±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 1
Overall: 27139
Visitors: 51

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

how to check if a video was modified

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
This topic is locked: you cannot edit posts or make replies.This topic is locked: you cannot edit posts or make replies. Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3 ... 9, 10, 11  Next 
  

how to check if a video was modified

Post Posted: Fri Dec 20, 2013 3:34 pm

Hello,
I would like to know if would be possible to tell if a video was modified, edited. People/objects/scenes being cancelled, as in made disappear, in the footage. I have a laptop pc recording videos using the built in webcam. The laptop records for 7-8 hours straight. I take the start and stop recording time and they match the length of the video. once done recording, I stop the video, and I directly load the video onto a USB stick that I carry on me the whole time. The only flaw in this, the laptop is being left, during the recording, unsupervised for more than 1hour 30 minutes at a time. Could the video have been modified? Is there a way that I might know for sure? Is there a software to download that does that?
thanks  

mcy111
Member
 
 
  

Re: how to check if a video was modified

Post Posted: Fri Dec 20, 2013 4:36 pm

if I may add, the laptop is left unsupervised during the day most days of the week  

mcy111
Member
 
 
  

Re: how to check if a video was modified

Post Posted: Sat Dec 21, 2013 5:13 am

- mcy111
I would like to know if would be possible to tell if a video was modified, edited.


Details, please. (See the guidelines for posting -- they are there for a reason.) A video stored in what format, and produced by what recording tool?

The only flaw in this, the laptop is being left, during the recording, unsupervised for more than 1hour 30 minutes at a time. Could the video have been modified? Is there a way that I might know for sure? Is there a software to download that does that?


That is, modified while the recording is running? I doubt it, but it depends on details already mentioned.

If there is such software, it probably requires some training to use, and/or interpret the results it produces. (Other readers can probably fill in those parts.) And it is unlikely to be free.

Does the laptop contain suitable video editing software? If not, it would need to be run from an external device. If it does have the software, you can probably try it out yourself: start a video recording, and while it is running, attempt to edit the recording, and see if it works.

Was the laptop locked during recording, or could anyone walk up to it and run programs? If it was locked, I'd expect that some kind of login would be necessary, so looking for log records of such logins would be a natural step.

Depending on the platform, there might also be logs of what software was run on the system, or what external devices had been connected to it.  

athulin
Senior Member
 
 
  

Re: how to check if a video was modified

Post Posted: Sat Dec 21, 2013 5:37 am

I do not know much about CCTV video formats. However, I would expect it is a format such as MPEG, AVCHD (and many others) that does not need finalising. This would mean it might be possible to cut a section out and still have a playable video.

However, many video formats I have seen do have some kind of clock field, or frame number. If this remains sequential it is unlikely that the video has been 'cut'

You say the length is correct.

Is the video stored as one long file, or many shorter files?

Nothing is impossible but I would suggest that the skill required to modify such a video is very high. Would the people being observed (or not observed) have such skills.

In the unlikely case that the video is a MP4 /AVI type recording then a full video editor would be required, and this would almost certainly leave significant traces. Date and time fields would also possibly be compromised.
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: how to check if a video was modified

Post Posted: Sat Dec 21, 2013 12:03 pm

the format is AVI. The recording tool is a free Debut software.
The Pc is on during the recording and not locked. The people who might have interacted surely would have no problem as far as budget goes. Conversely, I do not have a budget for this. I just need to know what is possible to obtain according to the latest software/technology. Would that be possible, I am thinking, that while the pc is recording the driver was modified as to record using a different source 'on command' and that they added a crafted video in there to cover for the scenes they want to cancel? or that the video was delayed or made repeat. In both cases, would there be a way of spotting this, was the video edited?
A good suggestion was given, which logs should I look for in the pc to check if someone interacted at a certain time there?  

mcy111
Member
 
 
  

Re: how to check if a video was modified

Post Posted: Sat Dec 21, 2013 12:05 pm

the videoa are each one unique file of 1GB~  

mcy111
Member
 
 
  

Re: how to check if a video was modified

Post Posted: Sat Dec 21, 2013 6:14 pm

An AVI file is one that needs finalising. At the end of the file are a series of pointers to each video (and audio) frame. However, you say that the file is stored in 1GB sections.

Inserting video streams is always a good one on crime movies, but in reality I am less convinced.

Does the video have a built in display clock?

A quick fiddle would be to remove and duplicate the 1GB image files. Run a hash on these files to see if any are duplicated. (A very quick check would be to see if there are any of identical size).

Was laptop on a network at the time? Could it have been hacked remotely?
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
This topic is locked: you cannot edit posts or make replies.This topic is locked: you cannot edit posts or make replies.

Share this forum topic to encourage more replies



Page 1 of 11
Go to page 1, 2, 3 ... 9, 10, 11  Next