Training Update

Amped Software has released the order form for their training session in Ft. Worth, Tx.

Intermediate Forensic Multimedia Analysis with Amped FIVE Professional is being presented in Ft. Worth, Tx (home of the #1 downtown in the US in 2014), May 5-9, 2014.

I hope to see you there.

FIVE in the news

Click here to check out the Gendarmerie on FranceTV using Amped FIVE to calculate the height of suspects (begins about 17:00). How cool is that?!

Training Opportunity In Texas

Course: Intermediate Forensic Multimedia Analysis

Instructor: Jim Hoerricks

Location: Ft. Worth, Tx.

Dates: May 5-9, 2014 (40 Hours)

Expectations and Goals: Graduates will acquire intermediate level training in the techniques and skills necessary to perform examinations, clarifications, and analyses on digital multimedia evidence in a “forensic science” setting as well as to package, deliver, and present those findings in their local court room context.

Sponsors: Amped Software North America and GP SIFT.

Skill Level: Intermediate. It is assumed that the student will have a basic knowledge of Forensic Multimedia Analysis and be able to navigate comfortably within the Windows computer environment.

While the registration page is being put together, click here to send your contact information to Amped Software. The registration page should be up in a few days and will contain information about the venue, host agency, costs, and hotel recommendations. I just wanted to get the word out about the opportunity as quick as possible. Also, you'll note that the class is oriented towards a Friday travel day with an afternoon departure time.

See y'all there.

An interesting use of crowd sourcing

Please consider taking a few minutes on March 28th to participate in the LEEDIR Operational Test!

What: LEEDIR (Large Emergency Event Digital Information Repository) Operational Test
When: Friday, March 28, 2014 - 9:00am - Noon PDT
How: Simply upload a random 1-3 minute video or still images shot with your cell phone. The video can be of anything, but we encourage video of people in public places, malls, shopping centers, convenience stores, vehicle traffic, etc.

The LEEDIR Eyewitness Platform INVITES YOUR PARTICIPATION!

The LEEDIR technology enables law enforcement and relief agencies to receive and rapidly analyze eyewitness videos and photos submitted by citizens during large emergency events.

Your participation in this exercise is being requested to help simulate a level of eyewitness photo and video submissions that would be expected during a major emergency event.

Law enforcement agencies around the nation have been invited to submit photos and videos to the LEEDIR platform through the LEEDIR website (leedir.us), iPhone app (available now at the App Store)
or the Android app (available March 23rd at the Google Play Store).

As submissions are uploaded, investigators at the LASD Cyber Investigations Center (CIC) will review, manage, analyze and distribute the photos and videos as they would during a real major emergency event, to better inform their emergency response teams and gather evidence. During the event, analytics and statistics will be published, followed by a press conference at SHB to broadcast the results.

More info at: http://www.leedir.us/about

Get the original

This just in from George Reis, "The March 2014 issue of California Lawyer magazine includes an article I wrote, titled, "Images: Get the Original." The original version I submitted had to go through quite a bit of editing (I wrote it before checking for length requirements, so it was too long). The points I tried to make are that when an attorney is provided with photographs or video evidence from opposing counsel, the best evidence is a bit-for-bit copy of the original, in it's original format. And, that when providing images to opposing counsel, providing bit-for-bit copies of the originals can result in fewer claims of file manipulation. The article is on page 24 of the on-line edition (link) and page 13 of the printed version."

Well done, George.

Cell phone with a camera, or camera with a phone?

John Riddell's Data Recovery Blog poses this curious question, how do you view your mobile device and how to you maintain it?

"With the increasing popularity of built in cameras with our cell phones today, it’s no longer a question as to whether you’ll use it at all but how often you’ll use it. It seems as though there is as much emphasis on the cameras in the phones today as there is memory, battery length and amount of apps we can store. I recently saw a TV commercial for a phone with a camera and the only thing they talked about were the features of the camera, nothing else."

That being said, how are you processing video/image evidence retrieved from mobile devices? Do you have the ability to safely acquire the images? Do you use your own iTunes account? With the cost of "forensic" software being relatively high, folks are "just doing what they can" to get images from phones and tablets. Some are even e-mailing images off the evidence to their own e-mail account.

Whatever you are doing, have a sound policy / practice document … and follow it.

Traditional Finger Printing Could Be A Thing Of The Past

This just in, "Computer scientists at Michigan State University have built the first three-dimensional model of a human fingerprint.

They say it will not only help today’s fingerprint matching technology do its job better, but could eventually lead to improvements in security.

The method, developed by Anil Jain, his MSU colleagues and research collaborator Nick Paulter at the National Institute of Standards and Technology, takes a two dimensional image of a fingerprint and maps it to a 3-D finger surface.

The 3-D finger surface, complete with all the ridges and valleys that make up the human fingerprint, is then made using a 3-D printer.

It creates what Jain’s team called a fingerprint "phantom."

They say that tools like this would help improve the overall accuracy of fingerprint matching systems, which eventually leads to better security in applications ranging from law enforcement to mobile phone unlock."

RIP LAPD Officer Nicholas Lee

LAPD Police Officer III Nicholas Lee, Serial No. 34980.

A man of greatness and selflessness. Nick was a great cop.

May he rest in peace. #EOW 3/7/14

- LAPD Chief Charlie Beck

Send images from Amped FIVE to Word and PowerPoint

This just in from the folks at Amped Software:

"We just released an update to FIVE with a lot of improvements, bug corrections and customer requested features.

Despite FIVE having very advanced and automated reporting capabilities, it’s undeniable that most of us use very often Word, PowerPoint and other programs to show our results to courts, customers and colleagues. They could be simple investigative reports or some tutorials for explaining how to work with images and video.

I do it daily and I was sick of saving pictures and importing them in other various applications, so we added a very convenient way to interact with third party programs.

In the latest version of Amped FIVE (release 5989), if you right click on the Save Snapshot button in the Player Panel of FIVE you will have access to new settings for the Save Snapshot button.

These are the available options:

• Save Image (Automatic Filename): the displayed image is saved in the default path, along with the current project file needed to recreate the image from scratch.
• Save Image (Selected By The User): like above, but the user can select the filename and folder of the file.
• Send Image To Clipboard: the displayed image is copied to the system clipboard to be pasted in other applications.
• Send Image To Word: the displayed image is copied in the currently opened Word document.
• Send Image to PowerPoint: the displayed image is copied in the currently opened PowerPoint document.

Additionally, there’s another new option. Sometimes you don’t want only the current image but the whole FIVE interface showing the working environment. We’ve also got this covered with the following options that can be combined with the above saving mode.

• Current Image: saves the currently displayed image alone.
• Current Window: saves the full Amped FIVE interface.
• Full Screen: saves the whole screen.

The last selection is kept in memory so the next time you simply click the button Save Snapshot it will be reapplied.

Imagine how useful it is the combination of these features: you can show and explain step by step in a document or presentation, all the operations done with FIVE."

It's amazing to have a company respond to suggestions by implementing changes in such a speedy fashion. For those agencies with pre-made report templates in MS Word, or who use MS PowerPoint extensively, this is a huge time saver.

Supreme Court of Canada halts use of expert opinions

Here's an amazing story from the Globe and Mail.

"… He said that Canadian courts had in effect been “contracting out” questions of guilt or innocence to experts. From here on, though, “any time ‘experiential’ evidence points the finger directly at the accused, that’s going to be offside. It’s not just drug cases – it’s any serious case …"

"… Ben Berger, a criminal-law specialist at Osgoode Hall Law School in Toronto, said the ruling is an attempt by the court to rein in expert witnesses, part of a trend since Ontario’s 2008 Goudge inquiry into more than a dozen wrongful convictions in baby deaths, stemming from the testimony of disgraced Toronto pathologist Charles Smith.

The Supreme Court found that “police experience on its own is something that has to be looked at with suspicion and a critical eye,” Prof. Berger said. “That’s important not just in a drug setting but in pretty much any criminal investigatory setting ...”

The $200 4TB HD for DVRs

Western Digital recently announced it's new line of hard drives built specifically for the surveillance (dCCTV) market. The new WD Purple HDD is available now in 1TB, 2TB, 3TB and 4TB capacities that are slated to cost $90, $120, $160, and $200, respectively. That's a lot of video to manage. Given the long budgeting cycle for government agencies, you better start planning on increasing your storage capacity soon.

Sony's Audio Master Suite for Mac is on sale this week

I've been using Sound Forge since it was a Sonic Foundry product. It's great for quick edits and for dealing with difficult file types. It's now available for OSX in the Audio Master Suite. The suite contains Sound Forge Pro Mac 2, SpectraLayers Pro 2, Convrt™ Batch Processing Automation Tool, Mastering and Repair Suite powered by iZotope®, and a few other goodies for only $499. This week, they've taken $100 off the price.

This is an awesome opportunity for those who are using Macs, but love Sony's audio products.

Amped FIVE update: load subtitles and a lot of other improvements

The folks at Amped Software just updated FIVE. Here's what's new:

New Load Subtitles filter

Sometimes DVR systems save timestamp information in a separate subtitle file. With this new filter you can finally view the exact timestamp printed on the video, if they are encoded as smi or srt files. The timestamp appearance can be fully customized by the user: location on the picture, size, font, style and color are fully configurable. Load Subtitles is located in the group Presentation.

Quick information on the current file

This is something very simple, but that will certainly make your life easier. Basically we added in the status bar the name of the current file and the pixel resolution of the currently displayed image, so you can always know what you are working on.

It's logical

Project S-Five

I received an invitation to take a survey being run by Project S-Five. It's an EU based study, not to be confused with Amped Software's FIVE. Here's what the project is about.

"About Project S-Five

Throughout the last decade, the digital video and surveillance industry has developed and expanded at an ever increasing pace. Unfortunately, the images and video recordings that are most often provided to forensic investigators are composed of rather low quality image data. Analysing such data requires considerable knowledge and tuning of different parameters in various software tools. As a consequence, forensic laboratories are most often overloaded with image and video analysis casework, and have experienced considerable difficulty in keeping up with recent developments both in terms of (academic and commercial) R&D and available software tools. Additionally, from an organizational point of view, an overview of the methods and procedures that are currently being used across the ENFSI member institutes is lacking. This hinders a unified methodology of dealing with this type of evidence and the development of standardization and quality assurance issues in general. Finally, there exists an urgent need for reference input material that can be used for evaluation and training of (new) investigators, for testing and validation of existing and new software tools, etc.

S-FIVE

This project will study various issues related to the Standardisation of Forensic Image and Video Enhancement (S-FIVE). The main focus of the project is oriented towards techniques that are used for improving the quality of surveillance video data and other types of images that portray persons and objects at the macroscopic level.
The S-FIVE project is a project funded by the European Commission through the European Network of Forensic Science Institutes (ENFSI) Monopoly 2011 programme "Improving Forensic Methodologies across Europe"(IFMAE).

The core S-FIVE project team is formed by researchers and investigators from BKA (Germany), CAST (UK), CSCP (Cyprus), MPS (UK), NFI (The Netherlands) and NICC-INCC (Belgium)."

As I'm filling out the survey, I could't help but remember the mantra from working with the SAPS in Pretoria - easy things should be easy. When the survey asked about difficulty, there wasn't a single question that I couldn't answer as "easy." For enhancement and analysis tasks, I use Amped's FIVE. Easy/simple things should be easy, and fast.

Here's the link to the survey: https://www.s-five.eu/limesurvey_9/index.php?sid=5

NIST Webcast on New Forensic Scientific Area Committees Set for Feb. 18, 2014

February 14, 2014

Contact: Linda Joy
301-975-2757

The NIST forensics science team is holding a public presentation and live webcast on its new Organization of Scientific Area Committees (OSAC) at the American Academy of Forensic Sciences annual meeting in Seattle, Feb. 18, 2014, 5:00 to 7:00 p.m. PST.

The establishment of OSAC is a result of a NIST and Department of Justice memorandum of understanding signed last year with the aim of improving standards and practices in forensic science laboratories.

NIST envisions uniform administration of development, promulgation and adoption of standards through the OSAC as well as supporting communication flow between the scientific area committees and the forensic science community. The intent is to bring structure, scientific rigor and increased communication among forensic scientists, research scientists, academicians, statisticians, attorneys, managers and quality assurance specialists.

The presentation will take place at the Washington State Convention Center, Ballroom 6C, Seattle, Wash.

Agenda
5:00 to 5:10: Introduction – Mark Stolorow
5:10 to 5:15: Background – Rich Cavanagh
5:15 to 5:30: Notice of Inquiry Responses – Susan Ballou
5:30 to 6:00: OSAC Plan – Barbara Guttman and John Butler
6:00 to 6:15: OSAC Membership – John Paul Jones II
6:15 to 7:00: Questions

Webcast Link: http://psav.mediasite.com/mediasite/Play/8e65ad3f9958440b8eab9da0831e3b1d1d
The presentation slides will be posted here on Tuesday, Feb. 18.

Important notes about Live Webcast:
This webcast will be streamed from Mediasite by sonicfoundry, individuals logging in from personal computers/laptops may need to:
Install Microsoft Silverlight prior to logging on – this is needed in order to view the program.
If any participants use Safari on Mavericks, they will need to disable plugins power saver option. That should be turned off so that it does not prevent the media player from loading.

What should a 101 level course contain?

Early last year, I wrote about Image Analysis Domains. I noted: "In terms of the domains of analysis, there are four agreed upon domains for forensic video/image analysis:

• Photogrammetry
• Comparison
• Content analysis
• Authentication

One common mistake made across the news reports I watched is that clarification/enhancement is analysis. To be sure, clarification/enhancement help observation and make it easier to form initial conclusions. To be part of a scientific method, they need to be reliable and repeatable. But they are not, of themselves, analysis."

In the American university system, a 101 level course is generally an introductory educational course. Thus, if you are taking a course entitled Image Analysis 101, it should contain a solid introduction to the domains of image analysis. As video can be considered a series of images, Video Analysis 101 should also contain these domains.

Now, add the word "forensic" to the title. Forensic Image (or video) Analysis 101 should contain introductory education in the analysis domains plus an introduction to "forensics." In this context, we mean using image/video analysis in legal matters. Thus, FVA 101 (or FIVA 101) should contain an introduction to the above domains within the context of the legal system for which the course is offered.

I find myself writing this in my hotel room in Tshwane, Gauteng, South Africa. South Africa's Magistrate Courts have no jury to sway our story telling. The story telling aspect of forensics is irrelevant here. The work here is almost pure image/video analysis in that the work has to stand on its own. The analyst may be called upon by the court to explain a few technical things, but largely the evidence is simply submitted for inclusion in the trial. You don't see the type of long, drawn out testimony by experts that we see in the US. To me, that's refreshing.

The domains of image/video analysis are sciences in and of themselves. As students of the craft of analysis, it's up to us to assure that we're educated and proficient in what they are and not what some vendors would like them to be. Photogrammetry, as an example, obeys certain agreed upon rules. If you are working in photogrammetry, you should understand the science behind the tools that you are using. The same is true for all of the domains.

So what does this all mean? Where am I going with this?

• 101 = an introduction to the domains of image/video analysis
• 201 = intermediate topics in the domains of image/video analysis
• 301/401 = advanced topics in the domains of image/video analysis

None of these should be exclusive to a certain toolset or manufacturer. They should equip the analyst with the knowledge of the science behind the techniques and the tools. Not just an explanation of a given tool's options for JPEG DCT examination in authentication of an image, but a deeper look at the way JPEG files work, how they are created, their history, and etc. In this way, the DCT examination will make more sense, and the American/Canadian analyst will have an easier time explaining his/her work.

If you take this approach, you may end up where I am - dissatisfied with your old tools. Try enquiring about the science behind the tools offered by the big three (Adobe, Avid, Sony). You won't get a straight answer. Their answers are trade secrets. You'll find yourself investigating the more purpose built offerings from Amped Software, Cognitech, MotionDSP, Noritsu, Salient Sciences, and Signal Scape. From there, you'll want to know which company offers both qualitative and quantitative tools. This will narrow the list significantly. You'll ask about cost, training, and general acceptance. If you want to do actual quantitative  image / video analysis, there are only a few manufacturers in this space - and they aren't the big three.

To pull all of this together, a course on FIVA 101 should be an introductory course on concepts of image and video analysis in a legal setting. It should introduce the domains and their role in the legal process. This is an entirely different course than an introduction to image/video processing with a specific tool or manufacturer. The former is considered education, the latter is considered training. Both are important. But, they are entirely different. When spending your precious funds to upgrade your knowledge, be sure to ask specific questions. Do you want training on a set of tools, or do you want education on the domains of analysis - or both.

Pardon the interruption

Greetings from South Africa.

After 2.5 days of travel covering half of the world, I'm here in Pretoria (Tshwane) working with the South African Police Service. I'm presenting training in digital multimedia evidence retrieval, advanced forensic image/video analysis, image authentication, forensic audio analysis, and case management over two very intense weeks.

South Africa is a beautiful country and I'm very happy and thankful at the opportunity to come here and assist the SAPS. Now, if only airline seats were more spacious. :)

Batch processing in Authenticate

Usually, image authentication is a one-at-a-time process. But, what if you have a bunch of images in a folder from a single source? In Amped Software's Authenticate, you can batch process the files ... saving you a ton of time.

The Batch Processing tool allows the user to automatically process many files with one or more filters configured. For example, it is possible to apply all filters to a single image; all filters to entire folders of images; or only one filter to an entire folder of images.

Since the results of processing with heavy filters are saved in the cache folders, this is a very good way to leave the computer do the work without the user intervention (like overnight if there are a lot of big files). At the end of the processing you will have the ability to analyze the results very quickly, without the need to wait the execution of every filter.

A small warning, the full processing of many images with all filters can take very long time, depending on images' size and currently active filter configurations.

But wait, there's more ...

The Batch File Format Analysis tool allows Authenticate to quickly inspect the format of all images in a folder and quickly display detailed information about the formats in a big table. This tool provides a means to do a quick triage of suspicious files that may deserve further analysis without the need to run full processing on them.

You are asked to choose a folder where to perform the analysis, and those results will be displayed in a table. The displayed information is from the files present in the filter [File Format].

Specific features from the analysis of the image that can be a possible warning of image tampering are displayed in red ink. Similarly to the filter File Format filter, it is possible to modify the rules for the comparison by Menu > View > Program Options > File Format.

But wait, there's even more ...

The Batch File Format Comparison tool allows Authenticate to compare the formats of all images in an user selected folder with the current evidence image. The results are displayed in a table. The first row (id 0) represents the current evidence image used for the comparison. All the subsequent lines display the file format for the other images in the compared folder. The value of every cell is written in black if the value is the same as the evidence image, red otherwise. The last column value represents the number of differences found.

This tool is very useful when you need to verify if a certain camera is capable of creating a picture with a certain format. The user can take the camera and shoot as many different pictures as possible, with different types of scenes and different settings. Then the tool can be run to automatically to find if there is some combinations which yields compatible results.

If you want to look deeper at a specific image, just double click on a row of the table and it will load the file as evidence.

How cool is that?

Omnivore Field Kit Issue

A lot of people have seen the Omnivore Field Kit Detailed Demo on YouTube since it was uploaded a few months ago.

A reader sent me the link and asked an interesting question about what was seen on the screen. He saw today's webinar and went to the web site for more information. The scenario here is that there's no digital output, thus you need the Field Kit. Here's the Field Kit Viewer's screen (from the video).

What jumped out at our eagle-eyed reader is the recorded size setting displayed on the screen, CIF. CIF, or Common Intermediate Format, "is a format used to standardize the horizontal and vertical resolutions in pixels of YCbCr sequences in video signals, commonly used in video teleconferencing systems. It was first proposed in the H.261 standard." The dimensions for a CIF sized video is 352x288.

But, the size of the VGA output, as shown in the video is different. The Viewer is reporting the source as 1024x768. How many times does 352 go into 1024? How many times does 288 go into 768? Are the results a nice, round number? If not, what does that mean?

If the video is recorded at 352x288, and sent to the VGA port at 1024x768 - what's happening? Is aspect maintained? What should you do? Unfortunately, when you examine the spec sheets of DVRs, you'll find this a lot. 720x480 or 640x480 is pushed out the VGA, regardless of what the recorded size setting happens to be.

If you choose the Set Display Dimension option (by clicking on the blue Display/Source link) all you do is resize the viewer screen. This doesn't change what's coming out of the DVR? Does it change the amount of pixels captured? No. It seems that the adjustment just makes the Viewer window smaller/larger.

So, here's a problem for folks using this solution. How many know the source video dimensions, or made a note of the dimensions in their report? How many know what's being pumped out of the VGA port into the Field Kit? The Field Kit Viewer is supposed to detect the signal and adjust accordingly. Did you remember to write this info in your report?

But even so, when this happens in the example video, it's still not divisible.

As with any tool, validate it for use before you put it into action. Forewarned is forearmed, right?