how to check if a v...
 
Notifications
Clear all

how to check if a video was modified

74 Posts
10 Users
0 Likes
9,679 Views
(@mcy111)
Posts: 44
Eminent Member
Topic starter
 

Hello,
I would like to know if would be possible to tell if a video was modified, edited. People/objects/scenes being cancelled, as in made disappear, in the footage. I have a laptop pc recording videos using the built in webcam. The laptop records for 7-8 hours straight. I take the start and stop recording time and they match the length of the video. once done recording, I stop the video, and I directly load the video onto a USB stick that I carry on me the whole time. The only flaw in this, the laptop is being left, during the recording, unsupervised for more than 1hour 30 minutes at a time. Could the video have been modified? Is there a way that I might know for sure? Is there a software to download that does that?
thanks

 
Posted : 21/12/2013 1:34 am
(@mcy111)
Posts: 44
Eminent Member
Topic starter
 

if I may add, the laptop is left unsupervised during the day most days of the week

 
Posted : 21/12/2013 2:36 am
(@athulin)
Posts: 1156
Noble Member
 

I would like to know if would be possible to tell if a video was modified, edited.

Details, please. (See the guidelines for posting – they are there for a reason.) A video stored in what format, and produced by what recording tool?

The only flaw in this, the laptop is being left, during the recording, unsupervised for more than 1hour 30 minutes at a time. Could the video have been modified? Is there a way that I might know for sure? Is there a software to download that does that?

That is, modified while the recording is running? I doubt it, but it depends on details already mentioned.

If there is such software, it probably requires some training to use, and/or interpret the results it produces. (Other readers can probably fill in those parts.) And it is unlikely to be free.

Does the laptop contain suitable video editing software? If not, it would need to be run from an external device. If it does have the software, you can probably try it out yourself start a video recording, and while it is running, attempt to edit the recording, and see if it works.

Was the laptop locked during recording, or could anyone walk up to it and run programs? If it was locked, I'd expect that some kind of login would be necessary, so looking for log records of such logins would be a natural step.

Depending on the platform, there might also be logs of what software was run on the system, or what external devices had been connected to it.

 
Posted : 21/12/2013 3:13 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

I do not know much about CCTV video formats. However, I would expect it is a format such as MPEG, AVCHD (and many others) that does not need finalising. This would mean it might be possible to cut a section out and still have a playable video.

However, many video formats I have seen do have some kind of clock field, or frame number. If this remains sequential it is unlikely that the video has been 'cut'

You say the length is correct.

Is the video stored as one long file, or many shorter files?

Nothing is impossible but I would suggest that the skill required to modify such a video is very high. Would the people being observed (or not observed) have such skills.

In the unlikely case that the video is a MP4 /AVI type recording then a full video editor would be required, and this would almost certainly leave significant traces. Date and time fields would also possibly be compromised.

 
Posted : 21/12/2013 3:37 pm
(@mcy111)
Posts: 44
Eminent Member
Topic starter
 

the format is AVI. The recording tool is a free Debut software.
The Pc is on during the recording and not locked. The people who might have interacted surely would have no problem as far as budget goes. Conversely, I do not have a budget for this. I just need to know what is possible to obtain according to the latest software/technology. Would that be possible, I am thinking, that while the pc is recording the driver was modified as to record using a different source 'on command' and that they added a crafted video in there to cover for the scenes they want to cancel? or that the video was delayed or made repeat. In both cases, would there be a way of spotting this, was the video edited?
A good suggestion was given, which logs should I look for in the pc to check if someone interacted at a certain time there?

 
Posted : 21/12/2013 10:03 pm
(@mcy111)
Posts: 44
Eminent Member
Topic starter
 

the videoa are each one unique file of 1GB~

 
Posted : 21/12/2013 10:05 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

An AVI file is one that needs finalising. At the end of the file are a series of pointers to each video (and audio) frame. However, you say that the file is stored in 1GB sections.

Inserting video streams is always a good one on crime movies, but in reality I am less convinced.

Does the video have a built in display clock?

A quick fiddle would be to remove and duplicate the 1GB image files. Run a hash on these files to see if any are duplicated. (A very quick check would be to see if there are any of identical size).

Was laptop on a network at the time? Could it have been hacked remotely?

 
Posted : 22/12/2013 4:14 am
(@martjno)
Posts: 5
Active Member
 

At the current stage there's no software on the market (as far as I know) that will allow you to analyze a video to tell if it has been tampered or not. My company develops a software for doing the same on photos (http//ampedsoftware.com/authenticate) and we are starting to work on video, but even at the research level there is very little compared to images. And even less that works on real cases, not simulated in the lab.
I personally worked on a few cases were there was the suspect of tampering on the video (and in all cases it was tampered). The analysis techniques were different from case to case, but in all these situations there were good traces of modification.

Nothing is impossible, but in the scenario you describe I think it is very unlikely that something has been done. Do you have any real clue that something may be happened, or it's just any hypothesis?

 
Posted : 22/12/2013 1:27 pm
(@mcy111)
Posts: 44
Eminent Member
Topic starter
 

An AVI file is one that needs finalising. At the end of the file are a series of pointers to each video (and audio) frame. However, you say that the file is stored in 1GB sections.


Does the video have a built in display clock?


Run a hash on these files to see if any are duplicated. (A very quick check would be to see if there are any of identical size).

Was laptop on a network at the time? Could it have been hacked remotely?

I apologize, I see only now the reply.
The file is not stored in sections. I have many videos and each video is a single file of more than1 GB (7-8 hours of recording). The video does not have a built in display clock, how may I get a built in clock? I resorted for now to put a true clock in the camera's view and add written on paper the date.
The pc is connected to the network.
If I run a a hash (which I still need to understand how to do correctly) I guess the hash sequence would tell me if the video was modified after I last saved the file, not if the video was modified before saving.
How do I check for logs on my pc to understand what interactions took place?

 
Posted : 24/12/2013 12:13 am
(@mcy111)
Posts: 44
Eminent Member
Topic starter
 

Nothing is impossible, but in the scenario you describe I think it is very unlikely that something has been done. Do you have any real clue that something may be happened, or it's just any hypothesis?

well just a doubt I had, but nothing for sure. However, I would like to know the best way to tell. perhaps reading the logs on a pc, since everything, if anything, happened on that pc, would be the best bet. I would like to know how to get relevant information on the pc

 
Posted : 24/12/2013 12:18 am
Page 1 / 8
Share: