Sustainability and getting the most for your training and education dollars

Get the most out of your training budget and save the planet whilst doing it.

We live in interesting times. There's a couple of cultural themes that are dominating the planning sessions in government and private industry. Governments and private firms are concerned about sustainability and austerity.

In order to satisfy sustainability initiatives, agencies are restricting travel. Given that airline travel  requires airplanes to consume carbon-based fuel in mass quantities, traveling to training is seen as damaging to the climate. Additionally, most government agencies will not allow a private firm to come in to a government facility and re-sell training seats in order to bring down the costs of training to small agencies. Thus, small agencies are faced with not being able to travel, and not being able to host due to the costs of purchasing on-site training.

In terms of austerity, many states aren't doing well financially. The pension crisis is hitting, homelessness is a real problem, and governments are focusing their attention - and their budgets - on the many social problems they are facing. Agencies are tasked with doing more, with less funds with which to do it. The days of "baseline budgeting" are drawing to an end as state / local governments face severe shortfalls.

I've been providing on-site training for over a decade now. I can't quantify the amount of times I've been asked to hold a seat, or the times that a class was full on the one date that worked for a student who couldn't get their registration completed in time.

On-line training and education solves all of these problems. According to the U.S. Department of Education, the most common reasons providers cite for offering online courses are to meet student demand, provide access to those who can't get to campus, and to make more courses available.

We've heard you. We're here to help.

Yesterday, I announced that our most popular course - Introduction to Forensic Multimedia Analysis with Amped FIVE - has found a home in our state-of-the-art learning management system. By offering our Intro to FIVE course on-line:

• Travel is no longer a problem. Consider how much travel, lodging, per-diem costs and how many additional people can be trained at your agency with the savings.
• Time is no longer a problem. With micro learning, you learn at your own pace and on your own schedule. You can easily accommodate an on-line course of instruction into your daily schedule. Studies show, there's better retention of information in adult learners with micro learning.
• Sustainability is no longer a problem. With on-line training and education, the learning experience comes to you ... helping your agency and government meet it's sustainability goals.

With interactive text, videos, and assignments, the learning experience moves beyond a simple demonstration event (webinar / information session) to create real growth in your knowledge, skills, and experience.

I'm excited about this news. I hope that you are too.

You can find out more, or sign up today, by clicking here.

See you in class, my friends.

keywords: audio forensics, video forensics, image forensics, audio analysis, video analysis, image analysis, forensic video, forensic audio, forensic image, digital forensics, forensic science, amped five, axon five, training, forensic audio analysis, forensic video analysis, forensic image analysis, amped software, amped software training, amped five training, axon five training, amped authenticate, amped authenticate training

Introduction to Forensic Multimedia Analysis with Amped FIVE – Now On-Line

Learn Amped FIVE anywhere, anytime!

The most cost effective training on Amped FIVE available!

The same great training, now offered on-line at a lower price.

So many users of FIVE complained about the cost of travel to attend a training session. For others, they couldn't leave their state for training. Still others didn't have the time to dedicate a week off of work to go to training. I hear you. I'm here to help. My most popular course, Introduction to Forensic Multimedia Analysis with Amped FIVE is now available on-line in a state of the art Learning Management System as micro learning. That should help ease the pressure on your calendar and comply with your agency's travel restrictions. In order to ease the pressure on your budget,  I'm offering this course for an amazingly low introductory price of US$ 995.00.

As vendors are raising prices, I'm looking for ways to deliver value and save you money.

Remember, this class serves as the entry point for those analysts involved in forensic image and video analysis, also known as Forensic Multimedia Analysis, and their use of FIVE as their software platform.

Sign-up today and take advantage of this incredible opportunity. To view the syllabus, click here.

And because someone will ask, this course not endorsed by or offered from Amped SRL, an Italian company. It’s offered from a US based business under the Fair Use doctrine, in the same way my Forensic Photoshop book was published and the accompanying training delivered. See (Apple v Franklin), 17 U.S.C. § 101. This course does not involve the distribution of software. And besides, we're moving our training offerings on-line to help municipalities meet their sustainability goals by reducing training travel. We're just trying to do our part to help the planet. Do your part and sign up today for Introduction to Forensic Multimedia Analysis with Amped FIVE – On-Line.


keywords: audio forensics, video forensics, image forensics, audio analysis, video analysis, image analysis, forensic video, forensic audio, forensic image, digital forensics, forensic science, amped five, axon five, training, forensic audio analysis, forensic video analysis, forensic image analysis, amped software, amped software training, amped five training, axon five training, amped authenticate, amped authenticate training

Source Attribution as an Ultimate Opinion

An interesting new article is available from David H. Kaye in Jurimetrics: The Journal of Law, Science and Technology Vol. 60, No. 2, Winter 2020.

Abstract
For decades, scientists, statisticians, psychologists, and lawyers have urged forensic scientists who compare handwriting, fingerprints, fibers, electronic recordings, shoeprints, toolmarks, soil, glass fragments, paint chips, and other items to change their ways. At last it seems that “[t]he traditional assumption that items like fingerprints and toolmarks have unique patterns that allow experts to accurately determine their source . . . is being replaced by a new logic of forensic reporting.” With the dissemination of “probabilistic genotyping” software that generates “likelihood ratios” for DNA evidence, the logic is making its way into US courts.

Recently, the Justice Department’s Senior Advisor on Forensic Science commented on a connection between prominent statements endorsing the new logic and an old rule of evidence concerning “ultimate issues.” He suggested that “some people . . . would like to pretend that [Federal Rule of Evidence 704] doesn't exist, but it actually goes against that school of thought.” This essay considers the nexus between Rule 704 and forensic-science testimony, old and new. It concludes that the rule does not apply to all source attributions, and even when it does apply, it supplies no reason to admit them over likelihood statements. In ruling on objections to traditional source attributions buttressed by the many calls for evidence-centric presentations, courts would be remiss to think that Rule 704 favors either school of thought.

Important quote:
... Thus far, I have assumed that all source attributions are ultimate opinions as those words are used in Rule 704. The rule applies to any opinion from any witness—expert or lay—that  “embraces an ultimate issue.” But the identity of the source of a trace is not necessarily an ultimate issue. The conclusion that the print lifted from a gun comes from a specific finger does not identify the murder defendant is the one who pulled the trigger. The examiner’s source attribution bears on the ultimate issue of causing the death of a human being, but the examiner who reports that the prints were defendant's is not opining that the defendant not only touched the gun (or had prints planted on it) but also pulled the trigger. Indeed, the latent print examiner would have no scientific basis for such an opinion on an element of the crime of murder..."

Download the full article here.

Have a great day, my friends.

Keywords: evidence, forensic science, identification, expert opinions, ultimate issues, Rule 704, likelihoods, individualization, probability

How do you explain the weight of evidence?

Learn the use of probability to explain the weight of evidence in the new Statistics for Forensic Analysts course, available on-line as micro learning. For more information, click here.

Sign up today and start learning statistical concepts as they relate to Forensic Science including standard error, standard deviation, confidence interval, significance level, likelihood ratio, probability, conditional probability, Bayes’ theorem, and odds.

Redaction - where do you start?

Learn to redact multimedia evidence for court, media release, or standards compliance. Four new redaction courses are available on-line as micro learning featuring  the most popular tools used for redaction. For more information, click here.  

Sign up today and start learning to redact multimedia files. These courses will get you up to speed on the issues and the technology necessary to quickly and confidently tackle this complex task.

Gaps in vendor-specific training?

Did your tool-specific training in video forensics leave you with questions? Do you want to know more? Want to dive deep into the science of forensic multimedia analysis? Click here to sign up for Introduction to Forensic Multimedia Analysis, available on-line as micro learning.

This course is the perfect complement to your vendor's training courses, offering a deep dive into the science that helps you to answer those "why" questions, helping you become a better analyst and a more confident expert witness.

keywords: audio forensics, video forensics, image forensics, audio analysis, video analysis, image analysis, forensic video, forensic audio, forensic image, digital forensics, forensic science, amped five, axon five, training, forensic audio analysis, forensic video analysis, forensic image analysis, amped software, amped software training, amped five training, axon five training, amped authenticate, amped authenticate training

Windows Sandbox vs Virtual Machine

Recently, I spent a week in New Jersey teaching a week-long course on forensic multimedia analysis with Amped FIVE. On day four of the class, we spent the morning installing, configuring, and working within virtual machines.

I've been using Oracle's Virtual Box for a while now. It's what we were working with in the course. It's easy to set-up and use. Plus, it's free.

But, the inevitable question came up. Why not use the new Windows Sandbox feature instead of Virtual Box, or other VM?

In their specific case, the answer was easy - the computers in their training room would not support Sandbox. To use Sandbox, your computer must meet minimum specifications.

• Windows 10 Pro or Enterprise build 18305 or later
• AMD64 architecture
• Virtualization capabilities enabled in BIOS
• At least 4GB of RAM (8GB recommended)
• At least 1 GB of free disk space (SSD recommended)
• At least 2 CPU cores (4 cores with hyperthreading recommended).

If your computer is capable of running Sandbox, setting it up is as simple as turning the feature on in the Windows Features dialog box.

Turn Windows Sandbox on in the Windows Features dialog box.

The training machines at this agency were 32bit with only 4GB of RAM. 

Yes, ICYMI, FIVE will run in a VM. I've installed FIVE in the popular VMs out there and it works just fine. The nice thing about FIVE is that it runs off a license key (dongle). With a VM, I can assign the USB port with the dongle to the VM to let FIVE run in the VM. Some of the other analysis programs out there require machine codes on installation, which will complicate matters. Some vendors allow only a single installation per license. With FIVE, you can install it everywhere. The dongle is portable. The software installation is quite agile.

FIVE running inside of Windows Sandbox

In my laboratory work, I have VMs set up for specific cases. I also have VMs set up for specific codecs / players (like Walmart's Verint / March Networks codecs). I can save these VMs. I can share these VMs for discovery.

Not so with Sandbox. Sandbox is volatile. Once you shut it down, everything you were just doing is gone for good. But, don't worry about accidents. Microsoft warns you of this.

Windows Sandbox warning about losing everything once you close the window.

My worry with Sandbox is that I've created something for a case. Then, when I shut it down, I necessarily destroy it. I'm just not comfortable with that. Thus, I still use Virtual Box.

Additionally, with a Virtual Box, I set things up once. Then, in the case of test/validate, I can use the space multiple times if needed. With Sandbox, I must set things up from scratch each time. Such a waste IMHO.

That's not even considering Windows stability issues and crashes. There's no "auto recovery" feature to Sandbox if the host OS crashes.

The other nice thing about VirtualBox are extension packs. The main extension pack from Oracle extends USB functionality within your VM. "VirtualBox Extension Pack" adds support for USB 2.0 & 3.0 devices such as network adapters, flash drives, hard disks, web cams, etc., that are inserted into physical USB ports of the host machine. These can then be attached to the VM running on VirtualBox. As a result, you can use a physical USB device in a guest operating system. There are other extension packs, with new ones being developed all the time.

If you haven't tried working in virtual machines, give it a go for yourself. If you'd like hands-on guidance, you're welcome to sign up for one of our upcoming training sessions. Check the calendar on our web site for available dates. We teach VMs within the Advanced Processing Techniques course. If you don't see a date that works for you on our calendar, but want to schedule a class, contact us about bringing a course to your agency or adding a course to our local training calendar ... or about our new micro learning options for self-directed learners.

Have a great day, my friends.

Deep-fakes, Photoshopping, and the Post-Truth Society.

With deep fake videos & Photoshopped images, how do you know you can trust what you see and hear? Learn the science of authentication in this new Forensic Multimedia Authentication course. It's available on-line as micro learning.  Click here for more information.

Remember, it’s not “just video.” Often times, it's the only witness to the events of the day. Please don’t let expediency guide your path. “Video evidence is a lot like nitroglycerin: Properly handled, it can demolish an opposing counsel’s case. Carelessly managed, it can blow up in your face.”

Right to Silence and the collection of evidence

"You do not have to say anything, but it may harm your defence if you do not mention when questioned something which you later rely on in court. Anything you do say may be given in evidence." - Right to Silence (UK)

When I retired from police service, I had spent a third of my life working for the LAPD. One of the questions that someone with my resume will eventually face is the balance of case types worked, the implication being that I would have mostly worked for the prosecution of criminal defendants. But, in Los Angeles County, there's an over 90% plea rate. In reality, I worked on the major criminal cases about 50% of the time, with the remainder working in the defence of the my self-insured city. I've also worked in the defence of officers falsely accused of perjury (People v Abdullah) and have donated a lot of time for case review in support of Innocence Project type cases.

If you're an American, you will be more familiar with the Miranda warning than the warning shown above from the UK. But, I think the Miranda warning, and the 5th Amendment in general, is setting people up for failure in successfully defending themselves in court (assuming they're innocent of all charges). Here's what I mean.

Americans generally believe that it's up to the State to prove guilt. Whilst this is true in theory, there are so many stories about innocent people pleading guilty to charges based on a "risk assessment" that they make about their potential to succeed at trial. The Prosecution has their theory of a case. The State's investigative might has been focussed on the Prosecution's theory in the collection of evidence. They're not necessarily concerned with the collection of alibi evidence for you. They may stumble upon potentially exculpatory evidence, but that's not their job - it's yours.

This is where I think the UK's standard admonition is more honest. Sure, you have the Right to Silence. But, by remaining silent, you may actually harm your defence. 

If you are innocent, you know where you've been, with whom you've associated during the time in question, places you've visited, and etc. Your defence team must begin it's own evidence collection process. Your movements throughout the day all leave traces - the store, the gas station, the coffee shop, highway tolls, and etc. There's very little about one's life these days that isn't tracked or recorded. In addition to CCTV video of you going about your day, your phone has likely recorded even more details about where you've been and what you've been doing. Now, there's even the personal home assistants like Alexa and Siri that can serve as a witness to your movements.

All of this data must be preserved. However, the average person doesn't have the resources or the know-how to collect and preserve digital evidence properly. Some items, like cell tower logs, may require a warrant to acquire. You must have a capable and aggressive lawyer working on this for you. 

I'm here to help. I've seen all sides of this and have been working on standards for digital evidence collection and processing for well over a decade. I've taught classes to public and private audiences on this as well (click here for more info).

Yes, in the US we have the presumption of innocence. But, the best defense is a good offense. You must go on the offense and collect the evidence that proves your innocence. The evidence shows that it will harm your defence if you don't.

A rough guide to spotting bad science

A relevant infographic from Compound Interest.

Mind the Communication Gap

I received a panicked email and phone call last week that can easily be summarized by the graphic above. Yes, there are still vendors selling to the police services that don't understand or accommodate the agencies needs or schedules.

As most in government service know, often the ability to spend money on tools and training happens within a short window of time. Such a window had opened for this person and they reached out to a company in response to a bit of marketing on new redaction functionality in a particular piece of software.

In the email that was shared with me, the requestor made it clear that they wanted to redact footage from body worn cameras. A trial code was shared for the company's tool. The requestor eagerly downloaded and installed the software, then assembled his supervisors and stakeholders to evaluate the new software. That's when the problems began.

Redacting the visual information was relatively straight forward, but cumbersome. However, he couldn't figure out how to redact the audio portion of the file. He reached out to the company's rep. Unfortunately, it was late on Friday in California. He received no reply from the company's rep, who'd likely gone home for the weekend. Thus, having previously communicated with me on technology issues, he reached out hoping that I'd still be around.

I let him know that to the best of my knowledge, none of Amped SRL's products redact audio. Yes, they'd promised audio redaction in FIVE at the 2016 LEVA conference. But, it's never materialized. As it's not been developed, it's quite likely that there is no audio redaction functionality in Replay.

He received a note from the sales rep on Monday. It informed him that the redaction functionality was built around a CCTV use case, and as such, did not concern itself with audio. The order taker that responded to the inquiry could have saved the requestor a ton of time and stress by simply reading the request - redaction of BWC footage - adding a helpful disclaimer in the reply that the tech doesn't redact audio.

Redaction remains a huge issue in California. Agencies are looking for a quick fix, but no easy solutions have presented themselves. The marketing from Amped seemed to provide a glimmer of hope to the requestor. But those hopes were dashed when the advice from the order taker, three days late, was that there is no single redaction solution - which isn't entirely true.

As I informed the requestor on Friday evening, the Adobe Creative Suite has all the necessary tools to perform a standards-compliant redaction for California's new laws. The automatic tracking in PremierePro is the best currently available. Plus, at $52.99/month, the cost savings is substantial vs. FIVE or Replay.

Given that the requestor had until 1700 PDT to spend the allocated funds, not receiving a reply until the following Monday was not an option. Thankfully, I was able to answer his questions and get him on the right path. Next stop for him is my redaction class, featuring the Adobe tools (link).

Have a great day friends.

Generic Conditionals

In my retirement from police service, I'm busier than ever. One of the projects that I'm involved with is the creation of an instructional program in report writing for a national police service. In defining the instructional problem, I've found that the learner population has a problem with "factual conditionals." I've also noted this problem in the report writing samples of their forensic science practitioners.

Because people have problems with the relationship between the dependent and independent clauses, their reports are hard to read and interpret. What should be a clear statement - (dependent variable / action) resulted in (independent variable / result) - is often a confusion of meanings.

Often, what should be written as a conditional is written as a declarative statement. This problem hides potential meanings, and obscures avenues for inquiry.

For example, one of the sample videos that I use in my Content Analysis class (link) examines a traffic collision scene. A collision occurs as V1 attempts to turn left whilst exiting a parking garage. In the declarative statement, fault is obvious - turning left eludes to issues of right of way. What is missing is the conditional. If V1's progress is purposefully impeded, then the inquiry turns from a simple traffic collision to a "staged collision," - an entirely different line of inquiry.

When the responding officer records the statements of those involved, as well as witnesses, it becomes important to consider the statements in a "conditional sense." If Person 1's statement is true, then the scene would be arrayed thus." or "If Person 2's statement is true, then Person 1's statement is untrue." The conditional statements help frame the analysis of the statements and the evidence.

Using an example from the weekend's posts, "If headlight spread pattern analysis is a subset of digital / multimedia forensic science (comparisons), then the analysis must examine the recording of the pattern and not the pattern itself."

Just something to ponder on this beautiful Tuesday morning. Have a great day, my friends.

Fusion-based forensic science

When I first started out in multimedia forensics, there were just a few vendors offering tools to practitioners. Ten years later, there were a whole bunch. A further ten years later, and there are a relatively small group of vendors again.

When I sat down with Dr. Lenny Rudin of Cognitech a few weeks ago, to catch up and see what's new with him, we took that walk down memory lane that is customary for the "old guys." We talked all things Cognitech, and the state of the market.

I asked him about "codec / format support" in his tools and it seems that he favors the approach taken by the folks at Input-ACE - or the other way around I guess, since Cognitech has been around much, much longer than Input-Ace. The approach, seize the device and process the hard drive directly, is where Input-Ace is going in their partnership with Cellebrite and DME Forensics. Cognitech is there as well, seemingly with SalvationData.

This fusion-based approach makes sense. Do what you do, well, and let others do their thing well - then partner with them. It makes sense.

On the other end of the spectrum is Amped SRL. I remember standing in the exhibit space at LEVA Asheville when a certain developer was trying to offer his services (even his IP) to Amped. The response he received was that everything that is necessary to the task should be in FIVE. No plug-ins. No extra programs. That, and that Amped was happy with their current staff and development pace. In that conversation, Amped noted that FIVE should be the "go-to" for analysts. For a few years, this was the case. Now, increasingly, it's not.

Is everything that is necessary for an analyst's work in FIVE? Currently, there are features available in DVRConv that aren't available in FIVE. The main one that most customers wanted (when I was fielding calls in the US for Amped Software, Inc.) is the ability to "convert" everything. You see, in DVRConv, you just drag/drop a bunch of files and folders into the interface and it "converts" everything that's convertible - and maintains folder structure. FIVE, on the other hand, only "converts" one file type at a time, one folder at a time. The new "change frame rate on conversion" functionality is another example of something that is done in DVRConv that isn't done in FIVE.

Then, there's Reply. It seems that rather than continue to develop FIVE, Amped is cannibalizing it. Is Redaction moving over to Replay? It seems so. Yes, Replay now has improved tracking functions. But, what about all of those customers who bought FIVE for redaction. How are they feeling right now knowing that promises made about future functionality weren't promises kept. Promises made that weren't kept, you ask? Yes. Amped has yet to make good on their promise, made at LEVA Scottsdale, of adding audio redaction functionality to FIVE. Perhaps audio redaction will make it into Replay. Perhaps not.

Amped was once known as the provider of "specialists'" tools. Now, it's "generalizing" them as it migrates FIVE's functionality to Replay. A lot of US based agencies bought five years worth of support and upgrades when they purchased their original licenses. I'm wondering how that ROI looks now, given Amped's latest moves.

Meanwhile, Amped's competition has closed the gap and begun to overtake them in the marketplace. Dr. Rudin, sensing this, is about to make a big push with some new tools (hint: video authentication).

But, with all of this in mind, probably the oddest development is Foclar's entry into the US market. Foclar's Impress isn't a new product. It's been available in Europe for years. But, in terms of development and functionality, it's about where Amped was on FIVE's entry to the US market ten years ago. Let's see if Foclar has the wherewithal to play catch-up. As Amped raises it's prices for its products and services beyond what the market will bear, they'll leave the door open for Foclar to make some headway - should that European company choose to compete on price.

Gone - for the most part - are Signalscape, Salient Stills, and Ocean Systems. These companies still exist as fractions of their former selves. Signalscape's StarWitness is gone - replaced by interview room recorders and evidence processing machines. Salient Stills never really owned the IP in VideoFocus - which is now a part of DAC / Salient Sciences. As for Ocean Systems, it seems as though it exists at the will and pleasure of Larry Compton (who might be it's only employee). They're still offering the Omnivore, the Field Kit (Omnivore + a laptop), and Larry's training courses. Legacy products are on autopilot. Has ClearID been substantially improved / updated since Chris Russ' sacking years ago? I don't think so. I never understood the value proposition of taking 8 of the algorithms from OptiPix / FoveaPro (which were collectively priced at about $500 for about 70 algorithms) and charging much, much more. Sure, you got a new UI. But was that worth the price? I still have an old MacBook running PS CS2 just to run Chris' old stuff.

Have a great day my friends.

Review: Forensic science. The importance of identity in theory and practice

A paper was recently published over on Science Direct (link) exploring what may be a "crisis" in forensic science. Here's the abstract of the paper:

"There is growing consensus that there is a crisis in forensic science at the global scale. Whilst restricted resources are clearly part of the root causes of the crisis, a contested identity of forensic science is also a significant factor. A consensus is needed on the identity of forensic science that encompasses what forensic science ‘is’, and critically, what it is ‘for’. A consistent and cogent identity that is developed collaboratively and accepted across the entire justice system is critical for establishing the different attributes of the crisis and being able to articulate effective solutions. The degree to which forensic science is considered to be a coherent, interdisciplinary yet unified discipline will determine how forensic science develops, the challenges it is able to address, and how successful it will be in overcoming the current crisis."

The article seems an exploration of struggle for identity, as the title suggests. What is it? What are we to do with it? What happens when it's not done correctly? Who's responsible for reform? Curiously, even as the paper notes the work done on forensic science in the US, it omits reference to the 2017 A Framework for Harmonizing Forensic Science Practices and Digital/Multimedia Evidence (link). I point this out because the OSAC's document provides a solid definition of forensic science that can serve as a foundation from which to explore the paper's topic, as well as to provide a path forward for research and practice.

As a reminder, the definition of forensic science, "The systematic and coherent study of traces to address questions of authentication, identification, classification, reconstruction, and evaluation for a legal context." "A trace is any modification, subsequently observable, resulting from an event."

I think that within the OSAC's definitions, the goals outlined in the paper can be achieved.

Nevertheless, the likely root of the "crisis" as observed by the author can be seen in another area altogether - bias.

The topic of bias, and the many places it influences the justice process has been explored in depth. Particularly, these two papers (link) (link) explore the impact of bias from the standpoint of each of the stakeholders and the influence of modern media.

Another place where bias occurs is in the selection and continuation of cases by the prosecution. For example, what effect does linking a prosecutor's "win / loss" record to their promotability within their organization have on their decision making process? Once they've filed a case, is there evidence of an "escalation of commitment" when confronted with problems in proving their case? With "escalation of commitment" bias, the prosecutor may seek out "fringe techniques" in an attempt to support their theories of the case. Is it these "fringe techniques," not forensic science, that have contributed to the observed "crisis" - as was illustrated in Netflix's Exhibit A?

Still, I'm glad to see that people are starting to identify that there might be a problem in the practice of "forensic science." How that problem, or "crisis," is addressed will make all the difference in the world.

Have a good weekend my friends.

Can Amped's Authenticate assist in detecting "deep fakes?"

Short answer: no.

Long answer: everything old is indeed new again.

In 2016, I presented an information session on authentication at the LEVA Conference in Scottsdale, Az. Here's the session description:

Understanding Concepts of Image Authentication Workshop (2016)
This workshop is for those interested in the authentication of digital images. The workshop provides an overview of the techniques and skills necessary to perform basic authentication examinations using Amped Authenticate (Axon Detect) on digital images in a “forensic science” setting as well as to package, deliver, and present those findings in their local court room context.

At this year's LEVA Conference, it seems that the old topic is being dusted off, with one small addition. Can you spot the main difference between the 2016 session description (above) and this year's (below)?

Authenticate: The Beginners Guide to Image Authentication* (2019)
Image authentication techniques have multiplied over recent years. The simplicity of Image editing and the increase of bogus imagery, “Deep Fakes”, being identified in the media has, quite rightly, meant that methods to detect manipulation must be available to the legal system.

The difference: "Deep Fakes"

There's one big problem though. A "deep fake" is a video. Authenticate doesn't work on video, only images of a specific file type.

In my forensic multimedia analysis course (link), I feature a number of proposed techniques that address so-called "deep fake videos." All of the solutions work within a fusion-based methodology - requiring different tools and applications of those tools to identify the many components that make up fake videos.

But the wider question, why use the term "deep fakes" incorrectly to market an information session on an image authentication tool? Is this SEO gone wild? I don't know. At a minimum, it's confusing. At the maximum, it's deceptive. Hopefully, you weren't just going to learn about "deep fakes." If so, you're sure to be disappointed - again, Authenticate does not process or authenticate video.

Have a great day my friends.

keywords: audio forensics, video forensics, image forensics, audio analysis, video analysis, image analysis, forensic video, forensic audio, forensic image, digital forensics, forensic science, amped five, axon five, training, forensic audio analysis, forensic video analysis, forensic image analysis, amped software, amped software training, amped five training, axon five training, amped authenticate, amped authenticate training

The best artists steal

It's an old adage in the art world that good artists copy the work of their masters, but the great artists steal it (link). With that in mind, a reader of the blog pointed out the apparent similarities between the Camera Match Overlay in Input-Ace (link) and a patent on file at the USTPO (link).

If you read the marketing around the Overlay tool, you might begin to notice the similarities between it and the patent. But, don't be fooled. US Patent 9,305,401 (link) describes a system for building out a scene in 3D utilizing images from that scene, then conducting various measurements. Overlay does none of that. Overlay does exactly what the name implies - it allows you to take the user interface of Input-Ace and "overlay" on top of the user interface of the tool with which you are actually conducting your measurement exam. The idea is that you can infer the location of images present in the images loaded in ACE, and overlaid on the measurement tool, from the data in the measurement tool. Because of this, I don't think ACE is infringing on anyone's patents - in my opinion.

Yes, the patented process is operationalized into Cognitech's software, and that software is actually reconstructing the scene and performing the measurement exams. No, Input-Ace's Camera Match Overlay tool is not reconstructing a scene and is not used directly in conducting the measurement.  Yes, it does lend a hand in attempting to calculate the range of potential measurement values (and thus the error potential in the measurement), so you'll need to be extra careful in how you report and present your results using their methods. You'll also need to explain how you validated your unique results. Yes, you should validate any tool used in your work as well as the results that lead to an opinion / conclusion.

Thanks for reading. Keep the comments coming. Have a good day my friends.

Detecting 'Doctored' Images

Just a wee reminder that authenticating multimedia evidence (aka 'spotting doctored images on the internet') is a bit more complicated than finding the "doctor" in the image.

If you'd like to learn the underlying science behind authenticating this complicated evidence type, check our our course - Forensic Multimedia Authentication (link). Offered on-line as micro-learning, seats are always available and you learn at your own pace. Click on the link for more information, or to sign up today.

Everything old is new again

Last month, I took a look at the new Camera Match Overlay feature in Input-ACE. The Overlay feature can be used in conjunction with a 3D laser scanner and it's accompanying software to create demonstrative exhibits.

I'm not a big fan of the feature, preferring single image photogrammetry to conduct measurements within the evidence items without creating brand new exhibits. But, it occurred to me ... one of the nice things about getting old is you get to see history repeat itself.

When I first arrived at the LAPD in 2001, it had a video / image processing workstation from Cognitech. It was then that I first met Dr. Lenny Rudin. Last month, I was in Pasadena to present a lecture and ventured over to CalTech's amazing restaurant to have lunch with Dr. Rudin and catch up on what's new with him and Cognitech.

Our conversation bounced all over the place and eventually exceeded the allotted time that the restaurant had for lunch service. I like those conversations where time ceases to be a factor, just enjoying the topics and the company.

Of course the current state of the industry came up. Who's who and what's what. If you're reading this and you don't know the names (Cognitech and Dr. Rudin), that's a shame. Dr. Rudin is one of the founders of this thing we now call Forensic Multimedia Analysis, but has largely been written out of the history by those with a more commercial agenda. It's only the old folks who know the likes of Dr. Rudin, Dr. Russ, and the like.

Nevertheless, we discussed input-Ace's Overlay feature a bit, noting it's similarity to Cognitech's Measure package that began life in the 90's (now called AutoMeasure).

Everything old is new again. You can find the 1995 paper that describes Cognitech's Measure over at the SPIE (link). It's not an "overlay" procedure as such, but a single image photogrammetry method that builds out the 3D space within the 2D image. Unlike Overlay and its mixed-methods approach, Cognitech's Measure does have a validation history available in the literature.

Over lunch, we talked about where Cognitech's tools are now and what are the plans for the future of Cognitech's offerings. It has been a while since I've used Cognitech's tools. I'm looking forward to getting to know the new versions and the new products. Hopefully, if Dr. Rudin agrees to allow it, I'll be showcasing some of them in future blog posts.

Have a good week my friends.

Yes, you do need stats ... actually

Yesterday, I received the good news that my validation study of how a course in statistics could improve the statistical literacy of digital / multimedia forensic analysts when delivered on-line as micro-learning was published by the Chartered Society of Forensic Science in the UK. I got excited and put the good news on my LinkedIn feed.

Along with the usual emoji responses, I received the comment shown below.

Rather than simply comment there, I'd like to take the opportunity to illustrate the many ways in which it's not just me who says that the world of the digital evidence analyst can benefit from a solid foundation in statistics.

You see, the course was created because the relevant government bodies around the world have said, on a rather regular basis, that the investigative services and the forensic sciences need a solid foundation in statistics.

Starting at the US government level, there's the PCAST Report from 2016 (link): "NIST has also taken steps to address this issue by creating a new Forensic Science Center of Excellence, called the Center for Statistics and Applications in Forensic Evidence (CSAFE), that will focus its research efforts on improving the statistical foundation for latent prints, ballistics, tiremarks, handwriting, bloodstain patterns, toolmarks, pattern evidence analyses, and for computer and information systems, mobile devices, network traffic, social media, and GPS digital evidence analyses." (emphasis is mine)

CSAFE has already responded with some tools for digital forensic analysts (link).  The ASSOCR tool will help analysts "determine if two temporal event streams are from the same source by through this R package that implements a score-based likelihood ratio and coincidental match probability methods."

The HEISENBRGR toolset can be used to "match accounts on anonymous marketplaces, to figure out which of them belong to the same sellers."

What about NIST? What is the issue that NIST is taking steps to address? The PCAST report notes, "The 2009 NRC report called for studies to test whether various forensic methods are foundationally valid, including performing empirical tests of the accuracy of the results. It also called for the creation of a new, independent Federal agency to provide needed oversight of the forensic science system; standardization of terminology used in reporting and testifying about the results of forensic sciences; the removal of public forensic laboratories from the administrative control of law enforcement agencies; implementation of mandatory certification requirements for practitioners and mandatory accreditation programs for laboratories; research on human observer bias and sources of human error in forensic examinations; the development of tools for advancing measurement, validation, reliability, and proficiency testing in forensic science; and the strengthening and development of graduate and continuous education and training programs."

It's that last bit that prompted me to design and validate an instructional program in statistics for forensic analysts. But, it's the first sentence that speaks to the comment from LinkedIn. Analysts don't deal in absolutes or definite - binary. The world of the computer program may be binary, but the world certainly isn't. There is a natural variability to be found everywhere. But more to the comment's point, how does an analyst know that their "various forensic methods are foundationally valid, including performing empirical tests of the accuracy of the results."

Ahh... but, you're saying, all of your support is from the United States. It doesn't apply to the rest of the world. In that, you're wrong. Let's look at the UK.

In September 2018, Members of the Royal Statistical Society Statistics & Law section (link) submitted evidence (link) to a House of Lords Science and Technology Committee inquiry on Forensic Science. Question 2 asked, "what are the current strengths and weaknesses of forensic science in support of justice?" Here's the RSS' response. Notice the imbalance between strengths and weaknesses.

I've highlighted the relevant section as it relates to this topic. "poor quality of probabilistic reasoning and statistical evidence, for example, providing irrelevant information because the correct question is not asked. For example, an expert focused on the rarity of an event, rather than considering two competing explanations of an event."

Our course on statistics for forensic analysts seeks to teach probabilistic reasoning, exploring the differences between objective and subjective statistics, as well as the fact that most of the forensic sciences currently work in the wold of abductive reasoning (taking your best shot).

Now there's the accusation that digital analysts are often engaged in "push button forensics." We buy tools from vendors and hope that they're fit for purpose and accurate in their results. But are they? We don't know, so we validate our tools (hopefully). If you're trusting the market to deliver reliable, valid, and accurate tools, you may be disappointed. As the above referenced report notes, "What can be learned from the use of forensic science overseas? Seen from continental Europe, there has been a loss of an established institution (FSS) with a profound body of knowledge. Now research seems scattered among different actors (mainly academic), as commercial providers might have other priorities and limited resources to invest in fundamental research." (emphasis mine)

To the Royal Society's point, if you're a digital analyst and there's a challenge to your conclusions or opinions, on what do you base your response or your work? For example, you've retrieved photos from a computer or phone. Your tool automatically hashes the files. But, a cryptographic hash does not guarantee the authenticity of the file, only places a unique value into the process to handle questions of integrity. How do you conduct an authenticity examination without a knowledge of statistics? You can't. How do you validate your tools without a knowledge of statistics? You can't.

Over in Australia (link), there is agreement on the need for training and research - just what I've presented. "There is however one aspect of the report with which the Society is in complete agreement; the need for both continuous training and research in forensic science. We are also aware of the lack of funding for this research and therefore support the recommendation of PCAST that this is essential if our science is to continue to develop into the future."

To conclude, yes, you do need training / education in statistics if you're engaged in any forensic science discipline. Many practitioners arrive in their fields with advanced college degrees and thus will have had exposure to stats in college. But, on the digital / multimedia side, many arrive in their fields from the ranks of the visible policing services. They may not have a college degree. They may only have tool-specific training and may be completely unaware of the many issues surrounding their discipline. It's for this group that I've designed, created, and now validated my stats class. It's made in the US, to be sure, but it's informed by the global resources listed in this post - and many others.

I hope to see you in class.

Demonstrative exhibits and reconstruction of events

My last post generated a few responses that I want to address in a separate post, as opposed to editing the previous post. A few people got the impression that I was saying that what folks are doing with ACE's Camera Match Overlay isn't "forensic science" or "forensic video analysis." That's not at all what I was saying. Let's dive into that question to explain.

First, the definition of forensic science again: "Forensic science is the systematic and coherent study of traces to address questions of authentication, identification, classification, reconstruction, and evaluation for a legal context."

Forensic science thus includes:

• authentication
• identification
• classification
• reconstruction
• evaluation

The type of work performed in the examples on ACE's websit clearly indicate that the Camera Match Overlay is a tool for reconstruction. This is how the product is being positioned in the market. Camera Match Overlay is an addition to ACE, and not part of it's basic functionality. If you're not involved in reconstruction, you can skip the Overlay tool and save a few bucks.

What ACE's basic functionality excels at is "evaluation." What's in the container? How should it be handled? Those File Triage type questions. Once answered, it's a short trip to repackaging the data in a format that is playable for the end user. But remember, evaluation has it's own set of rules.

ACE is also really good at reconstruction - the syncing and linking separate video streams. Reconstruction has it's own rules, workflow, and toolset. Reconstruction attempts to illustrate a theory of the sequence of events in question. Reconstruction is not authentication, identification, or classification - which have their own rules, workflows, and toolsets.

With that in mind, the second set of questions deals with training and tools.

A 16 hour training session on Camera Match Overlay's operation and use is likely sufficient for a technician to be able know which buttons do what functions across a variety of use cases. What it is not is a comprehensive education on photogrammetry. Because the focus of tool-specific training is the tool, we've split off the foundational education side as separate, non-tool-specific deep dives so that you get an unbiased exploration of the discipline from a neutral third party. If you're giving technician level testimony (no opinion offered), tool-specific training is likely enough. But, if you're offering an opinion (even passively), then you need a foundational education in the discipline in which you're engaged.

The third set of questions deals with the legal aspects of evidence hearings.

Keeping in mind that I'm not an attorney, consider the evidence hearing's rules (Frye / Daubert). Both types of hearings have as a foundational element what is commonly known as the “general acceptance test.” Generally accepted scientific methods are admissible, and those that are not sufficiently established are inadmissible.

Can a tool or technique without a history of publication or validation be "sufficiently established?"

Camera Match Overlay technology is new. It's the "shiny new object" for reconstruction exercises. The resulting videos become an amazing demonstrative aid to one's testimony, using the power of stunning visuals to illustrate one's theory of a case. But, bear in mind that it's only a demonstrative illustration of a single theory. There may be other theories worthy of exploration. If you're engaged in science, Daubert requires that you explore those other theories. If you're just engaged in trial support, and thus have no opinion, then go right ahead and create those stunning visuals.

All of this requires a bit of honesty. When I've simply retrieved files, I'm engaged in technician level work. When I've clarified and enlarged a frame, I've engaged in technician level work. These activities can support an analysis, and thus help to illustrate one's opinion, but they're not "analysis" in and of themselves. From the Frye ruling, "while courts will go a long way in admitting expert testimony deduced from a well-recognized scientific principle of discovery, the thing from which the deduction is made must be sufficiently established to have gained general acceptance in the field in which it belongs." When I want to offer an opinion, I must use tools and techniques that have been sufficiently established in my field. If I want to use "reconstruction" tools to reinforce my opinion in an "identification" exam, those tools must be sufficiently established within the realm of "identification." At this time, there are no studies validating the use of the Camera Match Overlay technology and methods for "identification" or "classification."

There are no studies involving the product at all. It's brand new. I'm certainly open to participating in validation studies, if anyone want to engage in our services. But for now, Camera Match Overlay seems to belong to the world of reconstruction until validated otherwise.

Thanks for reading. Have a great day my friends.