VideoSurveillance & Image / Video ForensicsCCTV / DVR AnalysisExport footage from Hikvision, Dahua and other DVRs with correct times, frames and hashesVideo Forensics
Video forensics examines recorded video to answer specific questions about what it shows, how it was made and whether it has been changed, with each of those questions handled as separate work.
Multimedia and surveillance8 evidence types7 tools4 coursesReviewed 2 November 2026
What it is and why it matters
Almost every incident is now filmed by something. The question is rarely whether video exists but what it can honestly tell us. A video file is not a stack of photographs. It is a compressed prediction of how each frame differs from the one before it, taken at a frame rate the camera chose, through a lens and sensor with their own limits. Reading it well means understanding how it was made before deciding what it shows.
Four kinds of work are done on video and they must not be mixed up. Enhancement makes the content easier to see without adding anything, by correcting brightness, removing interlacing or stabilising a shaky clip. Interpretation draws conclusions from the content, such as comparing a person's clothing across two cameras, measuring a height or estimating a vehicle's speed. Authentication asks whether the file is what it claims to be and whether it has been edited. Validation is the testing of methods and tools on known material so that their results can be trusted on unknown material. An enhanced clip proves nothing about authenticity, and a clip that passes authentication can still be misread.
The discipline grew out of CCTV work but now covers phone videos, body-worn and dash camera footage, drone video and clips downloaded from social media, each with its own encoding history. The examiner's report must say which generation of the file was examined, what processing was applied in what order and where the limits of the footage lie.
Types of digital evidence
- Frame Content
What each frame shows: people, objects, vehicles, text, lighting and shadows, read with the frame rate and compression in mind.
- Container Metadata
Duration, codec, resolution, declared frame rate, creation time and the software or device name written into the MP4, MOV or other container.
- Frame Timing
The timestamp of each frame inside the container, which on phone video is often irregular. It is the basis for any statement about speed, duration or sequence.
- Encoding Structure
The pattern of keyframes and predicted frames, the encoder settings and the quantisation used. Changes in this pattern can show where a clip was cut or re-encoded.
- Audio Track
Sound recorded with the picture, which supports timing, can reveal cuts and sometimes contradicts the pictures.
- Device and Location Data
GPS coordinates, orientation and device model written by some phones and cameras, present only in original files.
- Platform Traces
The re-encoding signatures left by messaging apps and social media, which identify the route a copy took and what it lost on the way.
- Sensor Noise Pattern
The fixed noise pattern of a camera sensor, which can link a video to a particular device when enough reference material is available.
Devices and data sources
- CCTV and NVR exports in native and converted formats
- Smartphone videos from the device's own storage, before any app has re-encoded them
- Body-worn cameras and dash cameras, including their own metadata overlays
- Clips received through WhatsApp, Telegram, email and social media, each a different generation
- Drone and action camera footage with telemetry
- Screen recordings and recordings of video calls
- Broadcast and streaming captures
- Older tape and DVD material transferred to digital form
How an examination runs
The order matters. Each step protects the one after it.
- 01Receive and Hash
Record how the file arrived, in what form and from whom. Hash it before anything else and keep that copy as the reference.
- 02Establish the Generation
Work out whether this is an original from the camera, a native CCTV export, a converted copy, a messaging app forward or a screen recording. Each answer changes what can be concluded.
- 03Technical Survey
Read the container and stream details: codec, resolution, declared and actual frame timing, keyframe pattern, audio format and any device or software names. Note anything that does not fit the claimed source.
- 04Agree the Question
Separate what is being asked into enhancement, interpretation or authentication tasks and plan each one. A request to "clean it up and tell us if it is real" is two jobs.
- 05Process With a Record
Apply each step with its parameters written down in order, working on lossless copies so that nothing is compressed again. Keep the frame numbering so that any frame can be traced to the source.
- 06Validate
Where a method is used to measure or compare, show that it works on material where the answer is known, or cite the validation already done for that method and tool version.
- 07Report
State what was examined, the processing, the findings and the limits, with enhanced output labelled as such and never presented as the original.
Tools used in this discipline
Independent profiles: what each tool does, where it stops and what you need to know before using it.
- Multimedia and videoCurrentAmped FIVEAmped Software
Amped FIVE is a workstation for CCTV and image evidence. It opens proprietary DVR files, applies documented filters to make what is there easier to see and writes a report of every step. Clarifying a picture is a different job from proving it is genuine.
- Multimedia and videoCurrentAmped AuthenticateAmped Software
Amped Authenticate asks a different question from FIVE. Not what does this picture show, but can this file be trusted. It tests integrity, reconstructs processing history, links an image to a camera and searches for manipulated or generated content.
- Multimedia and videoCurrentFFmpegFFmpeg project
FFmpeg is the engine behind most media software. For an examiner its three commands inspect a file's streams, extract frames without guessing and convert footage for viewing with every setting on record.
- Multimedia and videoCurrentMediaInfoMediaArea
MediaInfo reads a media file's structure and reports it: container, video and audio codecs, bit rates, frame rate, duration, encoding settings and tags. It tells an examiner what a file is before any player opens it.
- Multimedia and videoCurrentExifToolPhil Harvey
ExifTool reads the metadata inside a file and prints it in full: camera, lens, timestamps, GPS, editing software, maker notes and embedded thumbnails. It is the first stop when a photo or video has to explain where it came from.
- Multimedia and videoCurrentForensicallyJonas Wagner
Forensically is a free web page of image analysis tools that run inside the browser, so the picture never leaves the examiner's computer. It is a teaching and first-look tool, and its author says plainly that it cannot tell true from false.
- Computer forensicsCurrentMagnet AxiomMagnet Forensics
Axiom is Magnet Forensics' main examination platform. It takes images and extractions from computers, phones, cloud accounts and vehicles into a single case and presents the artefacts side by side.
Terminology
- Codec and Container
- The codec, such as H.264 or H.265, is the method of compressing the frames. The container, such as MP4 or MOV, is the file structure that holds the compressed streams and their timing.
- Keyframe and Predicted Frame
- A keyframe (I-frame) is stored whole. Predicted frames (P and B) store only the differences from nearby frames. Jumping into a clip lands on a keyframe, and a cut between keyframes leaves traces.
- Compression Artefact
- Blocks, smearing and ringing created by the codec at low bit rates. They can look like objects or marks and must not be interpreted as content.
- Variable Frame Rate
- Recording in which the time between frames changes, common on phones. The average frame rate shown by a player hides this, so timing is read from the per-frame timestamps.
- Interlacing
- An older recording scheme that stores alternate lines from two moments in one frame. Deinterlacing is a standard enhancement step, and skipping it halves the vertical detail or shows comb lines on moving objects.
- Aspect Ratio
- The relationship between picture width and height. Some systems store pixels that are not square, so a clip played at the wrong aspect ratio makes people look thinner or wider than they are.
- Generation
- How many times a file has been copied with re-encoding. Each generation loses detail and metadata, so the examiner asks for the earliest generation available.
- Photogrammetry
- Taking measurements from images, such as a person's height against a doorframe of known size, with the camera's perspective accounted for and an uncertainty attached.
- Frame Averaging
- Combining several frames of a still subject to reduce noise. Useful on a parked vehicle, useless on a moving one.
- Super-Resolution
- Software that estimates a higher-resolution picture from lower-resolution frames. Learned methods invent detail that was never recorded, so their output is not used for identification.
Challenges and limits
What makes it hard
- Low resolution, low light and heavy compression put a hard ceiling on what any frame can show, and expectations shaped by television need resetting
- Compression artefacts and interlacing can be mistaken for marks, objects or edits by anyone who does not know how the codec works
- Frame timing on phones and CCTV is irregular, and any speed or duration estimate that assumes a constant rate is wrong
- Copies from messaging apps and social media have been re-encoded, scaled and stripped of metadata, so they support fewer conclusions
- Comparison of people and objects is open to expectation bias, which is managed by examining the questioned material before the suspect material and by peer review
- Speed and distance estimates carry uncertainties from lens distortion, frame timing and reference measurements that must be stated, not hidden
- Tools apply proprietary processing, so every filter and version must be recorded for the result to be reproducible
Keeping the evidence intact
- Hash the received file and keep it unchanged, with all processing done on copies
- Record each processing step with its parameters in order, so another examiner can reproduce the output from the same source
- Work in lossless formats between steps so that the clip is never compressed a second time
- Label every enhanced or derived output and keep the mapping of frame numbers to the source file
- Keep the material used for validation and its results with the case notes
Standards and legal considerations
- SWGDE Best Practices for Digital Forensic Video Analysis
With SWGDE's Best Practices for Digital Video Authentication, its Technical Notes on FFmpeg for Forensic Video Examinations and its Best Practice for Frame Timing Analysis of Video Stored in ISO Base Media File Formats, this describes the examination tasks, the tool usage and the timing analysis summarised on this page.
Read the guide - ENFSI Best Practice Manual for Forensic Image and Video Enhancement
The European Network of Forensic Science Institutes' manual on enhancement, including how to document processing and present results.
- ISO/IEC 27042:2015
Guidelines for the analysis and interpretation of digital evidence, which apply directly to the difference between what a video shows and what an examiner concludes from it.
Read the guide - Forensic Science Regulator Code of Practice
The statutory code for forensic science activities in England and Wales, with requirements for validation, competence and reporting that laboratories elsewhere use as a model. The Regulator has also issued a notification on the risks of estimating vehicle speed from video.
- Digital Evidence Lifecycle
Where video sits in the chain from collection through examination to presentation, and why the earliest generation of a file must be preserved at each stage.
Read the guide
In practice
- A Number Plate at Night
A plate in a dark car park clip is unreadable. The examiner corrects levels, deinterlaces and averages eleven frames while the car is stationary. Four characters become legible and are reported with the frames used and the processing steps. The remaining characters are reported as unreadable rather than guessed.
- A Clip Said to Be Slowed Down
A party disputes a phone video, claiming it has been slowed to make an action look deliberate. The per-frame timestamps show a steady interval consistent with the phone model's recording, the audio pitch is normal and the container structure matches the phone's own encoder. The examiner reports no indication of a speed change, which is different from a guarantee that none happened.
- A Speed Estimate With Error Bars
A road crash clip from a shop camera records at an irregular 8 to 12 frames per second. The examiner measures reference distances on site, uses the actual frame timestamps and reports a speed range rather than a single figure, with the sources of uncertainty listed.
This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.
Learn it at DFRTI
Free pages explain. These courses teach it on real devices with a mentor.
VideoSurveillance & Image / Video ForensicsCCTV / DVR AnalysisExport footage from Hikvision, Dahua and other DVRs with correct times, frames and hashes
VideoSurveillance & Image / Video ForensicsImage & Video MetadataRead EXIF, XMP, GPS tags and MP4 atoms with ExifTool and know what each field can proveVideoSurveillance & Image / Video ForensicsDeepfake / AI ForensicsExamine face swaps and AI-made media, check C2PA provenance and know where detectors fail
LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.Careers that use it
Questions people ask
Can you zoom in and enhance like on television?
No. Enhancement can only reveal detail the camera recorded. It can improve brightness, contrast, sharpness within limits and stability. It can also combine frames of a still subject. It cannot turn a cluster of pixels into a face.
If a video has been enhanced, does that show it is genuine?
No. Enhancement and authentication are separate examinations. An enhanced clip is a processed copy, and authenticity is tested on the earliest generation of the file using its structure, metadata and content.
Does forwarding a video on WhatsApp change it?
Yes. The app re-encodes the video, reduces its size and removes most metadata. The forward can still be examined, but the original from the phone that recorded it supports far more.
How is the speed of a vehicle worked out from video?
From the distance it covers between frames whose timestamps are known, with reference measurements taken at the scene. The result is a range with stated uncertainty, and footage with irregular frame timing or strong lens distortion may not support an estimate at all.
Further reading
More in Multimedia and surveillance
Go deeper with DFRTI
Free pages explain the ground. Structured courses, lab work and a mentor take you from knowing about it to doing it on a case.