Is there anyway to know whether a video has been cut or not?

[RiverDD]

Sorry my ignorance but I am new.

I want to know if is possible to know if a video has been cut or not? I have a security cam record that records when it detects movements, but I want to know if the video has been manipulated, and some pieces has been cut.

Is there anyway to know it? or just is imposible to distinguish between both cases.

Thanks in advance.

[Ethlred]

What kind of video? That is how it the video recorded? Tape or hard drive? My guess is hard drive since you have motion detection.

There should be some sort of time stamp but that won't tell you much. If its on disk you may be able to use file recovery software on it. Is there editing software available for the machine or would someone need to take the drive out and put in a PC with editing software?

The idea here is you need to analyze the way your recording is made. Then determine how it could modified and what sort of traces it might leave. A deleted file is still there unless it is overwritten in most file systems. Overwriting could be an indicator of tampering. Examination of the disk with a hex editor could tell you a lot however it would be remarkably tedious and require some degree of understanding what the heck is supposed to on the disk.

[RiverDD]

Hi Ethlred.

This video is a forensic proof I have to examinate and write a report.
The video is recorded in a CD. I just know it has been recorded using motion detection, so it is not possible to examine hard disk. Try to know which video recorder has been used can be long time process and probably will not work. The only thing I can do is analyze the record.

Timestamps marks could be a good trick to know if the video has been cut, but I guess that probably the editing tool recalculate timestamps and save it again to be consistent with the new saved stream.

Anyway it will be worthy to try it. what tool could I use to analyze the video?

I have found this link with several tools but don't know which one use.

Currently I don't remember the video format, but I will post it later.

Any other ideas to know if the video has been cut will be appreciated.

Thanks, Ethlred.

[redwudz]

A lot of newer surveillance system DVRs use Xvid or H.264 video formats, usually to a hard drive or memory stick. If so, I would try VirtualDub. You can probably step through the video one frame at a time and you may be able to see any edits. The older VCR tape type recorders are just analog video and they would need to have been digitized to have been put on a CD or DVD. Since you mention motion detection, I would guess it's a newer type DVR that made the recording.

But it would be unusual that the original didn't have the timestamp as part of the video, along with the camera number. Surveillance video is pretty much useless without that. And it would be very difficult to remove if it was burned into the video. Even the VCR type recorders used a timestamp. Sometimes with VCR type recorders the timestamp is produced by the switcher unit, if multiple cameras are used.

The problem would be that when the DVR stops the recording, that may look exactly the same as a cut in the video. With formats like H.264 and Xvid, there are keyframes at intervals. With Xvid, they are usually every 300 frames by default. They may vary in spacing. Not sure about H.264, but probably similar.

If a cut was made anywhere but a keyframe, it would be very ragged and probably cause sync problems. And with the keyframes so far apart, cuts on them would not be very frame accurate. VD will tell you how many keyframes the video has, and it can also jump between them while viewing, with the keyframe button. If your keyframe spacing was 300 and your frames per second were 25, you can see that the spacing between keyframes would be about 12 seconds, if my math is correct. That would be the only place you could cut without re-encoding. And re-encoding may be easy to spot. And someone please correct me if I'm all wrong about this.

All that said, all you can say in a court of law is what you have observed from the recording. If you don't have access to the original recording, tape or hard drive, it's a bit hard to prove it wasn't tampered with. But if the court accepts you as an expert witness, you may not have any problems. It would help to have the testimony or a deposition of the person that put the video on the CD, saying that it's an exact copy and the reason the original isn't available.

And welcome to our forums.

[RiverDD]

Hi redwudz. Thanks for your answer.

The video format is avi. The size is 640x480 and 3 frames per second. I installed VirtualDub and tried to find out something, but no luck.

The only thing I can say is that cut on records do not look like normally if are motion detection driven. Some records starts with a car almost leaving the scene and some ends with several cars moving along the road. But first record start when a car get into the scene and last record finish 3 or 4 seconds after last car leave the scene Do not seem logical.

I will write all this at a report and add a note about the motion detection sensibility. I guess you can demonstrate the motion detection should not stop the record at those situations (no elapse time spend before stop it).

Thanks for all, folks.

Greetings from Spain.

[redwudz]

With motion detection there is a sensitivity threshold set, along with a area of interest that is selected by mapping the scene with a grid. You then pick where in the grid you want the detection to work. An example would be a door in the scene.

There is also a setting for the recording time that is a result of the motion triggered recording. If the DVR only records for a few seconds, then it will need to be re-triggered by another motion detect if the motion continues. It may also have a reset time before it can be triggered again. If it's set at a proper value of 1 to 5 minutes recording time, it should get most all the scenario that occurs, depending on the length of time the scenario lasts.

You could download a similar DVR manual and see what settings are available. The default settings are probably where most operators leave them, unless they have a specific reason to change them.

Even the very cheap DVRs available these days can do some fairly sophisticated motion detection and actions. But you also need a good operator to set it all up properly.

[RiverDD]

The camara is recording a street so it probably had been defined no grid.

Well, good news. I have found some proofs that would be enough to proof video manipulation.

I have found that some videos length do not match with expected and several timestamps have disappeared. I think this will be enough to proof the videos have been manipulated. In addition you can see a group of people talking in one frame and the next one of the guys is not there, this is not a technical proof but is logical enough, hahaha.

Thanks for all guys. It has been very instructive. I have learned a lot.

See you