Featured Post

Welcome to the Forensic Multimedia Analysis blog (formerly the Forensic Photoshop blog). With the latest developments in the analysis of m...

Tuesday, July 27, 2010

Export Panel - Bridge CS5

The new Export Panel brings added functionality, mainly the ability to upload to social media sites directly from Bridge CS5 (4.0.2x). If you are using social media sites to get the word out about crimes in your area, check out this new functionality. Once you set a few simple parameters, it'll save you a ton of time getting images uploaded.


Monday, July 26, 2010

An alternative to digital signatures

Often times, users have to "digitally sign" documents in the legal process. That being said, sometimes an actual signature is required. What if you could combine the two ....? With Photoshop, you can.

Check out Simon Rudd's tutorial on making a custom shape of your signature. Once you have this custom shape in your inventory, "signing" documents in Photoshop becomes easy.


Friday, July 23, 2010

Forensic science braces for change

From Nature.com's Laura Spinney: "As the White House prepares its response to a damning report into the state of forensic science in the United States, the director of the Federal Bureau of Investigation laboratory, Chris Hassell, says that forensic scientists need to invest more in the validation of new technologies and work more closely with the crime labs that implement those technologies, if forensics is to shake off its poor public image.

Speaking at the 4th International Crime Science Conference in London last week, Hassell described the gap between basic research and its application in solving crimes as the "valley of death" because "nobody wants to pay for it, nobody really wants to do it". That gap needs to be filled by thorough testing of new techniques before they are released to crime labs, said Hassell, who is a chemist with a background in this sort of validation ..."

Click here to continue reading the article.


Thursday, July 22, 2010

BP photoshops fake photo of crisis command center

A popular blogger has caught BP taking liberties with images that it posted on its web site. For the whole story, click here.


Wednesday, July 21, 2010

Variations in CS5?

A question came up in today's class about the missing Variations adjustment option on some of the students' machines.

Here's the explanation from Adobe, "Note: The Variations command is unavailable for indexed-color images, 16-bit images, and 64-bit versions of Mac OS."

Also, Send Video Preview to Device and Video Preview are only available in 32-bit versions of Photoshop CS5.

Here's a note on the TWAIN issue some have reported: "TWAIN - The TWAIN scanner plug-in is no longer installed with Photoshop CS5, but is available via web download. Supported when running Photoshop CS5 on 32-bit Windows or 32-bit Mac OS. Also supported as a 64-bit application on 64-bit Mac OS with scanners that support 64-bit scanner drivers. The TWAIN scanner plug-in is also supported if you run Photoshop CS5 as a 32-bit application on 64-bit Windows or 64-bit Mac OS."

To run Photoshop CS5 on Mac OS as a 32-bit application:
Select the Adobe Photoshop CS5 application file, installed by default in the Applications/Adobe Photoshop CS5 folder.
Choose File > Get Info, and select Open in 32 Bit Mode.
Deselect this option to run Photoshop CS5 in 64-bit mode.


Tuesday, July 20, 2010

Police may be overlooking video evidence

From The Province's Ethan Baron: "Hundreds of evidence videos — including one related to a possible shooting and one from a drunk-driving case — seized by Vancouver police gathered dust in storage, unanalyzed, an internal report shows.

Of about 1,400 videos the force received in 2008, up to 600 were not analyzed as of April 2009, says a June 2009 audit of video-evidence management in the Vancouver Police Department.

"Public safety and the reputation of the VPD could be seriously jeopardized if significant forensic-video evidence was missed or overlooked," audit manager Simon Demers wrote. "The VPD could also face substantial civil liabilities."

Video evidence has extremely high value to police, Demers noted.

"It can be more easily scrutinized by the court and is typically more objective than witness statements. Video evidence cannot be prejudiced or intimidated," he wrote.

In the investigation stage, videos can greatly benefit police -- and taxpayers, Demers noted.

"Forensic video analysis can be extremely cost-effective because it represents an opportunity to quickly and decisively identify suspects and key witnesses, therefore shortening the investigation, freeing up traditional investigative resources, increasing the likelihood of a guilty plea and reducing police and court costs. Video evidence can be used to decisively confirm or refute alibis."

Click here to continue reading the article.


People v Khaled

From People v Khaled (Case No. 30-2009-304893 - Ca. Superior Court - Appellate Div. - Orange County): "... the police department of the City of Santa Ana issued a traffic citation to the appellant alleging a violation of California Vehicle Code section 21453, subdivision (a). A traffic trial was held on the matter ..."

This is how it started. In order to prove it's case against Khaled, photographs were introduced to show Khaled driving through an intersection. Khaled objected - asserting that the introduction of the photos (and declarations by the police officers in support of the photos) were inadmissible hearsay. The trial judge overruled the objection and admitted the photos as "business records, official records, and because a proper foundation for the admission had been made based on the submitted declaration."

On appeal, the appeals court ruled that the trial court erred in admitting the photos over Khaled's hearsay and confrontation clause objections. With the photos gone, the judgment was reversed.

But wait, there's more ...

The court declared the "date, time, and other information" hearsay evidence as the person who entered that info into the system did not testify, nor was he/she subject to cross examination.

But wait, there's more ...

The person or persons who maintain the system didn't testify. "No one with personal knowledge testified about how often the date and time are verified or corrected."

Oh, we're not even close to being done yet ...

"The person with direct knowledge of the workings of the camera-computer system did not testify. Instead, the prosecution chose to submit the testimony of a local police officer ..." "This witness testified that sometime in the distant past, he attended a training session where he was instructed on the overall working of the system at the time of the training ..." The officer "was unable to testify about the specific procedure for the programming and storage of the system information."

It just keeps getting better ...

I think that you know where this is going. Take a look at the published ruling. I can think of many situations where this will apply. How many can you think of ... ?


Monday, July 19, 2010

People v. Beckley

The s***t storm has already begun. The cat's out of the bag. Motions have already been filed relating to the Beckley decision on the authentication of images taken from on-line sources.

If your agency is in (or does business in) California, you'll need to understand how this ruling will impact your casework. It's best to get ahead of these things.

There aren't many labs out there that can provide this level of service. If you need help, send me a note and I'll get you an appropriate referral.


Friday, July 16, 2010

Work Every Case Like It Is Going to Court

Wrapping up the series on authentication, I'm going to point you over to the Ex Forensis blog for a post by Lars Daniel that deals with his first time testifying as an expert.

"Work Every Case Like It Is Going to Court
A case can take a long time to get to court. Make sure to take copious notes during your examination and to perform a thorough investigation when working a case. Most likely you won’t get a second chance. Since a “do over” is basically non-existent when performing an investigation, do everything in your power to get it right the first time. Can you remember what you were doing a year ago this time? I barely can. Document your work thoroughly so you remember the case you worked a year ago."

Part of the preparation should include researching relevant / recent case law that pertains to the case that you're involved with. Don't depend on the attorney to know this info ... you're the expert. If you have a packet of case law, make sure that you give it to your attorney with plenty of time for him/her to digest it. There are quite a few cases cited here on the blog. But, I can't post everything. If you find something that's not listed here, and you think that it should be ... send it in.


Thursday, July 15, 2010

Authentication of web pages

Continued from yesterday ...
From People v Beckley, et all (B212529 - Ca. 2nd Appellate District): "As evidence that the defendants belonged to the Southside Compton Crips, the prosecution offered a purported roster of the gang‘s members, including Beckley and Finn, which appeared on a web page that Detective Schoonmaker printed from the internet. The trial court admitted the evidence over the defendants‘ objections. Only Finn has pursued the admissibility of the roster on appeal. He argues that the roster was ―unauthenticated‖ because there was no evidence as to who created it, what it was intended to represent, whether it did in fact represent what it was intended to represent, and whether its creator had any basis in personal knowledge for including the names on the list."

"The printout is presumed to be an accurate representation of the web page Detective Schoonmaker found on the internet. (Evid. Code, § 1552, subd. (a) ["A printed representation of computer information or a computer program is presumed to be an accurate representation of the computer information or computer program that it purports to represent"].) The issue, however, was not whether the computer‘s printer could be trusted to reliably print out what was on the computer‘s screen or stored on some site but whether the content of what was on the site was reliable. We conclude that the evidence was insufficient to show that the writing was what it purported to be "a roster of the Southside Compton Crips. Therefore, the writing should have been excluded as unauthenticated and, therefore, irrelevant. We further conclude, however, that the error was harmless."

"Here, Schoonmaker claimed the writing was a roster of the members of the Southside Compton Crips. Schoonmaker admitted that he did not know who authored the roster but testified that he believed "that is a roster of Southside Compton Crip gang members that they themselves put together." This evidence was insufficient to authenticate the document as a roster of the Southside Compton Crips. Schoonmaker admitted that he did not know who created the list nor did he explain the basis for his assertion that the gang members "themselves put [it] together." Moreover, he offered no evidence that the person who created the list had any personal knowledge of the members of the gang or that the persons named in the list were current gang members. Accordingly, the court should have excluded the purported roster of gang members. The court‘s error, however, does not require reversal of Finn‘s conviction because the information contained on the list was cumulative. There was other evidence of Finn‘s membership in the gang, including his own admission, only one month before the shooting, made to police when interviewed in Seattle, and the testimony of Detective Valencia that Finn "has been seen and congregated with other members of this particular street gang." Evidence also showed that he had a body tattoo indicating affiliation with the gang."

... to be continued ...


Wednesday, July 14, 2010

Authentication of on-line images

From People v Beckley, et all (B212529 - Ca. 2nd Appellate District): "In this opinion we hold that the prosecution‘s failure to authenticate a photograph and "gang roster" downloaded from internet web sites should have barred their admission but that the errors were harmless as to both defendants. We also conclude there was insufficient evidence to support the street gang enhancement of each defendant‘s sentence. We modify the judgments as to each defendant by striking the street gang enhancements. We further modify Finn‘s judgment by striking the gun use enhancements under Penal Code section 12022.53, subdivisions (b) through (d) and remand for resentencing."

"In rebuttal to Beckley‘s and Fulmore‘s testimony denying Beckley‘s gang involvement, Detective Schoonmaker testified regarding gang-related evidence he recovered from the MySpace.com internet accounts of Finn and Beckley"

"To rebut Fulmore‘s testimony that she did not associate with the Southside Compton Crips and that she insisted Beckley stop his association with the gang, the prosecution offered a photograph purportedly showing Fulmore flashing the Southside Compton Crips gang sign. Detective Schoonmaker testified that he downloaded the photograph from Beckley‘s home page on the internet website MySpace. The trial court admitted the photograph over both defendants‘ objections that it had not been authenticated. We agree with defendants that the court erred in admitting the photograph but we conclude that the error was harmless."

"A photograph is a "writing" and "[a]uthentication of a writing is required before it may be received in evidence." (Evid. Code, §§ 250, 1401, subd. (a).)"

"In People v. Bowley (1963) 59 Cal.2d 855, our Supreme Court established the two methods of authenticating a photograph. "It is well settled," the court stated, "that the testimony of a person who was present at the time a film was made that it accurately depicts what it purports to show is a legally sufficient foundation for its admission into evidence." (Id. at p. 859.) In addition, the court noted, authentication of a photograph "may be provided by the aid of expert testimony, as in the Doggett case, although there is no one qualified to authenticate it from personal observation." (Id. at p. 862.) In People v. Doggett (1948) 83 Cal.App.2d 405, the Court of Appeal upheld the admission of a photograph showing the defendants committing a crime. Because only the victim and the defendants, none of whom testified, were present when the crime took place and one of the defendants took the photograph, there was no one to testify that it accurately depicted what it purported to show. The People, however, produced evidence of when and where the picture was taken and that the defendants were the persons shown committing the crime. Furthermore, a photographic expert testified that the picture was not a composite and had not been faked. The court held this foundation sufficiently supported the photograph‘s admission as substantive evidence of the activity depicted. (Id. at p. 410.) Citing Doggett with approval, the Supreme Court held in Bowley that "a photograph may, in a proper case, be admitted into evidence not merely as illustrated testimony of a human witness but as probative evidence in itself of what it shows." (People v. Bowley, supra, 59 Cal.2d at p. 861.)

"Although defendants conceded that the face in the MySpace photograph was Fulmore‘s, neither method of authentication recognized in Bowley qualified the photo for admission as accurately depicting that Fulmore had assumed the pose shown in the photograph. Schoonmaker could not testify from his personal knowledge that the photograph truthfully portrayed Fulmore flashing the gang sign and, unlike Doggett, supra, 83 Cal.App.2d at p. 410, no expert testified that the picture was not a 'composite‘ or 'faked‘ photograph. Such expert testimony is even more critical today to prevent the admission of manipulated images than it was when Doggett and Bowley were decided. Recent experience shows that digital photographs can be changed to produce false images. (See e.g. U. S. v. Newsome (3d Cir. 2006) 439 F.3d 181, 183 [digital photographs used to make fake identification cards].) Indeed, with the advent of computer software programs such as Adobe Photoshop "it does not always take skill, experience, or even cognizance to alter a digital photo." (Parry, Digital Manipulation and Photographic Evidence: Defrauding The Courts One Thousand Words At A Time (2009) 2009 J. L. Tech. & Pol‘y 175, 183.) Even the Attorney General recognizes the untrustworthiness of images downloaded from the internet, quoting the court‘s warning in St. Clair v. Johnny’s Oyster & Shrimp, Inc. (S.D. Tex 1999) 76 F. Supp.2d 773, 775 that "[a]nyone can put anything on the Internet. No web-site is monitored for accuracy and nothing contained therein is under oath or even subject to independent verification absent underlying documentation. Moreover, the Court holds no illusions that hackers can adulterate the content of any web-site from any location at any time.‘"

... to be continued ...


Tuesday, July 13, 2010

Animated GIFs

A while back, an officer wrote in to ask about extracting a frame from an animated GIF. It seems that a parolee had created this animation and posted it on a web page. Within the GIF was a frame that showed activity that the parolee wasn't supposed to be doing. The officer wanted to extract the frame easily and preserve it as a separate file. I sent him a rather round-about procedure for accomplishing the task. In the end, frustrated, he sent me the file and I helped him out.

Now, as Adobe's Julieanne Kost points out in her blog post today, "Photoshop now has the ability to open Animated GIF files and preserve their frames." How cool is that? It just keeps getting better with each release.


Monday, July 12, 2010

Local Training Opportunity

The road show is back again. July 21 in Commerce, Ca will be the next hands-on Forensic Photoshop class. Click here for more details.

Friday, July 9, 2010

WMV in Adobe Media Encoder (Mac)?

"Hey Jim. Where's the WMV format in Adobe Media Encoder for Mac?" asked a reader recently.

Sorry ... but WMV isn't included as an export option on the Mac deployment. Mac users don't get Real Media either. I, for one, certainly wish that Adobe would include the WMV export ... as many Mac users (myself included) export files for Windows users.


Thursday, July 8, 2010

Power lines act as police informers

From the Register's Chris Williams: "Police scientists have hailed a new technique that recently played a pivotal role in securing a murder conviction as the most significant development in audio forensics since Watergate.

The capability, called "electrical network frequency analysis" (ENF), is now attracting interest from the FBI and is considered the exciting new frontier in digital forensics, with power lines acting as silent witnesses to crime.

In the "high profile" murder trial, which took place earlier this year, ENF meant prosecutors were able to show that a seized voice recording that became vital to their case was authentic. Defence lawyers suggested it could have been concocted by a witness to incriminate the accused.

The police force that ran the investigation this week declined to name the murderer in response to requests from The Register, citing undisclosed "operational reasons".

ENF relies on frequency variations in the electricity supplied by the National Grid. Digital devices such as CCTV recorders, telephone recorders and camcorders that are plugged in to or located near the mains pick up these deviations in the power supply, which are caused by peaks and troughs in demand. Battery-powered devices are not immune to to ENF analysis, as grid frequency variations can be induced in their recordings from a distance.

At the Metropolitan Police's digital forensics lab in Penge, south London, scientists have created a database that has recorded these deviations once every one and a half seconds for the last five years. Over a short period they form a unique signature of the electrical frequency at that time, which research has shown is the same in London as it is in Glasgow.

On receipt of recordings made by the police or public, the scientists are able to detect the variations in mains electricity occuring at the time the recording was made. This signature is extracted and automatically matched against their ENF database, which indicates when it was made.

The technique can also uncover covert editing - or rule it out, as in the recent murder trial - because a spliced recording will register more than one ENF match.

The Met emphasised that ENF analysis is in its infancy as a practical tool, having been used in only around five cases to date. Proponents are optimistic about its uses in counter-terrorism investigations, for example to establish when suspects made reconnaissance videos of their targets, or to uncover editing in propaganda videos.

Dr Alan Cooper, the leader of the Met's ENF project, said the technique is proving invaluable in serious cases, where audio and video evidence and its authenticity is often questioned.

To continue reading this story, click here.


Wednesday, July 7, 2010

Ask a Pro - Premiere Pro CS5

Adobe's Dave Basulto recently hosted a Connect Session on Premiere Pro CS5 titled "Ask a Pro." Check it out by clicking here.

Tuesday, July 6, 2010

An interesting case - what happens when the DVR malfunctions

Here's an excerpt from an interesting case in North Carolina involving a malfunctioning DVR and video evidence not retrieved by the police.

"... First, we cannot conclude that the State "suppressed" the surveillance video because the State never actually possessed that item in the first place or took any steps to prevent Defendants from obtaining access to it. Under Brady, the State is required "to disclose only those matters in its possession. . . ." Thompson, 187 N.C. App. at 353, 654 S.E.2d at 494. In addition, "Brady requires that the government disclose only evidence that is not available to the defense from other sources, either directly or through diligent investigation." State v. Scanlon, 176 N.C. App. 410, 436, 626 S.E.2d 770, 788 (2006). Shortly after the robbery, representatives of law enforcement and a number of the State's witnesses viewed the surveillance video. At a later time, the Albemarle Police Department made several attempts to copy the surveillance video, including sending a technology specialist to the Sonic restaurant in an attempt to achieve that end. However, these efforts to copy the surveillance video were unsuccessful due to a malfunction in Sonic's equipment. The record does not contain any indication that the subsequent destruction of the video of the robbery resulted from any action on the part of anyone acting on behalf of the State. Defendants were, at all times, able to contact Sonic directly, attempt to ascertain whether a surveillance video existed, and make independent efforts to preserve it for use at trial. However, the record does not contain any indication that Defendants made any attempt to contact Sonic between the week of 10 November 2008, when the existence of the surveillance video was discovered, and the beginning of the trial. Based on these facts, we cannot conclude that the State suppressed the evidence in question or that the State in any way interfered with Defendant's ability to independently obtain access to the surveillance video.

Secondly, even assuming that the State had an obligation to disclose the existence of the surveillance video, Defendants have made no showing that its contents were exculpatory or material. On the contrary, the record is completely silent as to what the contents of the surveillance video actually were. In the absence of some indication of the nature of the video's contents, we cannot say that it contained information that would have been helpful to Defendants or that "there is a `reasonable probability' of a different result had the evidence been disclosed." Williams, 362 N.C. at 636, 669 S.E.2d at 296 (quotation omitted).[ 4 ] Thus, we are unable to conclude that the surveillance video was either exculpatory or material as those terms are used in Brady-related jurisprudence. ..."

Read the whole ruling by clicking here.


Friday, July 2, 2010

Creating Contact Sheets in Bridge CS5

Folks have been asking about the new Bridge CS5 and how it will handle Contact Sheets. Here's a rundown on the feature.

The Contact Sheet feature is found in the Output Workspace.

In the Document portion of the panel, you can choose paper size, quality, and etc. You can also assign a password to the resulting file.

In the Layout section, you choose how the images will flow across your page. Auto-Spacing is usually a good option to check ... let Bridge do the layout work for you and speed things up. Remember, a 2 x 2 arrangement means 4 images on a page ... and so forth.

The Overlays section deals with if/how/where you want those helpful tags and page numbers arranged on your sheet. You can also choose font size/colour/alignment.

The custom Text input in the Header/Footer portion is worth its weight in gold.

When you're finished, you can choose to save the settings for next time and view the resulting file.

It's fast and easy. Bridge just keeps getting better.


Thursday, July 1, 2010

Photoshop CS5 Optional Plugins

If you're looking for the legacy Contact sheet plugin or Twain, or ... here's the link to the optional plugins for Photoshop CS5: