Predatory Open-Access Scholarly Publishers

I recently received an invitation (via LinkedIn) to speak at the 2nd International Conference on Forensic Research & Technology, to be held in October in Las Vegas. While it's always a bit flattering to receive an invitation to present, I had to admit that I'd never heard of the conference or it's host - OMICS Group.

Before agreeing, I searched the net and asked friends if they'd heard of the group or it's conference. No one in my circle of friends had heard of the group, much less the conference. A little more searching dug up an old article from the Charleston Advisor.

In their expose of "Predatory Open-Access Scholarly Publishers," the Advisor notes, "... I recently discovered OMICS Publishing Group, which appears to be a brand-new entry into the predatory Open-Access publishing industry, an industry that seems to be growing by the week. Based on the international dialing code on OMICS' Contact page, it appears that this publisher is based in India (the site does not give an address or location, only telephone numbers, including some in the U.S. area code 650). OMICS offers 68 peer-reviewed journals, most of which are health sciences titles. Few of the journals have any content. When one clicks on Current Issue or Previous issue on each journal's home page, a page appears that says “coming soon.”

Having a large number of titles, as does the OMICS Publishing Group, is typical of predatory Open-Access publishers. Also typical is each journal's broad coverage. For instance, among this publisher's titles we find Earth Science and Climate Change, Anesthesia and Clinical Research, and Bacteriology and Parasitology. By offering 68 titles each with a broad coverage, this publisher is tacitly saying it will publish anything.

OMICS' Web site stands out for its sophisticated look and feel. It has a very professional look and repeatedly pays homage to the Open Access movement, a movement it is exploiting. The tag line on the publisher's home page reads“OMICS Publishing Group: An Open Access publisher for the advancement of science and technology.” OMICS very cleverly uses logos from several legitimate organizations associated with Open Access on its pages. For example, on its home page, the publisher has logos for CrossRef, PubMed Central, DOAJ, Index Copernicus, and Scientific Commons.

The publisher also has a link called Conferences that leads to a page with scientific conference information, a trick to make the site look more scholarly and legitimate. The home page uses graphics and layout that effectively mimic legitimate publishers' Web sites. OMICS uses the “author-pays” model (OA gold) to support Open Access. Buried on one page I found a reference to “handling fees” that are charged upon acceptance of a manuscript.

The predatory Open Access publishing industry is getting more and more competitive. This publisher's marketing strategy is to make its site appear just like the sites of legitimate publishers, a strategy it accomplishes quite well, for the site is slick and convincing. I never was able to determine exactly what OMICS stands for or means; the name is not explained. Perhaps it is a play on the “omics” suffix found in the names of fields of study such as genomics and proteomics ..."

Needless to say, I declined the invitation.

Frames per second

Many investigators assume that all their video evidence comes in one flavor - 29.97 frames per second. But, is this true?

DVRs are usually scalable and upgradeable utilizing specific or proprietary software. They typically have video capture circuits or cards that can process 60, 120, 240, and 480 frames per second. These numbers represent the total number of frames per second that can be accommodated for all of the cameras or channels per system. For example, the 120 frames per second DVR with 16 cameras has an approximate frame rate of 7.5 frames per second. This means that each camera can be converted at 120/16 or about 7.5 frames per second.

Then there's the question of the reliability of the DVR. Did it actually record 7.5 frames per camera per second? In my tests, the answer is usually NO. System overhead and other internal issues usually result in a number that's between 5 and 8 frames per second - a number that randomly varies over time.

Tools like Amped FIVE can give you precise frame counts, and even accurately tell you the frames per second of the clip. Production tools, like Premiere Pro or Final Cut, force your clip to conform to certain specified standards. Also, there are LEVA courses that teach a method of conforming files for use in Avid's Media Composer.

Still and all, it's better to know than to assume.

Compression Ratio

What is compression ratio?

Here's an example: a compression ratio of 200:1 describes the original video with the numeric value of 200. In comparison, the compressed video is represented by the lower number. As more compression occurs, the numerical difference between the two numbers increases. The compression ratio is equal to the size of the original image divided by the size of the compressed image. Remember the formula (R = C/O) A 10 MB file that compresses to 2 MB would have a 5:1 compression ratio.

Another way to look at it is that MPEG4 video compressed to a 30:1 ratio allows the storage of 30 compressed frames in the same space as a single uncompressed frame.

In most cases, the video quality decreases as the compression ratio increases. This is the obvious result of throwing away more and more information to achieve compression. Think of it in terms of making orange juice from fresh oranges.

From Digital CCTV by Emily M. Harwood.

Copy to New

Many police officers regularly record interactions with the public on small digital audio recorders. Some, like traffic officers, even use small video recorders. A question came in from the following scenario.

During a traffic stop, an officer was approached by a citizen who wasn't involved in the traffic stop. A series of questions/answers were exchanged by the officer and the citizen. Then, the officer resumed handling the traffic stop.

Months later, the officer was approached by his agency's internal investigators looking into his handling of the citizen's questions. He had recorded the interaction on his personal audio recorder, but only needed the small section dealing with the citizen, not the entire traffic stop. His question - how best to redact the section of audio from the entire file?

It's actually a simple process. In Adobe's Audition, load the audio file. Then scrub to the section containing the relevant audio to be redacted. Select the section and choose Edit>Copy to New. This will create a new file from the selection. Next, just save the file with an appropriate name.

Other programs have the same feature. In those, you may need to copy the selection first - then select Paste to New.

Either way, it's helpful to know what the software calls the action you'd like to perform. Once you know that, you're on your way.

What happened to Sound Soap?

A Sound Soap users recently went to their site to check for upgrades. It had been a while, so he was surprised to find that BIAS, the makers of Peak and Sound Soap were out of business. Here's a link to a discussion on the details of what happened.

Audio restoration

I received a call about restoring the voices recorded by an in-car video system. Unfortunately, the siren obscured the voices. Audio restoration always involves trade-offs. In this example, removing the siren can remove part of the voice that occurs during the siren. So you may have to reconcile solving this problem with the infamous law of unintended consequences. Thankfully, Adobe's Audition allows for some very strategic and targeted edits. When done in the Spectral View, you can be very precise in removing unwanted noise - but you'll still lose a bit of information.

Photoshop as a verb

Photoshop: verb. To alter an image.

If you needed further evidence of photoshop becoming a verb, here's the latest round of fun - a collection from twitter. Photoshopping is all the rage these days.

Audio forensics question answered

Earlier last year, I taught an audio forensics class that featured Adobe's Audition. I like Audition for teaching audio forensics in the generic, and for my day-to-day audio work.

One of the features that I use all the time is the Spectral View. In it, I can see the audio's problems - like noise - much clearer. I can also make edits to the file in that view. In a recent case, I worked almost exclusively in that view to remove an unwanted noise - which gave me the perfect platform in my notes to visually explain my work.

A question came in from a reader about doing this type of work in Sony's Sound Forge Pro 10. Unfortunately, according to Sony - you can't.

"How can I make correction on the spectral graphic?
Spectrum Analysis is used only to view a specific section of audio. You will not be able to use this tool to make corrections to your audio file, but it gives you important information on what corrections may need to be made using other tools inside Sound Forge Pro 10."

Now I find out that Sony's got a separate product for that, SpectaLayers Pro. But, as good as it might be, and as interoperable as it might be with other Sony products, it's still another purchase.

If you're doing audio enhancement, audio clarification, noise reduction, noise isolation, or identification work with audio, and you're not utilizing some sort of spectral view, I'm not sure how you're seeing the whole picture (intensity, frequency, etc.).

For now, I'm still using Audition CS6 (Creative Cloud style).

Enjoy.

Grabbing a still image from AVC video

Here's a series of predictive coding sequences from an MPEG-4 (AVC) video file. Those of you familiar with video coding will recognize the format of the structures. Here's your question for today: that image that you want to grab ... is it an I frame, a P frame or a B frame?

IPPPPPPPPPPPIPP..., i.e. one I-slice followed by 11 P-slices, with one reference frame

IBBPBBPBBPBBIBBP..., i.e. 12-frame GOP with one I-slice, three P-slices and eight B-slices in each GOP.

IBBBBBBBBBBBIBB.., 12-frame GOP, hierarchical prediction.

Earlier, we talked about the structure of MPEG video. Here we ask the question, what happens when the frame that you want is a B or P frame? What do you do? How do you respond to the inevitable questions:

• Is this an accurate depiction of the scene?
• Is this an original image?

If you're going to court with digital video - it pays to do your homework. Know the codec and how it works. Know which frame you selected for your exemplar ... and how it was generated. If you do use a B or P frame, know how the pieces were assembled or how object oriented compression works. 

Essentially, be prepared for the worst and you should do fine.

Why won't my DVD play in Totem movie player?

Totem is the official movie player of the GNOME desktop environment based on GStreamer.

Ubuntu, a popular form of Linux, launches Totem by default when you insert a DVD into your workstation's CD/DVD tray. However, by default, Totem doesn't contain the proper codecs to play DVDs. When you first play a DVD, Ubuntu will ask whether you want to search for the proper codec. If you choose to search, Ubuntu will offer the available codec programs in the repositories for playing DVDs.

However, you may not be able to view your DVD even after installing the proper codec. Watching a DVD in Linux is a bit of a legal quagmire if you live in the United States. The Digital Millennium Copyright Act (DMCA) and other issues make it tricky for any open-source program to navigate the licensing maze when it comes to movies that are encoded or otherwise protected against pirating.

Not all DVDs have these features enabled, so you might be able to watch some DVDs on your Ubuntu workstation. If you burn your own DVDs, they should work just fine.

Video on Linux?

A few more adventurous officers got a grant to buy a Linux based workstation. They figured that since they were downloading from Linux based DVRs, they should have a Linux based computer. But, much to their dismay, the video that they downloaded from the DVR didn't work on their Ubuntu box.

As a general rule, viewing video files in Ubuntu requires two separate pieces of software:

• A video-playing software package
• A video-decoding software package

The video-decoding software package tells the video-playing package how to read and interpret the video file. Hopefully, by now you know that the decoding software is called a codec. Usually, each codec decodes a single type of video file. Ubuntu contains only the codec package for decoding OGG video files. Viewing any other type of video file requires downloading a different codec package. This is where things get messy.

The MPG video file format is by far the most common video format in use, both on the Internet and in many digital movie cameras. It provides good-quality video with relatively small file sizes by using patented compression algorithms. Unfortunately, because of the patented algorithms, MPG is a licensed product, which is a bad thing in the open-source world. Reverse-engineered codec packages are available that can decode MPG video files in Linux systems. However, these packages are not legal for use in some countries.

Add to this the problem of using un-licensed or quasi-legally obtained software in your case work. Do you want to answer questions about the legality of how you obtained your codecs from an Estonian hacker's web site?

For the power-user, having a Linux based workstation can be an advantage. But, most DVRs output a file that is meant to be used in the Windows operating environment.

One of the things that Amped FIVE users know is that FIVE automatically chooses the appropriate decoder - taking out the guesswork. And, to top it off, the choice is documented in your report. How cool is that?!

Where's the DVR?

Have you ever walked on to a crime scene to retrieve video evidence, only to find a server room full of gear. Where's the DVR? To which one of those components do you connect to retrieve your data? What do you document?

According to Anthony Caputo, The standardized rack-mounted form factor can be open – simply a few rails and a floor panel; it can be partially enclosed; or it can be fully enclosed within a cabinet under lock and key for additional security. A fully enclosed lockable rack, securely fastened to the floor and/or walls, severely restricts physical access by unauthorized personnel.

Standard rack-mounted computing implementations can be custom designed and built using various types and configurations and/or multiples of 1-U components. The standard 1-U unit is 19″ (482.6 mm) wide and 1.75″ (44.45 mm) tall. The most common rack-mounted computing form factor platform is based around a 42-U configuration, which means that a 42-U rack is capable of housing a maximum of 42 individual 1-U units.

There are many types of 1-U devices including network accessed storage (NAS), switches and routers, firewalls, power strips, uninterrupted power supplies (UPS), or even an LCD monitor and keyboard that neatly fold away. The multiple 1-U computers (servers and archivers) can be accessed using a keyboard, video, and monitor (KVM) switch, which allows access to each computer with the click of a button or a couple of keystrokes.

Additional rack-mounted options include lockable sliding rails, which allow a variety of equipment to slide in and out of sight without disconnecting it from the system. Rack-mounted equipment also provides easy access to the rear of the units, which may include inputs and outputs, power, and hardwired connectivity.

You're often better off asking for assistance from the tech that maintains the equipment. They might not know how to retrieve the data, but they should know which computer does what.

Computer or appliance?

Is a DVR a computer or an appliance? If the DVR software and cards reside in a Windows PC, it seems like a simple answer. But what about those little black boxes we're finding more often now?

The typical digital video recorder (DVR; or networked video recorder, NVR) includes a host application (usually a license-free Linux OS), video conversion software, storage and disc management application, and a VMS interface to manage the integrated video. The embedded video surveillance application and OS provide an appliance rather than a computer, streamlining the process of integration, maintenance, and support. As such, the DVR is the appliance that replaced the analog videocassette recorder (VCR).

So, when your computer crimes investigators don't know what to do with your DVR, fret not - after all, it's an appliance and not a DVR.

Privacy concerns and authentication of video and images

I've seen a lot of these types of memes floating around the internet. There's a dedicated group of activists who regularly record police activities and police contacts with the public. If you're LE, and you think what you're doing is private, think again. You're likely about to be the star of your own YouTube channel - unbeknownst to you.

When your internal investigators receive video from the public as part of a complaint, do your investigators automatically take the video as authentic? When YouTube video is involved, does your agency accept what it sees on the screen, or do they question the chain of custody, authenticity, source, and etc?

Chances are, they believe what they see. In my work on People v. Abdullah (BA353334, Los Angeles County Superior Court, December 2009), I was able to determine that the defendant had introduced completely fraudulent video - a complete fabrication. My work in authenticating the video led to a large mea culpa on the part of the defense counsel, but also helped preserve the careers of two of LA's finest.

Just because it's on film, or a thumb drive, doesn't make it authentic. While I am not saying that the activist groups are up to no good, I am saying that efforts should be made by the relevant authorities to determine the authenticity of the video footage submitted. If it's your career, you'll want to know that the video's been authenticated by an independent third party. That's where we come in.

I'll be speaking more about this in the future, and presenting an authentication workshop at the Spring 2013 NaTIA Pacific Chapter meeting. Stay tuned.

Video Standards for Law Enforcement Applications

The Criminal Justice Interview Room Recording System (IRRS) Standard, Supplier's Declaration of Conformity Requirements, and Selection and Application Guide is now available for public comment.

Click here.

The National Institute of Justice (NIJ) is in the process of developing a new Interview Room Video System Standard and corresponding supplier’s declaration and user’s guide documents. Through funding to the International Association of Chiefs of Police (IACP) under award 2009-IJ-CX-K009, this work is being performed by a Special Technical Committee (STC), comprised of law enforcement practitioners, researchers, testing experts, certification experts, and representatives from other stakeholder organizations. In late 2009 the STC completed draft versions of the three documents, and in January 2013 the documents were made available for public comment and review.

1. Draft Criminal Justice IRRS Standard
2. Draft Criminal Justice IRRS Supplier's Declaration of Conformity Requirements
3. Draft Criminal Justice IRRS Selection and Application Guide

The opportunity to provide comments on these documents is open to industry technical representatives; criminal justice agencies and organizations; research, development, and scientific communities; and all other stakeholders and interested parties. Please send comments by email to Mark Greene at mark.greene2@usdoj.gov by 5 P.M. Eastern Time on February 25, 2013.

What is PRNU?

PRNU = photo-response non-uniformity (a camera's noise fingerprint).

Identification of the source that has generated a digital image is considered one of the many open issues in the multimedia forensics community. The extraction of photo-response non-uniformity (PRNU) noise has been so far indicated as a means to identify a sensor's fingerprint. Such a fingerprint can be estimated from multiple images taken by the same camera by means of a de-noising filtering operation." From Crime Prevention Technologies and Applications for Advancing Criminal Investigation by Chang-Tsun Li and Anthony Ho.

An outline of JPEG compression

"There are many options for JPEG compression and many parameters that may be specified. [The] goal [here] is not a “bit-by-bit” account of the algorithm but rather to illustrate the role of the mathematics [involved], specifically the DCT. Here is the basic procedure:

1. Separate color, if applicable: A color image is decomposed into its color components, usually using the YCbCr color scheme. This color representation scheme, like RGB, dictates the color of each pixel with three numbers. The entire image can thus be represented by three arrays of appropriate size. The details here need not concern us, since we will be working with monochrome images.
2. Transform: Perform a block DCT on the image using 8 × 8 pixel blocks. If the image pixel count in either dimension is not a multiple of 8 the image is padded in some way to a higher multiple of 8. 
3. Quantize: Each 8 × 8 pixel block has an 8 × 8 DCT consisting of real numbers. Each of the 64 components or frequencies in this DCT is quantized. This is the main lossy step in the compression.
4. Compress: The image is compressed by using run-length encoding on each block, and then Huffman coding the result. The dc coefficient is often treated separately. This is the step where actual file compression occurs.

Decoding reverses the steps:
4. Decompress: Recover the quantized DCT blocks.
3. Dequantize.
2. Inverse transform: Apply the inverse DCT to each block.
1. Mix colors: If applicable, and display block."

From Discrete Fourier Analysis and Wavelets: Applications to Signal and Image Processing by S. Allen Broughton and Kurt M. Bryan.

Purkinje effect

"As the light dims, we literally perceive less color, prompting the famous painter Monet to exclaim, “Terrible how the light runs out, taking color with it.” In low light, our color-blind rods become more dominant in our vision. Additionally, of the three cone types, the one most sensitive in dim light is the cone that responds to blue. Thus in low light levels, we are less sensitive to reds and more sensitive to blues. This is partly why we perceive night as monochromatic and bluish, a phenomenon known as a Purkinje shift, or Purkinje effect (above).

Although this information might seem like a review of a high school science class, understanding how we perceive color explains the appearance of colored materials under colored light. Understanding the eye and how the images you see are translated to the brain also can help you to create images that capture your perception of what you saw ... " - from Illuminated Pixels by Virginia Wisslar

Pixel neighborhoods

The pixels surrounding a given pixel constitute its neighborhood, which can be interpreted as a smaller matrix containing (and usually centered around) the reference pixel. Most neighborhoods used in image processing algorithms are small square arrays with an odd number of pixels, for example, the 3 × 3 neighborhood shown below.

In the context of image topology, neighborhood takes a slightly different meaning. It is common to refer to the 4-neighborhood of a pixel as the set of pixels situated above, below, to the right, and to the left of the reference pixel (p), whereas the set of all of p's immediate neighbors is referred to as its 8-neighborhood. The pixels that belong to the 8-neighborhood, but not to the 4-neighborhood, make up the diagonal neighborhood of p (below).

Concept of neighborhood of pixel p (from an image topology perspective): (a) 4-neighborhood; (b) diagonal neighborhood; (c) 8-neighborhood.

From Practical Image and Video Processing Using MATLAB® by Oge Marques.

3 level MPEG picture hierarchy

"This sketch shows a regular GoP structure with an I-picture interval of n= 9, and a reference picture interval of m= 3. This example represents a simple encoder that emits a fixed schedule of I-, B-, and P-pictures; this structure can be described as IBBPBBPBB. The example shows an open GoP: B-pictures following the GoP’s last P-picture are permitted to use backward prediction from the I-picture of the following GoP. Such prediction precludes editing of the bitstream between GoPs. A closed GoP permits no such prediction, so the bitstream can be edited between GoPs. Closed GoPs lose some efficiency." - from Digital Video and HD, 2nd Edition, by Charles Poynton.

Square sampling

"In modern digital imaging, including computing, digital photography, graphics arts, and HD, samples (pixels) are ordinarily equally spaced vertically and horizontally – they have equal horizontal and vertical sample density. These systems have square sampling (‘square pixels’); they have sample aspect ratio (SAR) of unity. With square sampling, the count of image columns is simply the aspect ratio times the count of image rows.

The term square refers to the sample arrangement: Square does not mean that image information is uniformly distributed throughout a square area associated with each pixel! Some 1080i HD compression systems resample to 4/3 or ¾ pixel aspect ratio.

Legacy imaging and video systems including digital SD systems had unequal horizontal and vertical sample pitch (nonsquare sampling). That situation was sometimes misleadingly referred to as ‘rectangular sampling,’ but a square is also a rectangle! A heated debate in the early 1990s led to the adoption of square sampling for HD. In 1995 the New York Times wrote,

If you use the term pitch, it isn’t clear whether you refer to the dimension of an element or to the number of elements per unit distance. I prefer the term density.

HDTV signals can be sent in a variety of formats that rely not only on progressive or interlaced signals, but on features like square versus round pixels …

A technical person finds humour in that statement; surprisingly, though – and unintentionally – it contains a technical grain of truth: In sampled continuous-tone imagery, the image information associated with each sample is spread out over a neighbourhood which, ideally, has circular symmetry." - from Digital Video and HD, 2nd Edition, by Charles Poynton.

When is a composite image OK?

Twitter is again buzzing about a doctored image released by Rep. Pelosi's office.

This image is a fake but accurate accounting of the female members of the US Congress. It's a composite ... but not a very good one according to the flurry of Tweets that it generated.

So, yes ... it's "photoshopped." This kind of thing happens all the time in politics.  The content is a composite of more than one image (forgery). The context, a picture of the female members of Congress, is accurate - those are the female members.

It's what you do with the image that makes all the difference in the world.

More expert analysis

Someone sent this to me via Twitter (@jimhoerricks) and wanted my opinion. Essentially, they're asking for a photographic comparison of the woman in the photos. But, look at all the problems with the images - colour mismatch, aspect ratio mismatch, and so forth. The folks that make these memes care not a bit about the integrity of the image, they just cram together images in an attempt to make their point.

So, in my professional opinion ... the person spends too much time on Facebook.

Image Capture

"In human vision, the three-dimensional world is imaged by the lens of the eye onto the retina, which is populated with photoreceptor cells that respond to light having wavelengths ranging from about 400 nm to 700 nm. In video and in film, we build a camera having a lens and a photosensitive device, to mimic how the world is perceived by vision. Although the shape of the retina is roughly a section of a sphere, it is topologically two dimensional. In a camera, for practical reasons, we employ a flat image plane instead of a section of a sphere. Image science involves analyzing the continuous distribution of optical power that is incident on the image plane." - from Digital Video and HD, 2nd Edition, by Charles Poynton.

From grainy CCTV to a positive ID: Recognising the benefits of surveillance

This from the UK Independent (via @demuxdispatches): " ... Your identity is manifest in many different ways.” Ears, eyes, foot steps – all can be used to identify people. Even your heartbeat can betray who you are, and it can be detected from a distance without requiring contact with the body.

For those wearing masks or scarves over their faces, there are still plenty of ways computers can identify them. Much of the research has been carried out in the “biometrics tunnel” built in Prof Nixon’s department.

It’s a facility that requires a lot of technical expertise and patience – as Dr Carter tells us: “I’ve spent the last three months tracking down a fault in a cable.”

As I wander down it, eight cameras film my strides from a variety of angles against multicolour backgrounds, allowing electronic silhouettes and a 3D virtual model of my body to be constructed by a computer. The distance between my feet, knees, hips, shoulders and head are measured and the pattern of their motion analysed. Were I suspected of a crime, police would then be able to compare my gait profile to information gathered from CCTV footage of the incident – either eliminating me from their enquiries or encouraging them to delve deeper.

“We helped in a conviction of a bagsnatcher who robbed somebody,” says Prof Nixon. “He’d covered up his face with a motorbike helmet, that withheld his DNA, as there was no spit or breath. He wore gloves, so there were no fingerprints left – everything was covered up. But he still ran. We used images of him and presented images to the judge.”

Some of the work in the new centre will go into online identification. Keystroke analysis, looking at the minute differences in timings and patterns between different computer users’ typing mannerisms, is under development ..."

Continue reading the article by clicking here.

Happy New Year

From all of us, to all of you ... a happy and prosperous new year. Thank you for your continued support.

AmpedFive adds Color Deconvolution

Remember this article? Color deconvolution is an awesome tool for complex background removal that has applications across a number of forensic disciplines. Now, it's part of Amped FIVE. How cool is that?!

If you haven't checked out Amped FIVE, you owe it to yourself to spend a few moments to see just how robust this tool is. Latent Prints, Questioned Documents, Footwear, Tool Marks, Photogrammetry in 2d or 3d, Video, Images ... you name it. All for a very reasonable price. Well worth the investment.

The Perils of Using the Local Computer Shop for Computer Forensics

Along the lines of when is an expert not an expert, Larry Daniel posts the following quote in his article about using an unqualified person to perform computer forensics,

"Hickory Brands hired a service provider called Computer Ants, whose owner and operator, Thomas Scott, testified to never having performed forensic services in the context of a lawsuit. Scott, who the defendants tasked with producing documents responsive to search terms from a total of 308 million potentially relevant files on 35 computers and six servers, had previously worked as a truck driver and a security manager for Bass Pro Shop."

"The result was the delivery of 1,700 sensitive documents to the opposing counsel that resulted in a heated clawback motion, in which the judge found that the attorneys did not take the "reasonable steps" required by law to prevent the disclosure."

You can read more about that case by clicking here.

New Exclusive Photoshop Features for Creative Cloud Members

For a closer look at what’s new in Photoshop CS6 (13.1), click here.

Some of the improvements that may interest you are:

Retina Display Support
See more of the details in your images and in the Photoshop user interface when viewing on new Retina displays available on MacBook Pro.

Workflow improvements
Discover new user-inspired timesavers including Crop tool refinements, better naming of merged layers, the ability to quickly move a path anchor point using the spacebar and the option to see up to 100 items in your list of recently opened files. Easily create large images for signage, panoramas, and other large outputs by saving JPEGs of up to 65,000×65,000 pixels, more than twice the size previously supported. Ensure consistent type formatting across multiple documents by defining global styles, which are then available in any Photoshop document.

Conditional Actions
Speed up image processing by creating Conditional Actions. These commands use logic to automatically choose between different Actions based on rules that you establish.

Note: With the exception of Retina display support, the new features listed above will only be available to Adobe Creative Cloud members. For government and non-CC members, it just got interesting.

The costs of government

I try to keep up with current events. I read an article on Bloomberg.com about government employee costs under the title, "$822,000 Worker Shows California Leads U.S. Pay Giveaway." Being a part time government employee, I'd like to offer a bit of a rebuttal.

Point 1: "Today, the state’s highest-paid employees make far more than comparable workers elsewhere in almost all job and wage categories, from public safety to health care, base pay to overtime." - This interesting page makes the point that police detectives make more than private detectives on average and by region. What's lost on both pages is the fact that private sector workers can work as much as they are able, take on additional work, work for whomever they like, and negotiate for all of those conditions individually. Speaking of my own situation, I don't set my wage or working hours (no matter how hard I work, or how much I innovate, I get the same rate as everyone else in my pay grade). I don't have a say in benefits (including retirement). I can't actually opt out of my benefits package. I have to pay the union for the privilege of bargaining against my interests. I can't have a second job unless the city gives me permission. I don't get money for overtime worked - I get time off (which has to be used before vacation time). I don't get to go home until I'm relieved, which can be days beyond when I'd like to go home. Thus, there really is no comparison to a police detective and a private detective. The only real thing that we have in common is that we can both quit, and walk away (though my costs would be substantially higher).

Point 2: "From coast to coast, states are cutting funding for schools, public safety and the poor as they struggle with fallout left by politicians who made pay-and-pension promises that taxpayers couldn’t afford." - In California, the state is controlled by a supermajority of Democrats. Democrats and organized labor have walked hand-in-hand for generations. It's borderline conflict of interest to have the two negotiating over wages and benefits. Yet, there's more to the story. California is a magnet for those seeking opportunity. There's one side, those wishing to start a business and grow wealthy. Then there are those who come from all over seeking to avail themselves of our rather generous social programs. California, with 12% of the U.S. population, has one-third of the nation's welfare recipients. This influx of people requiring state services comes at a cost. Which would you rather pay for, schools, police, libraries, parks? All of the above? As each constituency fights for its piece of the pie, there will be winners and losers. Right now, the losers are the tax payers - who after Jan 1 will be some of the most burdened in the country.

Point 3: "“All it took was for political leaders to think more about the general population and the future, rather than their political futures,” said Crane, a Democrat who worked as an economic adviser to former Governor Arnold Schwarzenegger, a Republican. “Citizens should be mad as hell, and they shouldn’t take it anymore.” - Citizens aren't mad as hell. They voted in a Democrat supermajority - see point 2. The results of my own state assembly district is still up in the air. As it stands, the democrat challenger is ahead by 145 votes. With one party rule - they can do whatever they like (for good or ill). We'll see where the democrats lead the state.

Point 4: "Last year, Brown waived a cap on accrued leave for prison guards while granting them additional paid days off. California’s liability for the unused leave of its state workers has more than doubled in eight years, to $3.9 billion in 2011, from $1.4 billion in 2003, according to the state’s annual financial reports." - Why did the governor need to uncap accrued leave? How many prison inmates are in California's prisons? Is the trend rising or falling? Why? Inmates need to be housed and guarded 24 hours per day. They need food, laundry, medical care, and etc. Has the corrections realignment helped or hurt the overall situation? Is passing the buck to the counties a solution, or does it just postpone the problem?

Point 5: Elections have consequences. Here's the 2012 Platform of the political party that controls California. Every item has an actual cost today, plus a compounded (future) cost. Our education system "was once the envy of America. Our K-12 schools were among the best funded in the country and under the leadership of Governor Pat Brown, the California Master Plan for Higher Education made our community colleges, our California State Universities and our University of California institutional systems to emulate throughout the world. In recent years, our continual disinvestment from education threatens our ability to offer our youth the education they require to usher our state into the future." This statement from our leaders flies in the face of our state's constitution - which requires that a minimum of 40% of the state's general fund be spent on education. The actual number is closer to 50%. Thus, 50% of the world's 7th largest economy is spent on education ... and our kids are suffering? Where's the money going?

Here is the platform of a party that holds no current influence in Sacramento. Again, each of the items contained in the Libertarian Party's platform has a cost, as well as a savings for those areas that they think government should no longer control. Items 1 and 7 would reduce the prison population by about 40%. Item 10 is a huge cost saver - but now out of line with Obamacare. Item 18 gets rid of the state's ABC system. And so on ...

Thus, elections have consequences. California's voters chose to have a supermajority of leaders who believe in a large, all encompassing government. That choice has a high cost. If the voters really were mad, then the 2014 elections should see the Libertarian Party sweep into office ... and a massive redistribution of responsibilities back to the individual.

John Overton was right.

Thus endeth the rant.

Single View Metrology

Criminisi, et all, in their work Single View Metrology, describe how 3D affine measurements may be computed from a single perspective view of a scene given only minimal geometric information determined from the image. This minimal information is typically the vanishing line of a reference plane, and a vanishing point for a direction not parallel to the plane. Their work shows that affine scene structure may then be determined from the image, without knowledge of the camera’s internal calibration (e.g. focal length), nor of the explicit relation between camera and world (pose).

In particular, they show how to (i) compute the distance between planes parallel to the reference plane (up to a common scale factor); (ii) compute area and length ratios on any plane parallel to the reference plane; (iii) determine the camera’s (viewer’s) location. Simple geometric derivations are given for these results. They also develop an algebraic representation which unifies the three types of measurement and, amongst other advantages, permits a first order error propagation analysis to be performed, associating an uncertainty with each measurement.

They demonstrate the technique for a variety of applications, including height measurements in forensic images and 3D graphical modelling from single images.

Building on this foundation, the Measure 3d tool in Amped FIVE computes real-world distances directly on the image. The Measure 3d Single View Metrology implementation is based on the fact that some image lines, which are parallel in the real-world, join in a point in the image, named the vanishing point, due to the perspective. The vanishing points themselves are obtained by identifying, thanks to the geometric information (two or more lines for each x/y/z direction) provided by the user, sets of 3D points (x,y,z) that belong to the segment lines for each direction of interest. The scene perspective can be reconstructed from vanishing points: transforming the geometric information into a system of linear constraints on the coordinates of the 3D points and using the 2D observations (the known distance) to further constrain the 3D points. As result, 3D measurements may be computed from a single perspective view of a scene given only this minimal geometric information determined from the image.

The validity of the Single View Metrology approach is assessed by the Monte Carlo statistical tests: it determines how the uncertainty propagates from input to output of the computation chain and estimate the measurement accuracy.

But, as powerful as Amped FIVE is, it's only as good as the inputs received from a trained analyst. One of the examples used in my training sessions is a video from a convenience store. I have been to the scene and measured the floor tiles as 12" square. There is a discernible checker board pattern to the tiles, so it's easy to get X and Y segments from an 8' x 8' block of tiles. The store has two entrance/exit doors with security measuring tape affixed to the door frames, giving us the Z. Once this information is put into FIVE, measurements can be taken from within the scene with a high degree of reliability.

The biggest difference between SVM based photogrammetry, and methods like reverse projection photogrammetry, or products like iWitness, is that isn't the need to re-shoot the scene. Measurements are taken of the area that was captured by the video already in hand, like the floor tiles and the door frame - things that don't generally change. These measurements are then used for your calculations, lowering costs and time to completion / results.

Thus, if your are interested in adding Photogrammetry to your offerings, you should consider adding Amped FIVE to your tool kit.

Measuring within images

Here's a question - is it possible to measure within images? The answer, of course, is yes (with a gigantic caveat). It depends on what you mean by measure, and what it is that you'd like to measure.

In Amped Five, you have the ability to measure in 1d, 2d, and 3d. Tomorrow, we'll look at 3d measurements. Here's a look at 2 dimensional (X,Y) measurements within images.

The Amped FIVE Measure 2d tool computes a specific measurement distance in a rectified image. Image rectification corrects image distortion by transforming the image into a standard coordinate system (think perspective correction). Given an image of a planar surface (2d), points on the image plane can be mapped into corresponding points in the rectified plane by means of a projective transformation called homography. Points in one plane are mapped into the corresponding points in the other plane as follows:
X = Hx where x is an image point, X is the corresponding point on the world plane and H is the 3x3 matrix representing the homography transformation. Once the homography matrix H is known (or has been computed), any image point can be mapped into the corresponding location on the rectified planar surface and distances between actual points can be extracted by computing the Euclidean distance d(X1,X2), where X1 and X2 are the actual points of the two points x1 and x2 on the image plane. The homography is computed directly from a set of at least four points by the Perspective Correction filter.

Correct Perspective, in FIVE, maps a desired quadrangular region to a rectangular one, which allows seeing the plane of interest as the plane of the image was parallel to it. Pixel values are interpolated with a bicubic algorithm. (Anil. K. Jain, Fundamentals of Digital Image Processing, Prentice Hall, pp. 320-322, 1989.)

So what's the takeaway here? Measuring planar surfaces, or making two dimensional measurements within images, requires that a perspective correction process be applied first. If this isn't possible, then you should consider 3d measurements - which will be covered tomorrow - that deal with perspective as it is, and factors/computes the vanishing point in the image.

Jobs in forensics

As a few readers already know, I'm a PhD candidate working on a problem in the forensic sciences that I've illustrated here from time to time. A few years ago, the National Academy of Sciences declared the state of police (law enforcement staffed) forensic sciences to be quite dismal. Essentially, cops with nothing more than a driver's license and some vendor training on their tools were calling themselves forensic scientists - and coming to some troubling conclusions along the way.

Senator Leahy came along later can wrote a bill that put the NAS report into legislation - declaring that folks should have at least a masters degree to practice forensic science. The problem: no schools confer degrees for many of the CSI type tasks - latent prints, multimedia (video/image/audio), cell phones, tool marks, fire arms, and etc.

Along comes the Obama DOJ to say, it's sad that Leahy got no sponsors to his bill, but we like the idea. We'll do it within the construct of the DOJ's funding priorities - in other words, if you want federal money or you want to bring evidence in federal court, then you'll need to do X, Y, and Z (the work was done in the Executive Office - Subcommittee on Forensic Sciences).

So, schools are being created to confer this type of education. My area in this in multimedia. Part of my PhD dissertation deliverable is the creation of a school of media forensics - a school in a box deliverable that can be given to colleges in any city to start their own programs. In that way, local practitioners do not have to move away from their local areas to UC Denver in order to pursue the degree that they will now need.

Here's the dilemma. Some of the best candidates for this type of work moving forward (forensics) are autistic people. They may fall under one or many of the diagnosis given to autistics - high functioning autism, Aspergers Disorder, Sensory Processing Disorder, PDD-NOS, and so on. But an initial survey has found that there are many people involved in this industry are either non-diagnosed or diagnosed on the autism spectrum (high functioning side). But while their brains are perfectly wired for forensics - the other characteristics of the autism spectrum cause a problem for entering LE.

Many LE agencies polygraph applicants - not only sworn staff, but all staff - or staff who will handing sensitive cases like anti-terror, narcotics, vice, or internal affairs. Thus, many of the potential forensic scientists will face a polygraph exam.

If you believe the marketing on the polygraph - that the instrument measures the biorhythms, these are not going to read the same for autistics as in a neuro-typical subject. To put it another way, taking the polygraph industry at their word that the instrument shows the readings and the examiner interprets the results - how will the examiner interpret the results of an non neuro-typical person?

Here's some examples:
• One of the characteristics of Aspergers is no eye contact. Another is flapping, or the inability to sit still or some other wild body movement - like a fidget.
• Autistic people may be claustrophobic in terms of things touching them. How will their body react to the blood pressure cuff? How will their body react to the neumo tubes? Sitting still, strapped to a chair generally doesn't work for autistic people.
• Autistic people generally do not like bright lights, flickering fluorescents, or loud sounds. Sitting still, strapped to a chair in a room with bright fluorescent lighting?

Hopefully, you can see where this is going. Many of our best candidates will fail a polygraph exam simply because it is not geared to accommodate the characteristics of autistic people. In failing the exam, they will necessarily be excluded from on the industries uniquely suited to their strengths.

I am hoping to interview both polygraph professionals and other experts in the field on a series of questions related to the premise, how do you effectively polygraph an autistic person.

All interview subjects will be treated with dignity and respect. Results will be kept confidential. Data will be used to support my research and no names will be used. Please feel free to direct message me if you are interested. Also feel free to respond with additional questions or requests for clarification.

Thank you.

Does overt or covert depend on the time of day?

This Lancaster (PA) case illustrates a few points about using CCTV evidence in trial.

Cameras mounted outside of a business were used in recording some activity that the prosecutor wants to use in trial. The essence of the defense's objection is that the defendant couldn't see the cameras - it was 1am and quite dark. Thus, with the lack of lighting, does overt placement become covert? Hmm.

Additionally, the CCTV system had an active microphone that recorded the defendant's conversation in the public space, which may be a crime in itself.

Lots of issues at play in this murder trial.

Courts Divided Over Searches of Cellphones

This just in from the LA Times: "Judges and lawmakers across the country are wrangling over whether and when law enforcement authorities can peer into suspects’ cellphones, and the cornucopia of evidence they provide.

A Rhode Island judge threw out cellphone evidence that led to a man being charged with the murder of a 6-year-old boy, saying the police needed a search warrant. A court in Washington compared text messages to voice mail messages that can be overheard by anyone in a room and are therefore not protected by state privacy laws.

In Louisiana, a federal appeals court is weighing whether location records stored in smartphones deserve privacy protection, or whether they are “business records” that belong to the phone companies.

“The courts are all over the place,” said Hanni Fakhoury, a criminal lawyer with the Electronic Frontier Foundation, a San Francisco-based civil liberties group. “They can’t even agree if there’s a reasonable expectation of privacy in text messages that would trigger Fourth Amendment protection.”

Click here to continue reading the story.

Enjoy.

Colleges - the future site of forensic labs?

I've been thinking about this topic ever since the NAS report was issued, can forensic labs function well under police supervision? This article from India hints at our future here in the US - given budget shortfalls, staff cutbacks, and crime rates - can police departments keep up with forensics?

Sure, DNA is the sexy CSI science. But what about latent prints, crime scene photography, or multi-media forensics? As budgets shrink, governments can't afford to back fill open spots in their technical labs. The result, evidence isn't processed.

I've been saying that I think the solution is regional forensic labs at college campuses. Having the "official" lab at a college satisfies a number of issues raised in the NAS report, as well as by Senator Leahy. I think that this model solves a number of problems - more cops out of the labs and back on the street, disinterested third parties practicing forensic science, getting the CSI stuff away from fluctuating city budgets and under a federal funding scheme, and etc.

Just something to think about for now. But, something's got to give ...

Facial recognition in the news

This just in from RT: "In a single second, law enforcement agents can match a suspect against millions upon millions of profiles in vast detailed databases stored on the cloud. It’s all done using facial recognition, and in Southern California it’s already occurring.

Imagine the police taking a picture: any picture of a person, anywhere, and matching it on the spot in less than a second to a personalized profile, scanning millions upon millions of entries from within vast, intricate databases stored on the cloud.
It’s done with state of the art facial recognition technology, and in Southern California it’s already happening."

...

"Up to 4 million comparisons per second, per clustered server” — that’s how many matches a single computer wired to the FaceFirst system can consider in a single breath as images captured by cameras, cell phones and surveillance devices from as far as 100 feet away are fed into algorithms designed to pick out terrorists and persons of interest. In a single setting, an unlimited amount of cameras can record the movements of a crowd at 30-frames-per-second, pick out each and every face and then feed it into an equation that, ideally, finds the bad guys.

"I realized that with the right technology, we could have saved lives,” Joseph Rosenkrantz, president and CEO of FaceFirst, tells the Los Angeles Times. He says he dreamed up the project after the attacks of September 11, 2001 and has since invested years into perfecting it. Not yet mastered, however, is how to make sure innocent bystanders and anyone who wishes to stay anonymous is left alone as he expands an Orwellian infrastructure that allows anyone with the right credentials to comb through a crowd and learn facts and figures of any individual within the scope of a surveillance cam.

Speaking to reporters with Find Biometrics in August, Rosenkrantz said that the system is already in place in Panama, where computers there process nearly 20 million comparisons per second “using a FaceFirst matching cluster with a large number of live surveillance cameras on a scale beyond any other system ever implemented.”

Read the whole story by clicking here.

Allegations of sloppy work, bias, dishonesty dog Oregon State Police handwriting unit

This just in from the Oregonian: "An Oregon State Police handwriting examiner committed a serious error in a killer-for-hire case last January, provoking so much finger-pointing that the future of the agency's document analysis unit is uncertain.

State police officials, confronted by a whodunit under their own roof, suspended all work by the handwriting unit in March, saying little about why. But internal reviews obtained by The Oregonian through open-records filings detail allegations of bias, sloppy work and dishonesty.

Out-of-state experts are now re-examining 35 criminal cases worked by the unit's two handwriting analysts, partly to ensure that no innocent people were convicted on faulty findings. Washington State Patrol officials, who relied on the examiner who made the error to review at least 40 of their cases from 2009 to 2010, are waiting to see what the experts find."

...

"Kelley and Emmons say they have no problems with their work being reviewed by outside experts, and both say no mistakes will be found.

But their suspension has caused another problem.

The accreditation board of the American Society of Crime Laboratory Directors declined to accredit the handwriting unit as a result, leaving state police with no way to conduct handwriting examinations on their own.

They have had to farm out the work to the FBI and other agencies."

Read the whole article by clicking here.

Elections have consequences

I'm often asked about my political leanings. Given my profession, people make assumptions as to my party affiliation. They're often wrong.

Folks have been asking for my take on where the world is heading, and so forth, given the fact that the US has just had a big election. So, here's my analysis of the US's election results, and sundry associated issues:

Progressives have spent a century or more creating a demand for their products and services. Obama, for his part, handled the supply side of the equation. Folks like to see results, a bridge or library built, a program to help, etc. Robert Byrd is an excellent example of this re-election strategy. You can't go anywhere in WV without seeing his name plastered on some official sign. Republicans, for their part, have not offered an alternative set of products and services over the corresponding time period. The message of cut this, but not that, doesn't ring true for over half the country.
The conservative message of save for tomorrow rings hollow when the government drives down interest rates such that your savings are eaten away by inflation. Thus, people spend what they have and hope for a better tomorrow ($1000 in a savings account does you no good when you neighbor's flat screen is bigger than yours, after all).

The conservative message of investment and the power of compound interest is undercut by the government's insertion of itself into the market. It picks winners and losers, it deems companies too big to fail, it plays with the value of money and commodities. Given this, would you trust the stock mar

ket? Would you trust your retirement to the stock market?

The conservative message of family values continues to be undermined by politicians who say one thing in public, pass judgement on others through legislation, then do entirely different things behind their own closed doors. Pro-marriage legislators turn out to be cheating on their spouses. Anti-gay rights legislators turn out to be gay. Why can't well ordered liberty include all of God's creation? Why can't pro-freedom, pro-choice, and pro-American mean the same thing?

A few years ago, I wrote a book on what I thought were the essential qualities of a leader. Modern Freemasonry takes a good man, and illustrates the path to a well lived life. Thus, it's little mystery to me why so many of the world's heroes are/have been Freemasons.

Everyone makes mistakes - did you own them? Did you learn from them? DId you ask for forgiveness? What to be a leader - whom have you followed? Can a man lead who does not know how to obey? Do you have unhealthy attachments? Is your life out of balance? Can you make and keep commitments? Do you know how to be a friend? In whom do you put your trust?

So, lift your head up high. It's not the end of the world. Your family needs your full efforts, as does your neighborhood, town, county, state, and your country. Remember that your work recommends you, as does the company that you keep. Remember that your legacy includes not just those fixed assets that you leave behind, but also the memory of you that remains in your children and all of those of whom you've impacted over the years.

So, chin up, mates. It'll be fine. We'll make it through these tough times, together.

History log function now in Amped FIVE

Yesterday, Amped Software announced a new update to FIVE. Along with some bug fixes, FIVE now has an automatic logging feature. You'll find this by clicking on View>Open Log Folder.

Since the new default is to log every action in FIVE, I just wanted to remind you of a post I wrote a few years ago about the discovery issue related to history logs.

... Smith and Bace make clear the fact that the reports we generate will provide fodder for cross examination. This includes the History Log. If your log is not handled correctly, it will likely include a running list of every image ever processed by you on your computer. Do you want to turn this list over for discovery? Imagine the questions it would generate. If your Log only shows work on a few images, but hundreds were turned in for discovery, you should expect a long series of questions ...

As the FIVE history logs record not only the actions, including play and pause, but also the local time, file locations, and etc ... you might want to run the use of this feature past your chain of command and your risk management section. In the mean time, you can turn this feature off in the Program Options window, if you want to.

Enjoy.

A Texas Prosecutor Faces Justice

This just in from the New York Times: "In just about a month from now, Texas will witness a rare event: a former prosecutor is going to be held to account for alleged prosecutorial misconduct."

"What makes the Morton case unusual is that, thanks to the Innocence Project’s re-investigation, Ken Anderson will soon go before a Texas Court of Inquiry. If the court believes that Anderson’s alleged misconduct rises to the level of a crime, it could refer the matter to a grand jury. But the Court of Inquiry exists only in Texas, and is almost never used even there.

In truth, Anderson isn’t the only Williamson County prosecutor who faced consequences as a result of the Morton case. His successor, John Bradley, was the one who had fought for years against the DNA testing of the bandana. Seven months after Morton was set free, Bradley, who had always been a shoo-in for re-election as district attorney, was resoundingly defeated.

When I spoke to him the other day, he told me that he now believes he had been wrong to fight so hard against the DNA testing. “We shouldn’t set up barriers to the introduction of new evidence,” he said. Although it would mean more work for prosecutors, Bradley now believes that examining important new evidence is “a legitimate and acceptable cost to doing business in the criminal justice system.”

Bradley will leave office soon. He told me he was going to start a law practice specializing in appellate work. Here’s hoping he argues some appeals for the wrongly imprisoned."

Click here to read the whole story.

virtual reality crime scene training available to state and local law enforcement

This just in from Officer.com: "The nonprofit National Forensic Science Technology Center (NFSTC), in partnership with the University of Tennessee (UT) Law Enforcement Innovation Center (LEIC), is making virtual reality crime scene training available to state and local law enforcement professionals for the first time. For active law enforcement officers who register in 2012, the Investigator-Virtual Reality (I-VR) training is free of charge and funded by the National Institute of Justice.

Brian Cochran, a detective for 11 years, is a graduate of UT’s National Forensic Academy and was among those who helped develop the training. “Overall, the training is meant to be introductory,” says Cochran, who works in the crime scene unit of the Boone County Sheriff’s Office in Kentucky. “It [covers] general things: scene security, searching for evidence, and properly packaging, documenting and photographing evidence—the fundamentals of crime scene management and processing.”

Entry-level law enforcement personnel who may want to become crime scene investigators or forensic practitioners can benefit from I-VR. The training can also be used as a refresher for seasoned investigators, says Emily Miller, a specialist with LEIC at UT’s Institute for Public Service.

From January to the end of September, more than 400 participants registered for the course, Miller says. She says participants have included law enforcement officers, first responders, crime scene investigators, field training officers, rookies and veterans."

Click here to read the whole story.

Scope of warrant at issue

This just in from CyberCrime Review: "In United States v. Schlingloff, 2012 U.S. Dist. LEXIS 157272 (C.D. Ill. Oct. 24, 2012), Judge Shadid held that use of Forensic Toolkit's (FTK) Known File Filter (KFF) to alert on child pornography files was outside the scope of a warrant issued to look for evidence of identity theft.

The defendant in this case lived at a location that was searched pursuant to a valid warrant; the warrant was issued to find evidence of identity theft. During the search of the residence, multiple media devices and computers were retrieved, including a computer and external storage device belonging to the defendant. When the items were sent for forensic analysis, the computer forensic analyst did a search of the devices not only for identity theft (likely image and string searches), but also for child pornography using FTK's KFF option.

A short explanation on KFF. To make forensic analysis easier, files that are known to be valid (system files, DLLs, etc.) are hashed, and those hash values are compared against a disk image to exclude known valid files from further forensic analysis. Conversely, known malicious or illegal files are also hashed, and if those files are found on the computer, the KFF alerts on those hashes, indicating to the investigator that those files should definitely be investigated further. Per FTK's own literature, the KFF can be pared to certain file lists (i.e. hashes of child porn files, virus-related files, etc.) relevant to the current investigation. Additionally, the forensic investigator does not have to use KFF - it is merely an option.

Here, the investigator chose to use the KFF, and within its alerts were hashes of child pornography. While searching the defendant's computer, child porn alerts generated by the KFF showed up. The analyst took the next step and (to confirm the files were in fact CP), opened a few to confirm the results. As the court stated:
The search here did not end with flagging the child pornography files during preprocessing, however. After the KFF alerted to the two files in question, [the agent] believed that he recognized them to be part of the "Vicky" series of child pornography based on their hash values and his experience. Rather than stopping at this point to obtain a warrant to search for images of child pornography, [the agent] briefly opened each file in order to confirm his suspicions before stopping any further processing..

Based on this evidence, the defendant was charged with possession of child pornography. The defendant filed a motion to suppress the evidence, arguing that it was outside the scope of the warrant. The initial motion was denied because the court was under the impression that KFF was an all-or-nothing option. Upon learning that the KFF can be turned on and off in a motion to reconsider, the court granted the motion to suppress.

Continue reading the article by clicking here.

Enjoy.

HFR 3D - coming soon to a theatre near you

Here's a collection of links on the emerging HFR 3D standard for video.

• Regal Cinemas
• 'The Hobbit' to play in high frame rate at 450 theaters
• High frame rates will take off
• The Hobbit shot at 48 fps
• The technology

variable frame rates

An interesting quirk in digital multimedia evidence (DME) when it meets the average first responder's workflow can cause unnecessary angst when using the Omnivore.

Here's what I mean.

Let's say that a crime happened and was captured by a CCTV system - and that the Omnivore is your tool of choice for retrieving the DME for use by your agency. The crime lasts only a minute or two, but the investigators want 15 minutes before and after the crime - thus your capture duration would be 32 minutes, give or take a few seconds. With me so far?

Enter a variable frame rate.

Some systems employ a variable frame rate for recording / playback. Thus, if nothing's happening, the frames per second (fps) might be set at 1 or 2 fps. Then action occurs in front of the camera, and the fps jumps up to 15-30 for the duration of the action.

So, in our scenario, there's little going on for about 15 minutes, then 2 minutes of action, then little going on for 15 minutes. The DVR manufacturer wants to maximize storage space, so it's 15 minutes x 2 fps + 2 minutes x 30 fps + 15 minutes x 2 fps (as opposed to 32 minutes x 30 fps. With me? Here's where this is going.

If you run the Optimization routine in Omnivore based on the initial seconds of the DME, it will give you an average playback of 2 and a capture rate of 4 fps. But what happens when 15 minutes later, the fps jumps to 30? Omnivore, if you have it selected to stop when it drops frames, will stop and ask you if you want to save your work. It thinks it's dropped a frame as it's being flooded with frames and isn't set to receive them at the new rate. It's doing what it's supposed to do.

The simple solution to this problem, if you can call it that, is to base your Optimization on the time within the video where the crime actually occurs - or there's action happening. This will be the highest rate, generally. You should also note the internal settings of the DVR. What does it say the frame rate should be for the camera that you are capturing? Is there a different fps setting for motion, alarms, panic buttons, etc.? Write this stuff down. Then compare what Omnivore says about the frame rate with your notes.

Enjoy.

Nyquist Rate

The Omnivore, from Ocean Systems, is an essential part of my field kit. I've used it with great success on many cases. An interesting question came in related to it, it's Optimization process, and the accompanying instructions. Here's my answer.

While it's not explained or referenced, it appears that the software samples the playback rate, then uses a variation on the Nyquist Rate theme (The Nyquist-Shannon sampling theorem establishes that "when sampling a signal (e.g., converting from an analog signal to digital), the sampling frequency must be greater than twice the Band Width of the input signal in order to be able to reconstruct the original perfectly from the sampled version") in performing it's work.

It seems that the Omnivore is sampling (or capturing) at twice the playback rate, then discarding the duplicates to best re-create the proprietary file in a usable format.

So, from a workflow standpoint, you open the player, load the file, launch Omnivore .... and capture the video into Omnivore's proprietary format. With me so far.

What do you do when you have multiple clips from a single location - same player, many camera views? The Omnivore help files says this, The “Reset” button located in the Video Setting Tab (Optimization section) should only be used when you are changing from one player to another. If you are performing multiple captures of video from different camera views within the same player, you do not need to Re-Optimize each time or “Reset” the optimization process.

So in the case that generated the question, each of the individual views was playing back at a different rate - a rate that was variable. The only way to get an accurate grab was to Reset after playing back each view. Then Re-Optimize with the new camera view.

So, in this case, RTFM wasn't the best solution. Who knew?

Enjoy.

Stabilization of video from helmet cam

If you're looking to stabilize video from a helmet cam, motorcycle mounted cam, or in-car video, here's a YouTube video to show you how easy it is to do in AmpedFIVE.

Enjoy.

Reports from experts

I've noticed an increasing number of people presenting themselves as experts in the field of audio, video, image, and multi-media forensics. As the economy contracts, and people look for work slightly outside of their skill set, it's important to know that your work with Photoshop is just a portion of what you need to do for a case.

"As an expert witness, you may be asked to produce an Expert Witness report for the court.

When developing your expert witness report, remember that they are discoverable; that is, your report will be shared with the attorneys for all sides in the dispute prior to trial.

Your expert witness’s report should include all the pertinent findings that you observed, pertinent things that you sought but did not find, your conclusions based on your findings, and, if needed, a statement explaining the reasons for your conclusions. Because your conclusions are based on science, it should be possible for another person with your training to read your report and look at your documentation, such as photographs, and reach the same conclusions.

The quality of your work reflects your care and thoroughness and will help establish your reputation.

While reviewing a case, consider what points are important and need emphasis, as well as the best way to document your observations. Strive to describe an observation so that someone else, including yourself years later, can read the description and form an accurate mental image of what is described in the report.

Copies of your notes may be requested, so it is important to keep any documentation professional in nature; you would not want to be embarrassed because of a disparaging notation." - RTI International

Photoshop enters the Presidential campaign

It's getting completely ridiculous. This image is floating around Twitter, seeming proof that the President is ... (fill in the blank as you see fit. this isn't political commentary).

But, as each side points fingers and works themselves into a froth, the real loser is Photoshop. As Photoshop has become a verb, requests to authenticate images become more frequent.

Yes, it's a cut/paste forgery. Our ELA test shows clear lines where the insertion has taken place. But you need not take my word for it. All one has to do is trace the source. The man admits it's a fake.

So, let's all take a deep breath. Vote with intelligence, not emotion. And, please, let's resist the urge to use Photoshop in such nasty ways. Let's make art, and clarify images - let's not use such a wonderful tool to confuse and anger and annoy. Help make Photoshop a noun again.

LAPD posts 'Grim Sleeper' suspect's photos on Facebook, Twitter

This from the LA Times: "Los Angeles police are again turning to the public for help in identifying dozens of women seen in photos found at the home of the alleged "Grim Sleeper" serial killer.

Forty-two photographs found at the home of suspect Lonnie Franklin Jr. will be posted on Facebook and Twitter on Thursday, Los Angeles police announced. The photos, taken between 1976 and 2010, were among about 1,000 photos seized from Franklin's home when he was arrested in July 2010.

Franklin, 60, has been charged with murder in the slayings of 10 women whose bodies were found on the streets of South Los Angeles over two decades. Authorities said he has been linked to at least six more killings.

When authorities found the photos, along with hundreds of hours of video, they feared that some of the women could be additional victims. Some of the images appeared to be innocent snapshots, but most showed women in various states of undress in sexual poses.

Detectives weeded out duplicate images and sought to identify about 160 women. They tried to contact the women on their own, but when they were unable to identify the rest, they took the rare step of making the images public. Hundreds of tips poured in, and detectives were able to identify additional victims."

Click here to read the whole story and visit the gallery.

NIK now part of Google?

Did you know that Google bought NIK Software? A lot of folks like Nik Color Efex Pro and use it in their workflow. Well, NIK's now a Google property.

I'm not sure what this means for the future of Nik's tools, but at least you know. If you don't care for Google's privacy policies, you may want to click over and let them know that you don't want your user info migrated to Google.