LEVA (Law Enforcement and Emergency Services Video Association) is holding this year’s conference in Clearwater Beach, Florida, USA, between 16th and 20th October.
For the past few years, David Spreadborough, our international trainer, has run a 2-day practical session using Amped FIVE – and this year is no exception!
On Thursday 19th and Friday 20th, David will be looking at many practical case workflows using Amped FIVE.
Suitable for both the newbie and the wizard, the cases are designed to promote discussion, learning, and self-research. Report writing, case management, and organization will also be reviewed.
Along with a few new developments, David will also look at image authentication with Amped Authenticate, to ensure users understand some key concepts in Image Authentication.
The Amped team will be around throughout the week and you can also stop by the Axon stand to chat with us about the products we have to support you.
See you soon!
We are happy to attend once again the Digital Experience event organized by our partner DataExpert, on October 11-12, 2017, held at the Van der Valk Hotel in Utrecht.
What is Digital Experience?
Digital Experience 2017 is a two-day event in the field of Digital Forensics, Data Analysis and Cyber Intelligence. This event brings experts and specialists, proven and innovative solutions, and users, together in one place! The latest trends and developments will be presented during this event.
The first day is dedicated to sessions and workshops around the theme ‘Digital Forensics’.
The second day is dedicated to topics such as ‘Analysis & Investigation’, ‘OSINT & Mobile’ and ‘Cyber Intel’. You can sign up for one or both days.
Amped Software will be presenting a session regarding investigations on images and video in the age of terrorism.
For more info and to register, click here: https://dataexpert.nl/en/digital-experience-2017
We look forward to seeing you in The Netherlands!
Source device identification is a key task in digital image investigation. The goal is to link a digital image to the specific device that captured it, just like they do with bullets fired by a specific gun (indeed, image source device identification is also known as “image ballistics”).
The analysis of Photo Response Non-Uniformity (PRNU) noise is considered the prominent approach to accomplish this task. PRNU is a specific kind of noise introduced by the CMOS/CCD sensor of the camera and is considered to be unique to each sensor. Being a multiplicative noise, it cannot be effectively eliminated through internal processing, so it remains hidden in pixels, even after JPEG compression.
In order to test if an image comes from a given camera, first, we need to estimate the Camera Reference Pattern (CRP), characterizing the device. This is done by extracting the PRNU noise from many images captured by the camera and “averaging” it (let’s not dive too deep into the details). The reason for using several images is to get a more reliable estimate of the CRP, since separating PRNU noise from image content is not a trivial task, and we want to retain PRNU noise only.
After the CRP is computed and stored, we can extract the PRNU noise from a test image and “compare” it to the CRP: if the resulting value is over a given threshold, we say the image is compatible with the camera.
Camera identification through PRNU analysis has been part of Amped Authenticate for quite some time. However, many of our users told us that the filter was hard to configure, and results were not easy to interpret. So, since the end of last year, a new implementation of the algorithm was added (Authenticate Build 8782). The new features included:
Advanced image pre-processing during training
In order to lower false alarms probability, we implemented new filtering algorithms to remove artifacts that are not discriminative, something that is common with most digital cameras (e.g., artifacts due to Color Filter Array demosaicking interpolation).
If you follow the news from Apple you may have heard that the latest iOS 11 introduces new image and video formats.
More specifically, videos in H.264 (MPEG-4 AVC) are replaced by H.265(HEVC) and photos in JPEG are replaced by the HEIF format.
Files in HEIF format have the extension “.heic” and contain HEVC encoded photos. In a nutshell, a HEIF file is more or less like a single frame encoded H.265 video. Here there is a nice introduction. And, if you want to go more in depth, here there is some more technical documentation.
For people like us, that have been working for years on image authenticity exploiting the various characteristics of the JPEG formats and various effects which happen when you resave a JPEG into another JPEG, this is pretty big – and somewhat worrying – news.
If you want to do image forensics in the real world – not in academia, where the constraints are usually quite different – it means that the vast majority of images you will work with will be compressed in the JPEG format. A lot of filters in Amped Authenticate actually work only on JPEG files, because that’s the most common case. On the contrary, a lot of the algorithms published in journals are almost useless in practical scenarios since their performances drop dramatically when the image is compressed.
JPEG has been on the market for ages, and many tried to replace it with something better, with formats like JPEG 2000 and, more recently, Google WebP. However, with the decreasing costs of storage and bandwidth and the universal adoption of JPEG, it has been impossible to displace. In contrast, video formats and codecs have seen a very rapid progression at the same time, since storage and bandwidth for video is always an issue.
I think this time will be different, for better or worse, since when Apple introduces radical changes, the industry normally follows. This means a lot of work for those of us working on the analysis of image files. Nowadays the majority of pictures are done on a mobile device, and a good part of them are Apple devices so the impact cannot be neglected.
If the HEIC format becomes the new standard, many of the widely used algorithms must be heavily modified or replaced. Don’t hope to save many of those. After all, despite what some are saying, most of the image authentication and tampering detection algorithms don’t work on videos at all. The exception is having a Motion JPEG video modified and resaved as another Motion JPEG video. But that’s a very rare case, and most times the quality will be so low that it will be impossible to use them anyways.
Now let’s see what the situation is like in practice. Continue reading
On the 7th December 2017, David Spreadborough, Amped Software’s International Trainer, will be presenting a workshop on the use of images and video within investigations.
David will provide investigators with all the latest knowledge and best practice to ensure they make maximum use of video and images that withstands the scrutiny of the courts. David will carry out practical demonstrations throughout the day and draw on relevant case studies of his recent experience.
Download the brochure for more info.
The Investigator magazine regularly runs workshops on many techniques and services.
This workshop is primarily aimed at the decision makers, but open to all frontline investigators who will benefit from having an increased knowledge of what is, and what is not, possible within the world of visual multimedia.
To register and for more information:
+44 (0)844 660 8707 or email firstname.lastname@example.org
There were a couple of interesting discussions this week which prompted me to write this blog post. One is related to the scientific methods used during the analysis of images and videos, the other relates to the tools used.
There was a pretty interesting and detailed conversation that happened on an industry specific mailing list where a few experts debated about the scientific and forensic acceptability of different methodologies. This discussion began with the reliability of speed determination from CCTV video but then evolved into a more general discussion.
There are two extreme approaches to how forensic video analysts work: let’s call one group the cowboys and the other the bureaucrats. I’ve seen both kinds of “experts” in my career, and – luckily – many different variations across this broad spectrum.
What is a cowboy? A cowboy is an analyst driven only by the immediate result, with no concern at all for the proper forensic procedure, the reliability of his methods and proper error estimation. Typical things the cowboy does:
- To convert a proprietary video, he just does a screen capture maximizing the player on the screen, without being concerned about missing or duplicated frames.
- Instead of analyzing the video and identify the issues to correct, he just adds filters randomly and tweaks the parameters by eye without any scientific methodology behind it.
- He uses whatever tool may be needed for the job, recompressing images and videos multiple times, using a mix of open source, free tools, commercial tools, plugins, more or less legitimate stuff, maybe some Matlab or Python script if he has the technical knowledge.
- He will use whatever result “looks good” without questioning its validity or reliability.
- If asked to document and repeat his work in detail he’ll be in deep trouble.
- If asked the reason and validity of choosing a specific algorithm or procedure, he will say “I’ve always done it like this, and nobody ever complained”.
- When asked to improve a license plate he will spell out the digits even if they are barely recognizable on a single P frame and probably are just the result of compression artifacts amplified by postprocessing.
- When asked to identify a person, he will be able to do so with absolute certainty even when comparing a low-quality CCTV snapshot with a mugshot sent by fax.
- When sending around results to colleagues he just pastes processed snapshots into Word documents.
- When asked to authenticate an image, he just checks if the Camera Make and Model is present in the metadata.
If you present an object, an image, or a story to a courtroom, you must be able to trust that it is accurate.
How then, do you trust an image – a digital photograph, a snapshot in time of an object, a person or a scene? Do you trust what the photographer says? Or do you check it? Do you attempt to identify any signs of manipulation that could cast doubt on the weight of the evidence?
How many members of the public are aware of the Digital Imaging Procedure? What about the guidance surrounding computer based information, which includes digital images and video? What about the person that is receiving that file? Perhaps the investigating officer. Are they aware of the importance of image authentication?
Is the Criminal Justice System naive to believe that fake images do not end up being displayed in court and presented as truth? Even if it is a rarity now, we need to think of the future. To start with, we must ask ourselves, “Can we rely on the image we see before us? Has it been authenticated?”
Read the article published by The Barrister magazine to learn about the importance of authenticating images before submitting them as evidence.
David Spreadborough, international trainer at Amped Software, and a regular expert witness in criminal investigations, charts the technical history of bringing CCTV images to court and provides an insight into the challenges associated with preparing surveillance images as evidence.
Read the article published on IFSEC Global
Here we are again with another Amped FIVE update, full of user enhancements and product refinements, designed to help you in your analysis and forensic reporting.
Before we dive in, it’s worth saying that, here at Amped we strive to provide you with the very best product for image and video analysis, and enhancement. If you want our software to do something that it doesn’t do, just let us know. Many of the new functions in this update come directly from user feedback and requests.
Genetec File Support
Genetec is the latest surveillance system manufacturer to allow integration between the export format and forensic analysis.
Currently utilizing the .G64 and .G64X file extensions, most Genetec exports can now either be reformatted using the original H264 encoding or, when this is not possible due to the export type, transcoded into .ASF to aid in initial analysis and preview.
When you load a Genetec export into Amped FIVE, either using the loader or drag and drop, the Direct Play dialogue box will appear.
After selecting ‘Yes’ to attempt conversion, ensure that ‘Copy Stream if possible, or else Transcode’ is selected in Convert DVR.
The file will then be scanned and either reformatted or transcoded if required.
There is a new configuration tab specifically for Genetec G64 and G64X files.