standards through the OSAC as well as supporting communication flow between the scientific area committees and the forensic science community. The intent is to bring structure, scientific rigor and increased communication among forensic scientists, research scientists, academicians, statisticians, attorneys, managers and quality assurance specialists.
The presentation will take place at the Washington State Convention Center, Ballroom 6C, Seattle, Wash.
Agenda
5:00 to 5:10: Introduction – Mark Stolorow
5:10 to 5:15: Background – Rich Cavanagh
5:15 to 5:30: Notice of Inquiry Responses – Susan Ballou
5:30 to 6:00: OSAC Plan – Barbara Guttman and John Butler
6:00 to 6:15: OSAC Membership – John Paul Jones II
6:15 to 7:00: Questions
Webcast Link: http://psav.mediasite.com/mediasite/Play/8e65ad3f9958440b8eab9da0831e3b1d1d
The presentation slides will be posted here on Tuesday, Feb. 18.
Important notes about Live Webcast:
This webcast will be streamed from Mediasite by sonicfoundry, individuals logging in from personal computers/laptops may need to:
Install Microsoft Silverlight prior to logging on – this is needed in order to view the program.
If any participants use Safari on Mavericks, they will need to disable plugins power saver option. That should be turned off so that it does not prevent the media player from loading.
Saturday, February 8, 2014
What should a 101 level course contain?
Early last year, I wrote about Image Analysis Domains. I noted: "In terms of the domains of analysis, there are four agreed upon domains for forensic video/image analysis:
One common mistake made across the news reports I watched is that clarification/enhancement is analysis. To be sure, clarification/enhancement help observation and make it easier to form initial conclusions. To be part of a scientific method, they need to be reliable and repeatable. But they are not, of themselves, analysis."
In the American university system, a 101 level course is generally an introductory educational course. Thus, if you are taking a course entitled Image Analysis 101, it should contain a solid introduction to the domains of image analysis. As video can be considered a series of images, Video Analysis 101 should also contain these domains.
Now, add the word "forensic" to the title. Forensic Image (or video) Analysis 101 should contain introductory education in the analysis domains plus an introduction to "forensics." In this context, we mean using image/video analysis in legal matters. Thus, FVA 101 (or FIVA 101) should contain an introduction to the above domains within the context of the legal system for which the course is offered.
I find myself writing this in my hotel room in Tshwane, Gauteng, South Africa. South Africa's Magistrate Courts have no jury to sway our story telling. The story telling aspect of forensics is irrelevant here. The work here is almost pure image/video analysis in that the work has to stand on its own. The analyst may be called upon by the court to explain a few technical things, but largely the evidence is simply submitted for inclusion in the trial. You don't see the type of long, drawn out testimony by experts that we see in the US. To me, that's refreshing.
The domains of image/video analysis are sciences in and of themselves. As students of the craft of analysis, it's up to us to assure that we're educated and proficient in what they are and not what some vendors would like them to be. Photogrammetry, as an example, obeys certain agreed upon rules. If you are working in photogrammetry, you should understand the science behind the tools that you are using. The same is true for all of the domains.
So what does this all mean? Where am I going with this?
- Photogrammetry
- Comparison
- Content analysis
- Authentication
One common mistake made across the news reports I watched is that clarification/enhancement is analysis. To be sure, clarification/enhancement help observation and make it easier to form initial conclusions. To be part of a scientific method, they need to be reliable and repeatable. But they are not, of themselves, analysis."
In the American university system, a 101 level course is generally an introductory educational course. Thus, if you are taking a course entitled Image Analysis 101, it should contain a solid introduction to the domains of image analysis. As video can be considered a series of images, Video Analysis 101 should also contain these domains.
Now, add the word "forensic" to the title. Forensic Image (or video) Analysis 101 should contain introductory education in the analysis domains plus an introduction to "forensics." In this context, we mean using image/video analysis in legal matters. Thus, FVA 101 (or FIVA 101) should contain an introduction to the above domains within the context of the legal system for which the course is offered.
I find myself writing this in my hotel room in Tshwane, Gauteng, South Africa. South Africa's Magistrate Courts have no jury to sway our story telling. The story telling aspect of forensics is irrelevant here. The work here is almost pure image/video analysis in that the work has to stand on its own. The analyst may be called upon by the court to explain a few technical things, but largely the evidence is simply submitted for inclusion in the trial. You don't see the type of long, drawn out testimony by experts that we see in the US. To me, that's refreshing.
The domains of image/video analysis are sciences in and of themselves. As students of the craft of analysis, it's up to us to assure that we're educated and proficient in what they are and not what some vendors would like them to be. Photogrammetry, as an example, obeys certain agreed upon rules. If you are working in photogrammetry, you should understand the science behind the tools that you are using. The same is true for all of the domains.
So what does this all mean? Where am I going with this?
- 101 = an introduction to the domains of image/video analysis
- 201 = intermediate topics in the domains of image/video analysis
- 301/401 = advanced topics in the domains of image/video analysis
None of these should be exclusive to a certain toolset or manufacturer. They should equip the analyst with the knowledge of the science behind the techniques and the tools. Not just an explanation of a given tool's options for JPEG DCT examination in authentication of an image, but a deeper look at the way JPEG files work, how they are created, their history, and etc. In this way, the DCT examination will make more sense, and the American/Canadian analyst will have an easier time explaining his/her work.
If you take this approach, you may end up where I am - dissatisfied with your old tools. Try enquiring about the science behind the tools offered by the big three (Adobe, Avid, Sony). You won't get a straight answer. Their answers are trade secrets. You'll find yourself investigating the more purpose built offerings from Amped Software, Cognitech, MotionDSP, Noritsu, Salient Sciences, and Signal Scape. From there, you'll want to know which company offers both qualitative and quantitative tools. This will narrow the list significantly. You'll ask about cost, training, and general acceptance. If you want to do actual quantitative image / video analysis, there are only a few manufacturers in this space - and they aren't the big three.
To pull all of this together, a course on FIVA 101 should be an introductory course on concepts of image and video analysis in a legal setting. It should introduce the domains and their role in the legal process. This is an entirely different course than an introduction to image/video processing with a specific tool or manufacturer. The former is considered education, the latter is considered training. Both are important. But, they are entirely different. When spending your precious funds to upgrade your knowledge, be sure to ask specific questions. Do you want training on a set of tools, or do you want education on the domains of analysis - or both.
Monday, February 3, 2014
Pardon the interruption
Greetings from South Africa.
After 2.5 days of travel covering half of the world, I'm here in Pretoria (Tshwane) working with the South African Police Service. I'm presenting training in digital multimedia evidence retrieval, advanced forensic image/video analysis, image authentication, forensic audio analysis, and case management over two very intense weeks.
South Africa is a beautiful country and I'm very happy and thankful at the opportunity to come here and assist the SAPS. Now, if only airline seats were more spacious. :)
Friday, January 24, 2014
Batch processing in Authenticate
Usually, image authentication is a one-at-a-time process. But, what if you have a bunch of images in a folder from a single source? In Amped Software's Authenticate, you can batch process the files ... saving you a ton of time.
The Batch Processing tool allows the user to automatically process many files with one or more filters configured. For example, it is possible to apply all filters to a single image; all filters to entire folders of images; or only one filter to an entire folder of images.
Since the results of processing with heavy filters are saved in the cache folders, this is a very good way to leave the computer do the work without the user intervention (like overnight if there are a lot of big files). At the end of the processing you will have the ability to analyze the results very quickly, without the need to wait the execution of every filter.
A small warning, the full processing of many images with all filters can take very long time, depending on images' size and currently active filter configurations.
But wait, there's more ...
The Batch File Format Analysis tool allows Authenticate to quickly inspect the format of all images in a folder and quickly display detailed information about the formats in a big table. This tool provides a means to do a quick triage of suspicious files that may deserve further analysis without the need to run full processing on them.
You are asked to choose a folder where to perform the analysis, and those results will be displayed in a table. The displayed information is from the files present in the filter [File Format].
Specific features from the analysis of the image that can be a possible warning of image tampering are displayed in red ink. Similarly to the filter File Format filter, it is possible to modify the rules for the comparison by Menu > View > Program Options > File Format.
But wait, there's even more ...
The Batch File Format Comparison tool allows Authenticate to compare the formats of all images in an user selected folder with the current evidence image. The results are displayed in a table. The first row (id 0) represents the current evidence image used for the comparison. All the subsequent lines display the file format for the other images in the compared folder. The value of every cell is written in black if the value is the same as the evidence image, red otherwise. The last column value represents the number of differences found.
This tool is very useful when you need to verify if a certain camera is capable of creating a picture with a certain format. The user can take the camera and shoot as many different pictures as possible, with different types of scenes and different settings. Then the tool can be run to automatically to find if there is some combinations which yields compatible results.
If you want to look deeper at a specific image, just double click on a row of the table and it will load the file as evidence.
How cool is that?
The Batch Processing tool allows the user to automatically process many files with one or more filters configured. For example, it is possible to apply all filters to a single image; all filters to entire folders of images; or only one filter to an entire folder of images.
Since the results of processing with heavy filters are saved in the cache folders, this is a very good way to leave the computer do the work without the user intervention (like overnight if there are a lot of big files). At the end of the processing you will have the ability to analyze the results very quickly, without the need to wait the execution of every filter.
A small warning, the full processing of many images with all filters can take very long time, depending on images' size and currently active filter configurations.
But wait, there's more ...
The Batch File Format Analysis tool allows Authenticate to quickly inspect the format of all images in a folder and quickly display detailed information about the formats in a big table. This tool provides a means to do a quick triage of suspicious files that may deserve further analysis without the need to run full processing on them.
You are asked to choose a folder where to perform the analysis, and those results will be displayed in a table. The displayed information is from the files present in the filter [File Format].
Specific features from the analysis of the image that can be a possible warning of image tampering are displayed in red ink. Similarly to the filter File Format filter, it is possible to modify the rules for the comparison by Menu > View > Program Options > File Format.
But wait, there's even more ...
The Batch File Format Comparison tool allows Authenticate to compare the formats of all images in an user selected folder with the current evidence image. The results are displayed in a table. The first row (id 0) represents the current evidence image used for the comparison. All the subsequent lines display the file format for the other images in the compared folder. The value of every cell is written in black if the value is the same as the evidence image, red otherwise. The last column value represents the number of differences found.
This tool is very useful when you need to verify if a certain camera is capable of creating a picture with a certain format. The user can take the camera and shoot as many different pictures as possible, with different types of scenes and different settings. Then the tool can be run to automatically to find if there is some combinations which yields compatible results.
If you want to look deeper at a specific image, just double click on a row of the table and it will load the file as evidence.
How cool is that?
Thursday, January 23, 2014
Omnivore Field Kit Issue
A lot of people have seen the Omnivore Field Kit Detailed Demo on YouTube since it was uploaded a few months ago.
A reader sent me the link and asked an interesting question about what was seen on the screen. He saw today's webinar and went to the web site for more information. The scenario here is that there's no digital output, thus you need the Field Kit. Here's the Field Kit Viewer's screen (from the video).
What jumped out at our eagle-eyed reader is the recorded size setting displayed on the screen, CIF. CIF, or Common Intermediate Format, "is a format used to standardize the horizontal and vertical resolutions in pixels of YCbCr sequences in video signals, commonly used in video teleconferencing systems. It was first proposed in the H.261 standard." The dimensions for a CIF sized video is 352x288.
But, the size of the VGA output, as shown in the video is different. The Viewer is reporting the source as 1024x768. How many times does 352 go into 1024? How many times does 288 go into 768? Are the results a nice, round number? If not, what does that mean?
If the video is recorded at 352x288, and sent to the VGA port at 1024x768 - what's happening? Is aspect maintained? What should you do? Unfortunately, when you examine the spec sheets of DVRs, you'll find this a lot. 720x480 or 640x480 is pushed out the VGA, regardless of what the recorded size setting happens to be.
If you choose the Set Display Dimension option (by clicking on the blue Display/Source link) all you do is resize the viewer screen. This doesn't change what's coming out of the DVR? Does it change the amount of pixels captured? No. It seems that the adjustment just makes the Viewer window smaller/larger.
So, here's a problem for folks using this solution. How many know the source video dimensions, or made a note of the dimensions in their report? How many know what's being pumped out of the VGA port into the Field Kit? The Field Kit Viewer is supposed to detect the signal and adjust accordingly. Did you remember to write this info in your report?
But even so, when this happens in the example video, it's still not divisible.
As with any tool, validate it for use before you put it into action. Forewarned is forearmed, right?
A reader sent me the link and asked an interesting question about what was seen on the screen. He saw today's webinar and went to the web site for more information. The scenario here is that there's no digital output, thus you need the Field Kit. Here's the Field Kit Viewer's screen (from the video).
What jumped out at our eagle-eyed reader is the recorded size setting displayed on the screen, CIF. CIF, or Common Intermediate Format, "is a format used to standardize the horizontal and vertical resolutions in pixels of YCbCr sequences in video signals, commonly used in video teleconferencing systems. It was first proposed in the H.261 standard." The dimensions for a CIF sized video is 352x288.
But, the size of the VGA output, as shown in the video is different. The Viewer is reporting the source as 1024x768. How many times does 352 go into 1024? How many times does 288 go into 768? Are the results a nice, round number? If not, what does that mean?
If the video is recorded at 352x288, and sent to the VGA port at 1024x768 - what's happening? Is aspect maintained? What should you do? Unfortunately, when you examine the spec sheets of DVRs, you'll find this a lot. 720x480 or 640x480 is pushed out the VGA, regardless of what the recorded size setting happens to be.
If you choose the Set Display Dimension option (by clicking on the blue Display/Source link) all you do is resize the viewer screen. This doesn't change what's coming out of the DVR? Does it change the amount of pixels captured? No. It seems that the adjustment just makes the Viewer window smaller/larger.
So, here's a problem for folks using this solution. How many know the source video dimensions, or made a note of the dimensions in their report? How many know what's being pumped out of the VGA port into the Field Kit? The Field Kit Viewer is supposed to detect the signal and adjust accordingly. Did you remember to write this info in your report?
But even so, when this happens in the example video, it's still not divisible.
As with any tool, validate it for use before you put it into action. Forewarned is forearmed, right?
Wednesday, January 22, 2014
Image Authentication Assumptions
I recently received an e-mail from a reader with a single image attached. The question, has this image been altered? Simple question? Not really, it seems.
As a favor, I loaded it into Amped's Authenticate. Sure enough, the image has been through Photoshop as indicated by the various File Analysis filters. So, the image has been "altered."
It could be contextually accurate, even though it's been through Photoshop. Does a curves adjustment invalidate an image from use? The EXIF info shows a size change and a few other problems. But EXIF information can be spoofed. Other things about an image can be fabricated in an attempt to fool authentication software. So, if this was a trial, what would you do? How would you structure your enquiry?
Should I stake my name and reputation on a software's test against a single image without a reference? No way. Not a chance. Have you ever seen a Black Swan?
Thus, I would want a reference image. If the submission is purported to be a "camera original," then I should be able to test against a reference image from the same camera. In other words, I want your camera in my lab to conduct my authentication experiments.
Here's an example that I use in my Image Authentication classes. A person turns in a cell phone picture to the police as proof that a certain ticket and tow was unjustified. In my example, a person received a parking ticket for parking in front of a fire hydrant. The person is seeking not only to have the ticket voided, but is also seeking a refund on towing and impound fees. On the face of it, there is no hydrant in the image. Case closed? No.
To do a proper test, I need a reference image. I need the camera in my lab - in this case, the person's cell phone. I take the necessary reference pictures and find that the image submitted as evidence in traffic court to be a forgery. Oops! Submitting false evidence to the court is a big, big no-no.
The plot on the top is the DCT Plot of the evidence Image. If I have the phone, and I get the actual "original" image off the storage device, these plots should look the same. Obviously, they don't. There are other mismatches as I go through the process, but you get the idea.
The idea, and the point, is that it may be relatively easy to fool an authentication test without a valid reference. It is, however, very hard (Black Swan notwithstanding) to fool a test when you have a valid reference to test against.
The obvious message here is to not even try to submit forgeries into the court system.
But, the thing that scares me about as much as the above scenario is when law enforcement use their personal cell phones to document crime scenes. Here is one instance where "just trying to get something done" can get you into a bit of a bind. If there's a challenge to the authenticity of the images you've generated, we'll need your phone. Will you like what we find? Will you like us rooting around your phone's contents? Remember, if you receive a lawful order from your command to give up the phone to the investigation, it's a lawful order. Eliminate the potential problem and just use a separate point and shoot camera of decent quality, or engage your agency's official resources for photographing evidence.
Finally, and this one ties the whole thing together with the "screen capture rant" that I've been on. You use your personal cell phone to make a video of the monitor of a DVR at a crime scene. You use the video to make the images that lead to an arrest. All's well that ends well? No, hardly. If it turns out that the DVR had usable digital out options (like USB), and you didn't use it to secure the actual evidence, you've' just recorded yourself not properly securing the actual evidence. Oops. In that case, you may lose more than the use of your phone.
To wrap it all up, authentication is a powerful tool when done properly. It's a complex process that involves many moving pieces - the evidence file, the reference file, the reference source, procedures, chain of command, interviews, and so forth. If you're not able to account for the pieces of the puzzle, you may get an incomplete (wrong) picture.
As a favor, I loaded it into Amped's Authenticate. Sure enough, the image has been through Photoshop as indicated by the various File Analysis filters. So, the image has been "altered."
It could be contextually accurate, even though it's been through Photoshop. Does a curves adjustment invalidate an image from use? The EXIF info shows a size change and a few other problems. But EXIF information can be spoofed. Other things about an image can be fabricated in an attempt to fool authentication software. So, if this was a trial, what would you do? How would you structure your enquiry?
Should I stake my name and reputation on a software's test against a single image without a reference? No way. Not a chance. Have you ever seen a Black Swan?
Thus, I would want a reference image. If the submission is purported to be a "camera original," then I should be able to test against a reference image from the same camera. In other words, I want your camera in my lab to conduct my authentication experiments.
Here's an example that I use in my Image Authentication classes. A person turns in a cell phone picture to the police as proof that a certain ticket and tow was unjustified. In my example, a person received a parking ticket for parking in front of a fire hydrant. The person is seeking not only to have the ticket voided, but is also seeking a refund on towing and impound fees. On the face of it, there is no hydrant in the image. Case closed? No.
To do a proper test, I need a reference image. I need the camera in my lab - in this case, the person's cell phone. I take the necessary reference pictures and find that the image submitted as evidence in traffic court to be a forgery. Oops! Submitting false evidence to the court is a big, big no-no.
The plot on the top is the DCT Plot of the evidence Image. If I have the phone, and I get the actual "original" image off the storage device, these plots should look the same. Obviously, they don't. There are other mismatches as I go through the process, but you get the idea.
The idea, and the point, is that it may be relatively easy to fool an authentication test without a valid reference. It is, however, very hard (Black Swan notwithstanding) to fool a test when you have a valid reference to test against.
The obvious message here is to not even try to submit forgeries into the court system.
But, the thing that scares me about as much as the above scenario is when law enforcement use their personal cell phones to document crime scenes. Here is one instance where "just trying to get something done" can get you into a bit of a bind. If there's a challenge to the authenticity of the images you've generated, we'll need your phone. Will you like what we find? Will you like us rooting around your phone's contents? Remember, if you receive a lawful order from your command to give up the phone to the investigation, it's a lawful order. Eliminate the potential problem and just use a separate point and shoot camera of decent quality, or engage your agency's official resources for photographing evidence.
Finally, and this one ties the whole thing together with the "screen capture rant" that I've been on. You use your personal cell phone to make a video of the monitor of a DVR at a crime scene. You use the video to make the images that lead to an arrest. All's well that ends well? No, hardly. If it turns out that the DVR had usable digital out options (like USB), and you didn't use it to secure the actual evidence, you've' just recorded yourself not properly securing the actual evidence. Oops. In that case, you may lose more than the use of your phone.
To wrap it all up, authentication is a powerful tool when done properly. It's a complex process that involves many moving pieces - the evidence file, the reference file, the reference source, procedures, chain of command, interviews, and so forth. If you're not able to account for the pieces of the puzzle, you may get an incomplete (wrong) picture.
Tuesday, January 21, 2014
Open and demux native Everfocus .avr files with Amped FIVE
Here's another file type that Amped FIVE can decode, Everfocus' .avr files.
Simply select File>DVR Change Container to AVI and point FIVE to the file. It will repackage the file and open it in the view pane. If there are multiple views, you will see the first frame of the first view.
If you need to Demultiplex (demux) the video, just select Demultiplex from the Select Frames filter group.
Everfocus, like many manufacturers, use standard codecs and wrap their file with a proprietary container. This is an easy problem for FIVE to handle.
Enjoy.
Simply select File>DVR Change Container to AVI and point FIVE to the file. It will repackage the file and open it in the view pane. If there are multiple views, you will see the first frame of the first view.
If you need to Demultiplex (demux) the video, just select Demultiplex from the Select Frames filter group.
Everfocus, like many manufacturers, use standard codecs and wrap their file with a proprietary container. This is an easy problem for FIVE to handle.
Enjoy.
Monday, January 20, 2014
Don't ask, don't tell
When retrieving video evidence, law enforcement has to go into some very interesting places to access the CCTV equipment. In the course of my work, I've been in every type of building and dwelling. Given where I live and work, yes, I've been to a few "stars" homes. But, I keep what I see to myself.
Our local Sheriff's office had a hard time of it recently, as TMZ reports. They had a video evidence related warrant, and had to walk past some interesting items in one pop star's home.
Our local Sheriff's office had a hard time of it recently, as TMZ reports. They had a video evidence related warrant, and had to walk past some interesting items in one pop star's home.
Friday, January 17, 2014
What is Video Evidence?
What is video evidence?
According to Elliott Goldstein, a Woodbridge, Ont., lawyer; an acknowledged video evidence expert who lectures at the Ontario (Canada) Police College, and the author of the two-volume book, Visual Evidence: A Practitioner’s Manual, “In the old days, video images were recorded on videotapes. When it came to submitting them as evidence, there was no problem: You just took the original tape into court and played it for the judge and jury. But today most [surveillance] video is recorded on hard disk drives, which are routinely wiped as new data comes in. This means that the video evidence has to be downloaded onto a DVD or digital tape, requiring very careful procedures, witnessing, and documentation to prove that you have an unedited ‘exact duplicate copy’ of the original.”
According to Jonathan Hak, “The party tendering video evidence must establish how the video was recorded, what impact the recording process had on the captured video, whether the exporting of the video evidence has further comprised the reliability of the images and whether all relevant video has been obtained of the incident in question.” As a result, “video evidence must be authenticated in order to gain admissibility in court. Authentication can be accomplished by witnesses familiar with the video content — for example, the person who captured the video images — or technically, showing that the images have not be altered in any improper way. This is a requirement of both the Canada Evidence Act and common law.”
According to LEVA, "Multimedia Evidence. Analog or digital media, including, but not limited to, film, tape, magnetic and optical media, and/or the information contained therein. NOTE: The term Digital Multimedia Evidence (DME) used in this document refers specifically to multimedia evidence in a digital form."
According to the IAI/LEVA Glossary, "Digital Evidence. (CER) Information of probative value that is stored or transmitted in binary form."
Does video evidence in digital form have to be downloaded or exported so that you have "an unedited ‘exact duplicate copy’ of the original?” LEVA's guide notes that in acquiring DME, one should "Transfer all relevant media files from the DVR." Download, export, transfer. Seems like there's some agreement.
LEVA adds what the Flip Book notes, "In addition to acquiring the native video files, a transcoded copy (eg: .avi) may provide an interoperable format for ease of use by investigators." Securing and protecting the native video files (evidentiary data) is the goal of securing video evidence."
Thus, I think that we can say that digital multimedia evidence (video) from digital CCTV systems should be retrieved in digital form. Any deviation from this should be done with extreme care and only in the worst case scenario.
Authenticating digital evidence employs various schemes that look at the underlying math within the container, changes to the container, and so forth. If you've retrieved the proprietary/native data and the authenticity of the data is challenged, you have the original export/transfer to test against and (hopefully) the DVR that produced it. The rest is pretty straight forward time consuming work.
Worst case scenarios call for solutions like screen capture hardware/software and/or scan converters. These options don't actually secure (download, export, transfer) the native data, they take a picture of it. Can you authenticate screen grabs? Maybe. "This screen grab has not been altered." But, if you didn't actually secure the native data or seize the DVR, how do you show that the screen grab depicts what it's supposed to depict? How do you tell the DVR's story? What if there's a challenge to the authenticity of what's depicted (as happened in People v Abdullah, BA353334 - Los Angeles County Superior Court, December 2009)?
I've processed DME from recorders that I didn't download, from scenes that I've never been to. I rely on chain of custody documents, notes from the field, and etc. Remember, thanks to Melendez-Diaz, everyone in the chain of custody may have to testify. So, if you, your first responders, or your investigators are using worst case tools as their main option - they may eventually have to testify.
I realize that agencies are overtasked and understaffed. I understand that well-meaning folks are "just trying to get things done." I understand that most have the best interests of all parties in mind. I also understand that video evidence (DME) is evidence - and should be treated as such. It's not "just video." Often times, its the only witness to the events of the day. Please don't let expediency guide your path. "Video evidence is a lot like nitroglycerin: Properly handled, it can demolish an opposing counsel’s case. Carelessly managed, it can blow up in your face.
According to Elliott Goldstein, a Woodbridge, Ont., lawyer; an acknowledged video evidence expert who lectures at the Ontario (Canada) Police College, and the author of the two-volume book, Visual Evidence: A Practitioner’s Manual, “In the old days, video images were recorded on videotapes. When it came to submitting them as evidence, there was no problem: You just took the original tape into court and played it for the judge and jury. But today most [surveillance] video is recorded on hard disk drives, which are routinely wiped as new data comes in. This means that the video evidence has to be downloaded onto a DVD or digital tape, requiring very careful procedures, witnessing, and documentation to prove that you have an unedited ‘exact duplicate copy’ of the original.”
According to Jonathan Hak, “The party tendering video evidence must establish how the video was recorded, what impact the recording process had on the captured video, whether the exporting of the video evidence has further comprised the reliability of the images and whether all relevant video has been obtained of the incident in question.” As a result, “video evidence must be authenticated in order to gain admissibility in court. Authentication can be accomplished by witnesses familiar with the video content — for example, the person who captured the video images — or technically, showing that the images have not be altered in any improper way. This is a requirement of both the Canada Evidence Act and common law.”
According to LEVA, "Multimedia Evidence. Analog or digital media, including, but not limited to, film, tape, magnetic and optical media, and/or the information contained therein. NOTE: The term Digital Multimedia Evidence (DME) used in this document refers specifically to multimedia evidence in a digital form."
According to the IAI/LEVA Glossary, "Digital Evidence. (CER) Information of probative value that is stored or transmitted in binary form."
Does video evidence in digital form have to be downloaded or exported so that you have "an unedited ‘exact duplicate copy’ of the original?” LEVA's guide notes that in acquiring DME, one should "Transfer all relevant media files from the DVR." Download, export, transfer. Seems like there's some agreement.
LEVA adds what the Flip Book notes, "In addition to acquiring the native video files, a transcoded copy (eg: .avi) may provide an interoperable format for ease of use by investigators." Securing and protecting the native video files (evidentiary data) is the goal of securing video evidence."
Thus, I think that we can say that digital multimedia evidence (video) from digital CCTV systems should be retrieved in digital form. Any deviation from this should be done with extreme care and only in the worst case scenario.
Authenticating digital evidence employs various schemes that look at the underlying math within the container, changes to the container, and so forth. If you've retrieved the proprietary/native data and the authenticity of the data is challenged, you have the original export/transfer to test against and (hopefully) the DVR that produced it. The rest is pretty straight forward time consuming work.
Worst case scenarios call for solutions like screen capture hardware/software and/or scan converters. These options don't actually secure (download, export, transfer) the native data, they take a picture of it. Can you authenticate screen grabs? Maybe. "This screen grab has not been altered." But, if you didn't actually secure the native data or seize the DVR, how do you show that the screen grab depicts what it's supposed to depict? How do you tell the DVR's story? What if there's a challenge to the authenticity of what's depicted (as happened in People v Abdullah, BA353334 - Los Angeles County Superior Court, December 2009)?
I've processed DME from recorders that I didn't download, from scenes that I've never been to. I rely on chain of custody documents, notes from the field, and etc. Remember, thanks to Melendez-Diaz, everyone in the chain of custody may have to testify. So, if you, your first responders, or your investigators are using worst case tools as their main option - they may eventually have to testify.
- Did you secure the evidence from the recorder?
- How did you secure the evidence from the recorder?
- Are your field and/or processing notes available?
- Are these the native/proprietary files from the recorder?
- If not, why not?
- What is your training and experience with your tools?
- Did your agency approve your tools' use for collecting evidence?
- Did your collection method comply with your agency's procedures for collecting and securing evidence of this type?
- Are your methods and tools commonly accepted in the industry?
- Are you aware of people in your field of expertise who may not agree with yours / your agency's methodology for retrieving this type of evidence? What are their arguments against your methods?
These are all questions that I've faced. How will you answer them if/when asked?
I realize that agencies are overtasked and understaffed. I understand that well-meaning folks are "just trying to get things done." I understand that most have the best interests of all parties in mind. I also understand that video evidence (DME) is evidence - and should be treated as such. It's not "just video." Often times, its the only witness to the events of the day. Please don't let expediency guide your path. "Video evidence is a lot like nitroglycerin: Properly handled, it can demolish an opposing counsel’s case. Carelessly managed, it can blow up in your face.
Thursday, January 16, 2014
Oops, they did it again
Our friends at Ocean Systems sent a spam recently, announcing their Omnivore Field Kit overview webinar. I'm wondering if attendees are allowed to ask questions.
In the webinar, you will learn how to "quickly and easily [capture] uncompressed crime scene video directly from any DVR source." Really?! We went over this already. Omnivore is a nice "last / worse case" option. While you are capturing the contents of the graphics buffer for the computer on which you are running the Omnivore, the actual data (evidence) is still sitting on the DVR. The Omnivore does not actually retrieve the evidence (data) from the system. It takes a picture of the screen that displays the video signal.
The fact that it does screen scrapes in an uncompressed and easy fashion is great. However, they're still screen scrapes. You're still grabbing video signal - when your evidence is the data on the DVR.
So, if you are interested in retrieving digital multimedia evidence from crime scenes, there are a number of ways to do it. On your list of ways, grabbing the signal from the graphics buffer should be your last option - after seizing the DVR is ruled out.
Seriously, why are we still talking about this?!
CCTV schemes face budget realities
Citywide CCTV schemes often are started with great fanfare and media hype. Today, whilst preparing for work, I had the news on blaring the announcement of a major west coast LE agency testing body worn video.
But, as this article illustrates, once the news cameras are gone and the realities of maintaing the service set in, cuts are made.
There seems to be no limit to grant funds and special allocations to purchase gear to solve particular problems. The initial group of operators get trained. A few media-worthy events are highlighted, proving the worth of the scheme.
But, what about 3 years later? What happens when the service contract expires? What happens when new employees need training? What happens when …
Politicians love soundbites and headlines. They'll get the ribbon-cut they need in order to get re-elected, or elected to a different office. Yet, the real work begins long before the cameras show up. The real work begins at the planning stage.
Maintenance budget? Training budget? Storage budget? FOIA budget? Staff budget? Then, say five years later, when the gear is obsolete, you'll need to replace it all and start over.
But, as this article illustrates, once the news cameras are gone and the realities of maintaing the service set in, cuts are made.
There seems to be no limit to grant funds and special allocations to purchase gear to solve particular problems. The initial group of operators get trained. A few media-worthy events are highlighted, proving the worth of the scheme.
But, what about 3 years later? What happens when the service contract expires? What happens when new employees need training? What happens when …
Politicians love soundbites and headlines. They'll get the ribbon-cut they need in order to get re-elected, or elected to a different office. Yet, the real work begins long before the cameras show up. The real work begins at the planning stage.
Maintenance budget? Training budget? Storage budget? FOIA budget? Staff budget? Then, say five years later, when the gear is obsolete, you'll need to replace it all and start over.
Wednesday, January 15, 2014
Adobe resets the Photoshop trial clock
Adobe announced an update to Photoshop (14.2). "Today we’re announcing the immediate availability of new Photoshop CC features for Creative Cloud members. This update to Photoshop CC (version 14.2) includes many new features, including Perspective Warp for manipulating multiple perspectives in an image, and linked Smart Objects for easier reuse of design elements. We are also delighted to deliver support for 3D printing in Photoshop CC. Now you can design, edit and print in 3D using the world’s best imaging tool.
We want everyone to have a chance to try out these new features, as well as other features like Adobe Generator, which was introduced last September with the release of Photoshop CC version 14.1, and those released in the first version of Photoshop CC (version 14). We are excited to announce that we are resetting the trial clock for everyone today. Even if you have previously tried Photoshop CC and your trial has expired, now you can try the latest version of Photoshop CC for an additional 30 days and test-drive these awesome new features."
We want everyone to have a chance to try out these new features, as well as other features like Adobe Generator, which was introduced last September with the release of Photoshop CC version 14.1, and those released in the first version of Photoshop CC (version 14). We are excited to announce that we are resetting the trial clock for everyone today. Even if you have previously tried Photoshop CC and your trial has expired, now you can try the latest version of Photoshop CC for an additional 30 days and test-drive these awesome new features."
Tuesday, January 14, 2014
Hidden files
I recently received a help request. The investigator had a Lorex DVR and was trying to download files to his USB flash drive. He seemed to be doing everything right. Yet, no files were on the drive after completion of the process … or were there?
For some reason, Windows had assigned .264 files as hidden or an unknown file type. As such, the .264 files weren't being displayed. The fix is quick and simple. In Tools>Folder Options, make sure to show hidden files and folders.
With this quick fix, the problem was solved.
For some reason, Windows had assigned .264 files as hidden or an unknown file type. As such, the .264 files weren't being displayed. The fix is quick and simple. In Tools>Folder Options, make sure to show hidden files and folders.
With this quick fix, the problem was solved.
Monday, January 13, 2014
Bunker Hill Security DVR
If you've encountered a Bunker Hill Security DVR (Harbor Freight) at a crime scene, ask the owner about the software CD that came with the system.
Harbor Freight (USA) is selling this 8 channel recorder with 4 cameras for $299. Needless to say, a lot of folks are responding to those adds and snapping up this deal. Hopefully for you, they've kept the software CD that came with the unit.
At $299, there's no support outside of the 90 day limited warranty. The manual is no help either. The CD has a .264 to AVI converter as well as the playback software … for better or worse.
Harbor Freight (USA) is selling this 8 channel recorder with 4 cameras for $299. Needless to say, a lot of folks are responding to those adds and snapping up this deal. Hopefully for you, they've kept the software CD that came with the unit.
At $299, there's no support outside of the 90 day limited warranty. The manual is no help either. The CD has a .264 to AVI converter as well as the playback software … for better or worse.
Monday, January 6, 2014
FBI drops Law Enforcement as its Primary Mission
This just in from Foreign Policy Magazine: "The FBI's creeping advance into the world of counterterrorism is nothing new. But quietly and without notice, the agency has finally decided to make it official in one of its organizational fact sheets. Instead of declaring "law enforcement" as its "primary function," as it has for years, the FBI fact sheet now lists "national security" as its chief mission. The changes largely reflect the FBI reforms put in place after September 11, 2001, which some have criticized for de-prioritizing law enforcement activities. Regardless, with the 9/11 attacks more than a decade in the past, the timing of the edits is baffling some FBI-watchers."
" … FBI spokesman Paul Bresson told Foreign Policy. He noted that the FBI's website has long-emphasized the agency's national security focus. "We rank our top 10 priorities and CT [counterterrorism] is first, counterintel is second, cyber is third," he said. "So it is certainly accurate to say our primary function is national security." On numerous occasions, former FBI Director Robert Mueller also emphasized the FBI's national security focus in speeches and statements …"
"Whatever the reason, the agency's increased focus on national security over the last decade has not occurred without consequence. Between 2001 and 2009, the FBI doubled the amount of agents dedicated to counterterrorism, according to a 2010 Inspector's General report. That period coincided with a steady decline in the overall number of criminal cases investigated nationally and a steep decline in the number of white-collar crime investigations."
"Violent crime, property crime and white-collar crime: All those things had reductions in the number of people available to investigate them," former FBI agent Brad Garrett told Foreign Policy. "Are there cases they missed? Probably."
This might explain the rise in the number of LE agencies who reported that the FBI lab was little/no help in their criminal investigations.
" … FBI spokesman Paul Bresson told Foreign Policy. He noted that the FBI's website has long-emphasized the agency's national security focus. "We rank our top 10 priorities and CT [counterterrorism] is first, counterintel is second, cyber is third," he said. "So it is certainly accurate to say our primary function is national security." On numerous occasions, former FBI Director Robert Mueller also emphasized the FBI's national security focus in speeches and statements …"
"Whatever the reason, the agency's increased focus on national security over the last decade has not occurred without consequence. Between 2001 and 2009, the FBI doubled the amount of agents dedicated to counterterrorism, according to a 2010 Inspector's General report. That period coincided with a steady decline in the overall number of criminal cases investigated nationally and a steep decline in the number of white-collar crime investigations."
"Violent crime, property crime and white-collar crime: All those things had reductions in the number of people available to investigate them," former FBI agent Brad Garrett told Foreign Policy. "Are there cases they missed? Probably."
This might explain the rise in the number of LE agencies who reported that the FBI lab was little/no help in their criminal investigations.
Friday, January 3, 2014
It's time to update your antivirus software
Trend Micro reported, "We recently came across a CryptoLocker variant that had one notable feature—it has propagation routines.
Analysis of the malware, detected as WORM_CRILOCK.A, shows that this malware can spread via removable drives. This update is considered significant because this routine was unheard of in other CRILOCK variants. The addition of propagation routines means that the malware can easily spread, unlike other known CRILOCK variants.
Aside from its propagation technique, the new malware bears numerous differences from known CryptoLocker variants. Rather than relying on a downloader malware—often UPATRE— to infect systems, this malware pretends to be an activator for various software such as Adobe Photoshop and Microsoft Office in peer-to-peer (P2P) file sharing sites. Uploading the malware in P2P sites allows bad guys to easily infect systems without the need to create (and send) spammed messages …"
Takeaways:
Don't steal software.
Get a good antivirus / internet security solution and keep it up to date.
Analysis of the malware, detected as WORM_CRILOCK.A, shows that this malware can spread via removable drives. This update is considered significant because this routine was unheard of in other CRILOCK variants. The addition of propagation routines means that the malware can easily spread, unlike other known CRILOCK variants.
Aside from its propagation technique, the new malware bears numerous differences from known CryptoLocker variants. Rather than relying on a downloader malware—often UPATRE— to infect systems, this malware pretends to be an activator for various software such as Adobe Photoshop and Microsoft Office in peer-to-peer (P2P) file sharing sites. Uploading the malware in P2P sites allows bad guys to easily infect systems without the need to create (and send) spammed messages …"
Takeaways:
Don't steal software.
Get a good antivirus / internet security solution and keep it up to date.
Thursday, January 2, 2014
Have you been hacked?
Here's an interesting article, NSA’s ANT Division Catalog of Exploits for Nearly Every Major Software/Hardware/Firmware. Makes you wonder ...
Thursday, December 26, 2013
Academic sources for authentication of digital images
For folks needing references for their authentication work, here's a short list (in no particular order):
- E. Kee, M.K. Johnson and H. Farid, "Digital image authentication from JPEG headers", IEEE Transactions on Information Forensics and Security, vol. 6, pp. 1066-1075, 2011.
- J. Kornblum, "Using JPEG quantization tables to identify imagery processed by software", Digital Investigation, vol. 5, pp. S21–S25, 2008.
- CCITT Recommendation T.81, ISO/IEC 10918-1:1994, "Information technology - Digital compression and coding of continuous-tone still images: Requirements and guidelines ", 1992.
- Z. Lin, J. He, X. Tang, Chi K. Tang "Fast, automatic and fine-grained tampered JPEG image detection via DCT coefficient analysis", Journal Pattern Recognition, Vol. 42, pp. 2492-2501, 2009.
- Alin C. Popescu and H. Farid, "Statistical tools for digital forensics", Lecture Notes in Computer Science, vol. 3200, pp 128-147, 2005.
- H. Farid, "Exposing digital forgeries from JPEG ghosts", IEEE Transactions on Information Forensics and Security, vol. 4, pp. 154-160, 2009.
- M.C. Stamm and K.J.R. Liu, "Forensic Detection of Image Tampering Using Intrinsic Statistical Fingerprints in Histograms", IEEE Transactions on Information Forensics and Security, vol. 5, pp. 492-506, 2010.
- J. Lukas, J. Fridrich and M. Goljan, "Digital Camera Identification from Sensor Noise ", IEEE Transactions on Information Security and Forensics, pp. 205-214, 2006.
- Mo Chen, J. Fridrich and M. Goljan , "Digital Imaging Sensor Identification (Further Study)", Proceedings. of SPIE Electronic Imaging, Security, Steganography and Watermarking of Multimedia Contents, pp. 0P-0Q, 2007.
- W. Wang, J. Dong and T. Tan, "Tampered Region Localization of Digital Color Images Based on JPEG Compression Noise", Proceedings of the 9th International Conference on Digital watermarking, pp. 120-133, 2010.
- R. Gonzalez and R. Woods, "Digital Image Processing (3rd ed.)", Prentice Hall, pp. 165–168, 2008.
- M. Kirchner and T. Gloe, "On Resampling Detection in Re-compressed Images". IEEE Workshop on Information Forensics and Security, pp. 21-25, 2009.
Wednesday, December 25, 2013
I Saw Mommy Kissing Jólnir Under the Mistletoe
Yuletide greetings from sunny Towcester Abbey, in the beautiful Sierra Pelona Mountains of California. Thanks for your support over the years.
-author unknown, but many thanks to Pye O'Malley-
A Viking-Asatru Christmas Carol
‘Twas the night before Christmas and all through the Hall
Not a creature was stirring, not warrior nor thrall.
And I in my armor, my greaves and my helm
Was drunker than anyone else in the Realm.
I staggered upstairs and fell into bed
While four quarts of mead were ablaze in my head.
Then up from below came the sounds of a brawl
So I grabbed up my axe and ran down to the Hall.
I missed the last step and crashed down in a heap
Thinking, “Why can’t those low-lifes downstairs go to sleep!”
When what to my wondering eyes should appear
But two brawny strangers, wielding mallet and spear.
I said to myself, “We’ll soon have them beat!”
Then I noticed ten warriors laid out at their feet.
I gave out a yell and leapt into the fray…
I’ll always regret my poor choice of that day.
For the one laid his hammer to the side of my nose
And up, up, up to the rafters I rose.
Then came a lone frightened voice from the floor,
“Those are no mortal warriors — that’s Odin and Thor!”
Then they looked at each other and they said, “Battle’s done.
Now they know who we are, it no longer is fun.”
Then Thor raised his hammer, and his elbow he bent,
And with a loud crash, through the ceiling they went.
I crawled through the Hall and flung open the door,
Not really sure that I’d seen them before.
The snow bathed in starlight, the moon like a glede,
I saw them ride off on an eight-legged steed.
And I heard them exclaim, ‘ere they flew out of sight,
“TO HELA WITH CHRISTMAS, WE JUST LOVE A GOOD FIGHT!”
-author unknown, but many thanks to Pye O'Malley-
Tuesday, December 24, 2013
Authenticate Warning Software Keywords
Software developers can't know everything from every corner of the world. That's a given. So when it comes to selling a single piece of software around the world, it helps to make using it as flexible as possible.
Amped Software's Authenticate features this hidden gem in the Program Options>File Format dialog, you can customize the Keywords. In my practice, I see a lot of images carved out of physical dumps from cell phones. There's no way of keeping track of all the different apps from all the different countries. But, as I encounter a new one, I can research it and find out what it does to the image. Then, I can add it to the list of Keywords.
I can also export the settings file (Save Settings) to share with the court or a co-worker - or load someone else's settings file. In this way, we can easily QA another expert's work, or collaborate with the larger community of experts.
It's just another reason why Authenticate is head and shoulders above the competition.
Monday, December 23, 2013
Authenticate file type support
Folks have been wondering if Amped Software's Authenticate works with image file types other than those found on social media sites. Based on the early marketing of the product, many think it's just for .jpeg files. Well, that's not true. Unlike FourMatch (which only supports .jpeg files from within Photoshop, Amped Authenticate supports all the most common image formats and many of the uncommon ones too.
Currently it allows the user to work with the following formats: Jpeg, Tiff, Bitmap, PNG, TGA, Jpeg 2000, Ico, GIF, Dicom, EMF, EPS, Photo PCD, XPM and Raw camera formats from most manufacturers.
Since the most common format is JPEG, some of the filters are exclusively designed to analyze the features of this format. In any case, all the filters that work on the pixel data will work on any kind of image as well as the analysis of metadata (if present) also supports almost all the formats.
This serves as great news for those folks investigating academic fraud. Many of these cases involve Dicom images used in academic articles. Now, you have a better option than HHS - Office of Research Integrity's Forensic Droplets. "The image can be resized and reoriented using "Free Transform" in the Edit Menu to test alignment of the images." Are you F--ing kidding me?! Free transform?!
Thankfully, with Authenticate, you have an option rooted in sound science.
Currently it allows the user to work with the following formats: Jpeg, Tiff, Bitmap, PNG, TGA, Jpeg 2000, Ico, GIF, Dicom, EMF, EPS, Photo PCD, XPM and Raw camera formats from most manufacturers.
Since the most common format is JPEG, some of the filters are exclusively designed to analyze the features of this format. In any case, all the filters that work on the pixel data will work on any kind of image as well as the analysis of metadata (if present) also supports almost all the formats.
This serves as great news for those folks investigating academic fraud. Many of these cases involve Dicom images used in academic articles. Now, you have a better option than HHS - Office of Research Integrity's Forensic Droplets. "The image can be resized and reoriented using "Free Transform" in the Edit Menu to test alignment of the images." Are you F--ing kidding me?! Free transform?!
Thankfully, with Authenticate, you have an option rooted in sound science.
Friday, December 20, 2013
Effective Courtroom Testimony: Trick Questions
This just in from Digital Forensic Investigator, "The cross-examination can be very tricky and quickly make you appear to be feeble minded. There are two types of questions often asked to catch you off guard, whereby attempting to discredit your testimony.
Once you have deciphered which type of question you are being asked, thoroughly think through your answer before speaking, and then answer with confidence."
To find out more, click here.
- Ambiguous Question: This type of question is designed to have a double meaning. Therefore, no matter how you answer, it can be turned around and used against you. The solution is to request clarification or ask for the question to be rephrased before attempting to answer.
- Two-part Question: This type of question is usually asked because the person asking it is knowingly aware that one part of the question is obviously true and the other part is obviously false. Therefore, if you attempt to answer both parts of the question at the same time, you will be caught in a “Catch 22.” The solution is to answer only one part of the question. Select which part of the question you would like to answer, then simply state, “Since this is a two-part question, let me answer the (first/second) part.” Do not automatically start to answer the other part of the question when you finish the first part. Let the other part of the question be redirected to you.
Once you have deciphered which type of question you are being asked, thoroughly think through your answer before speaking, and then answer with confidence."
To find out more, click here.
Thursday, December 19, 2013
Salient Sciences
A lot of folks were wondering what happened to Salient Stills. It turns out, they're back ...
Salient Sciences = DAC + Salient Stills!
You might remember that Salient Stills was quietly acquired in July by DAC. The combined company has been rebranded as Salient Sciences. The new company announced an update to VideoFOCUS Pro, "In January, we will be releasing the latest VideoFOCUS Pro version 4.1, which incorporates a number of improvements, including drag-and-drop import of videos and image sequences and greatly expanded file format support through FFMPEG."
Salient Sciences = DAC + Salient Stills!
You might remember that Salient Stills was quietly acquired in July by DAC. The combined company has been rebranded as Salient Sciences. The new company announced an update to VideoFOCUS Pro, "In January, we will be releasing the latest VideoFOCUS Pro version 4.1, which incorporates a number of improvements, including drag-and-drop import of videos and image sequences and greatly expanded file format support through FFMPEG."
Monday, December 16, 2013
The MAVEN Project
Amped Software recently announced it's participation in the MAVEN Project. "Amped to develop new image and video forensic technologies with the MAVEN European Project.
Most of our research and development activities are done internally within our company, but we also believe in cooperation with university and research institutes to further push the state of the art of the current technologies in the forensic field. In this context, we are happy to announce that we are joining the MAVEN European Project: we really think that the scientific and technical expertise of the other institutions involved in the project will allow us to develop new outstanding in the field of image and video forensics."
"MAVEN is a collaborative project among seven European partners, which has been selected by the European Commission as one of the projects funded under the “Research for the benefit of SMEs” programme, in the 7th Framework Programme. The focus of this programme is to foster applied research driven by the needs of small and medium-sized companies, with the aim of producing a positive impact on their business in the short term. As for MAVEN, its technical goal is to develop market-ready, efficient and robust tools for the management and authenticity verification of multimedia contents. The project officially started on October 1st, and will run for 24 months until September 30th, 2015."
"Despite the advances in the Security and Media sectors, MAVEN arises from the need of providing such industries with a suite of advanced technological solutions, able to operate in a range of realistic scenarios (CCTV, web images, broadcast data, etc). The project results will allow SMEs, law enforcement bodies, press agencies, insurance companies and broadcasting companies, among others, to manage their multimedia assets and verify its integrity and authenticity, all in an efficient and scalable manner."
"MAVEN project will develop a set of tools for multimedia data management and security. The project’s objectives will be centered on two key concepts: “SEARCH” and “VERIFY”, both integrated in a coherent manner. This “search and verify” concept is not supported in an integrated manner by any tool currently available in the market."
With the impressive list of companies involved in the Project, it should be very interesting to see what comes of it all.
Most of our research and development activities are done internally within our company, but we also believe in cooperation with university and research institutes to further push the state of the art of the current technologies in the forensic field. In this context, we are happy to announce that we are joining the MAVEN European Project: we really think that the scientific and technical expertise of the other institutions involved in the project will allow us to develop new outstanding in the field of image and video forensics."
"MAVEN is a collaborative project among seven European partners, which has been selected by the European Commission as one of the projects funded under the “Research for the benefit of SMEs” programme, in the 7th Framework Programme. The focus of this programme is to foster applied research driven by the needs of small and medium-sized companies, with the aim of producing a positive impact on their business in the short term. As for MAVEN, its technical goal is to develop market-ready, efficient and robust tools for the management and authenticity verification of multimedia contents. The project officially started on October 1st, and will run for 24 months until September 30th, 2015."
"Despite the advances in the Security and Media sectors, MAVEN arises from the need of providing such industries with a suite of advanced technological solutions, able to operate in a range of realistic scenarios (CCTV, web images, broadcast data, etc). The project results will allow SMEs, law enforcement bodies, press agencies, insurance companies and broadcasting companies, among others, to manage their multimedia assets and verify its integrity and authenticity, all in an efficient and scalable manner."
"MAVEN project will develop a set of tools for multimedia data management and security. The project’s objectives will be centered on two key concepts: “SEARCH” and “VERIFY”, both integrated in a coherent manner. This “search and verify” concept is not supported in an integrated manner by any tool currently available in the market."
With the impressive list of companies involved in the Project, it should be very interesting to see what comes of it all.
Thursday, December 12, 2013
Photoshop as an amazing verb
“If a person in an image looks so pristine they look unreal, 90 percent of the time it is unreal,” she continued. “Photoshop is an amazing tool and I love it (otherwise I wouldn’t have spent years learning it), but I wanted to point out that it can be — and is — often abused.” - Anna Hill.
This just in from theblaze.com, "When you flip open a magazine or watch an ad on primetime TV, how much of the makeup or fashion model you’re seeing is real, and how much has been digitally enhanced?
Anna Hill, who’s been using Photoshop since she was in her teens, is highly aware of how much we’re shown that’s been faked using technology, as demonstrated in a recent viral video that showed such a transformation in progress.
“Many are edited so much, they may as well be advertising Photoshop rather than what they sell,” the 24-year-old student told TheBlaze in an email.
For her final advanced digital photography class project at East Carolina University, Hill “thought it would be fun to make fun of how much beauty ads are digitally enhanced.”
Whilst the work and the commentary have more to do with beauty and the media, it's illustrative to know just how much Photoshop can alter your reality.
Is it a good or bad thing? It depends. Check out Anna Hill's work here and see for yourself.
This just in from theblaze.com, "When you flip open a magazine or watch an ad on primetime TV, how much of the makeup or fashion model you’re seeing is real, and how much has been digitally enhanced?
Anna Hill, who’s been using Photoshop since she was in her teens, is highly aware of how much we’re shown that’s been faked using technology, as demonstrated in a recent viral video that showed such a transformation in progress.
“Many are edited so much, they may as well be advertising Photoshop rather than what they sell,” the 24-year-old student told TheBlaze in an email.
For her final advanced digital photography class project at East Carolina University, Hill “thought it would be fun to make fun of how much beauty ads are digitally enhanced.”
Photo credit: Anna Hill
Whilst the work and the commentary have more to do with beauty and the media, it's illustrative to know just how much Photoshop can alter your reality.
Is it a good or bad thing? It depends. Check out Anna Hill's work here and see for yourself.
Friday, December 6, 2013
Testing the Resolution of the Human Eye
Thanks to @spreadys for this article.
"All sorts of wild guesses and theoretical calculations exist about what the resolution of the human eye is, with 576MP a common claim.
No one we can find has ever actually tested it . . . until now.
In this report, we share our findings of testing various resolution IP cameras against the human eye.
Results Summary
Here's a summary of the full test results, explained inside the report …"
"All sorts of wild guesses and theoretical calculations exist about what the resolution of the human eye is, with 576MP a common claim.
No one we can find has ever actually tested it . . . until now.
In this report, we share our findings of testing various resolution IP cameras against the human eye.
Results Summary
Here's a summary of the full test results, explained inside the report …"
Wednesday, December 4, 2013
Administration to review facial recognition technology
With agencies looking at facial recognition technology, this article notes that the Obama administration is taking a look at it from the privacy standpoint. "The Obama administration on Tuesday said it plans to review the privacy implications of facial recognition technology.Lawmakers and privacy advocates have expressed fears that tech companies and government agencies are using facial recognition technologies to track people, often without their knowledge."
Sen. Ed Markey (D-Mass.) ... applauded the [Commerce Department’s National Telecommunications and Information Administration (NTIA)] move. “Clear policies that support consumer privacy are crucial as facial recognition technology is developed and deployed,” he said. “While these technologies hold great promise for innovation, consumers — not companies — should to be in control of their sensitive personal information, including having the choice to affirmatively opt-in to being subject to facial recognition or detection.”
The [NTIA] said the first meeting about the technology will take place Feb. 6, 2014.
Sen. Ed Markey (D-Mass.) ... applauded the [Commerce Department’s National Telecommunications and Information Administration (NTIA)] move. “Clear policies that support consumer privacy are crucial as facial recognition technology is developed and deployed,” he said. “While these technologies hold great promise for innovation, consumers — not companies — should to be in control of their sensitive personal information, including having the choice to affirmatively opt-in to being subject to facial recognition or detection.”
The [NTIA] said the first meeting about the technology will take place Feb. 6, 2014.
Monday, December 2, 2013
Lock It, Hide It, Keep It
Normally, I stay away from comments about policing in Los Angeles. Today, however, I'm going to use a recent marketing campaign in Los Angeles to make a point about point about CCTV in particular and policing in general.
According to the LA Daily News, there have been 23,265 thefts from motor vehicles in Los Angeles thus far this year. This time last year, there were 23,531. This time in 2011, there were 22,614. These numbers represent those crimes actually reported.
With the blanketing of Los Angeles with CCTV cameras, and with the Mayor's goal of 10,000 sworn officers being met in 2009, you'd think that property crimes would be reduced significantly. But they haven't.
If you can imagine the range of crimes being investigated, and the relatively low priority of property crimes, then you can understand why there are only about 6 or 7 staff assigned per geographical area to investigate property crimes. The total might be around 100 investigators. These 100 are responsible for over 23k crimes. That's a huge caseload.
Enter CCTV. It's everywhere. If it's a deterrent, then crime should be down significantly. But, again, it's not. The tech is old, under maintained, and generally not fit for purpose. In many cases, companies have just replaced their old VCRs with a DVR. No upgrades to cameras or lenses. Many are trying to cover entire parking lots from roof-top cameras with small lenses.
With a few police agencies actually publishing lists of crimes that won't generate a police response, and most having informal/internal policies about response priorities, this new marketing campaign's admission is probably the best advice.
Crime is out of control. In Los Angeles, there have been over 90k Part 1 Crimes year to date. If you live in a small town, like me, that number is staggering and almost incomprehensible. There are so many crimes in most major cities that CrimeMapping.com can only map a few months of data before running out of room on its map.
In the end, the police marketing seems accurate. The steps you take are your best defense against crime.
According to the LA Daily News, there have been 23,265 thefts from motor vehicles in Los Angeles thus far this year. This time last year, there were 23,531. This time in 2011, there were 22,614. These numbers represent those crimes actually reported.
With the blanketing of Los Angeles with CCTV cameras, and with the Mayor's goal of 10,000 sworn officers being met in 2009, you'd think that property crimes would be reduced significantly. But they haven't.
If you can imagine the range of crimes being investigated, and the relatively low priority of property crimes, then you can understand why there are only about 6 or 7 staff assigned per geographical area to investigate property crimes. The total might be around 100 investigators. These 100 are responsible for over 23k crimes. That's a huge caseload.
Enter CCTV. It's everywhere. If it's a deterrent, then crime should be down significantly. But, again, it's not. The tech is old, under maintained, and generally not fit for purpose. In many cases, companies have just replaced their old VCRs with a DVR. No upgrades to cameras or lenses. Many are trying to cover entire parking lots from roof-top cameras with small lenses.
With a few police agencies actually publishing lists of crimes that won't generate a police response, and most having informal/internal policies about response priorities, this new marketing campaign's admission is probably the best advice.
Crime is out of control. In Los Angeles, there have been over 90k Part 1 Crimes year to date. If you live in a small town, like me, that number is staggering and almost incomprehensible. There are so many crimes in most major cities that CrimeMapping.com can only map a few months of data before running out of room on its map.
In the end, the police marketing seems accurate. The steps you take are your best defense against crime.
Wednesday, November 27, 2013
Authenticate's Global Launch
Amped Software just announced the global release of Authenticate. "After years of hard work we are finally glad to announce the immediate global availability of Amped Authenticate, the world’s most complete and advanced tool for analyzing the authenticity of an image. We are just at the first release and there is so much more we are working on, but there is no other tool on the market with all of Authenticate’s features, including:
- More than 20 different filters to analyze different aspect of a digital image file, both for forgery detection and camera ballistics
- Most of the filters allows advanced comparison of the output between two images
- Batch tools to automatically analyze large numbers of images
- Integration with Flickr, Google Images, Google Maps and TinEye
I've been working with the limited release version and it's an amazing program. But, don't take my word for it. Request a demo and take it for a spin yourself.
Tuesday, November 26, 2013
Photoshop Photography Program at a great price
Adobe recently announced that for a limited time, you can join a special Creative Cloud plan. It includes access to Photoshop CC and Lightroom 5, plus feature updates and upgrades as they are available, 20GB of cloud storage for file sharing and collaboration, and a Behance ProSite. And it's just US $9.99/month when you sign up for a one-year plan, but you need to join by December 2, 2013.
Monday, November 25, 2013
Image Authentication experts wanted - in China
The South China Morning Post recently reported that as more and more Chinese officials are being blackmailed using faked digital photographs, the government is asking scientists for help."Research teams at major universities have received funding from the central government to come up with ways to help the authorities quickly determine whether an image has been manipulated by photo-editing software such as Photoshop."
It's a worldwide problem - forgeries of photographs. With this news, I'll bet the folks at Amped Software are working on a Chinese language version of Authenticate.
It's a worldwide problem - forgeries of photographs. With this news, I'll bet the folks at Amped Software are working on a Chinese language version of Authenticate.
Friday, November 22, 2013
Creative Cloud Status Monitor
From time to time, as with any service, the Adobe Creative Cloud experiences problems. The easiest way to see if your service issues are on Adobe's side is to check their Status Monitor. Here's the link.
Thursday, November 21, 2013
NightThief Forensic Imaging Technology
I received the usual PoliceOne.com spam announcing a new company in the forensic imaging marketplace, FRP Forensic Imaging’s new NightThief forensic imaging technology.
The OCD in me was alerted by the specific use of several words in the piece - like technology vs. software or product and "restoration" vs clarification or enhancement. The OCD went into overdrive with this bit, "NightThief imaging is available as a controlled service built around uncompromising ethics and usage frameworks. FRP Imaging’s commitment to responsible forensic imaging includes strict submission requirements, chain of custody prerequisites, and a no-nonsense licensing model designed to facilitate smarter criminal investigations while protecting the privacy and liberties of innocent individuals." What's a "controlled service?" Submission requirements?
But then, the issue was laid to rest, "Because NightThief imaging is a service, there are no upfront costs, investments in time, equipment, training, or commitments required. More importantly, NightThief is built for speed with processing times rarely exceeding three days – and critical cases much faster! Dynamic all-inclusive per-event pricing based on senior agency involvement and community population provides simple, predictable, and affordable world-class forensic imaging to organizations and communities of all sizes." It's a service with per-event pricing. Ok. First question, who's going to come to Los Angeles to testify about the work done on the images?
So, I went to the web site - FRP Imaging. It seems that FRP stands for Forensic Reverse Pixelation. I couldn't find out what they mean by the term, but it seems that they're a tech start-up coming out of the movie special effects industry.
Judging from their FAQ page, they may run into significant resistance over a few of their policies.
The OCD in me was alerted by the specific use of several words in the piece - like technology vs. software or product and "restoration" vs clarification or enhancement. The OCD went into overdrive with this bit, "NightThief imaging is available as a controlled service built around uncompromising ethics and usage frameworks. FRP Imaging’s commitment to responsible forensic imaging includes strict submission requirements, chain of custody prerequisites, and a no-nonsense licensing model designed to facilitate smarter criminal investigations while protecting the privacy and liberties of innocent individuals." What's a "controlled service?" Submission requirements?
But then, the issue was laid to rest, "Because NightThief imaging is a service, there are no upfront costs, investments in time, equipment, training, or commitments required. More importantly, NightThief is built for speed with processing times rarely exceeding three days – and critical cases much faster! Dynamic all-inclusive per-event pricing based on senior agency involvement and community population provides simple, predictable, and affordable world-class forensic imaging to organizations and communities of all sizes." It's a service with per-event pricing. Ok. First question, who's going to come to Los Angeles to testify about the work done on the images?
So, I went to the web site - FRP Imaging. It seems that FRP stands for Forensic Reverse Pixelation. I couldn't find out what they mean by the term, but it seems that they're a tech start-up coming out of the movie special effects industry.
Judging from their FAQ page, they may run into significant resistance over a few of their policies.
- "Does any other company perform FRP Imaging or use NightThief™ technology? No. FRP Forensic Imaging™ and NightThief™ technologies are exclusive services of FRP Imaging."
How will they handle the reliability/repeatability questions if they don't share their technology? What happens if they're compelled to release their tech to opposing counsel? What happens when their technicians are cross-examined about how their technology works?
- "Who owns FRP-processed images? We do. To control the application or FRP images, we license copyrighted FRP-processed images to acquiring agencies. Agencies may use them freely within departments, and publicize them in association with their case specific law enforcement efforts in perpetuity."
I'm not sure how the "we license the results back to you - but we now own the file" policy is going to fly with LE agencies and the courts.
- "Are FRP images admissible in courts? Generally, yes. However, it’s important to remember FRP Imaging products are designed as investigatory tools."
An investigatory tool that's generally admissible in court - at an "affordable price."
Back to the who's going to come to your court and testify about the work and be cross examined, as is the defendant's right? No one, it seems.
- "Each FRP processed image includes a notarized sworn statement made under penalty of perjury certifying the image was not modified, original enhanced, created, edited, or manipulated in any way that adds or removes any element from the image, or portrays any suspect in an unfavorable light beyond the actual image provided. If enhancement(s) were made, it is noted along with its purpose (scale, proximity, detail, etc.) ."
How do you cross examine a "notarized sworn statement?"
I'm interested to hear back from them to find out more about how they see this working.
Subscribe to:
Posts (Atom)