Tampered with(?) Video file Meta Data query

[SebD]

I hope someone on the forum can help, please (if not, any suggestions of a forum which might assist would be sincerely appreciated).

I have a small video file taken with a Samsung Galaxy SmartPhone that I think has been tampered with.

I've another video file produced by the same mobile telephone on the same date and in the same hour which shows the times encoded and tagged as the exact same in all three (General, Video and Audio) segments.

Unlike this file, which reveals the General time recorded differs to that of the Video and Audio time segments (the latter two tallying one with the other):

General
Encoded date : UTC 2023-08-09 10:51:35
Tagged date : UTC 2023-08-09 10:51:35

The above time being when I know, 100% for sure, the video was created and first saved.

Video
Encoded date : UTC 2023-08-09 11:04:25
Tagged date : UTC 2023-08-09 11:04:25

Audio
Encoded date : UTC 2023-08-09 11:04:25
Tagged date : UTC 2023-08-09 11:04:25

The above being when I suspect the file was saved again, having been tampered with and altered.

As stated, this video was followed by another short video taken between the above timestamps, when this file was first saved and then seemingly saved again.

Just to confirm, that other video’s Meta Data shows no disparity between its General, Video and Audio segments’ time stamps.

Is the above evidence (PROOF, even) that my suspicions are correct and that the video may have been edited (perhaps truncated, cropped or otherwise), around thirteen minutes after it was initially created?

Many thanks.

Seb

[ProWo]

Post both videos here.

[SebD]

Post both videos here.

Thank you for responding, but I cannot do that for legal reasons as there may be a court case looming.

What I can do is post the Meta Data logs but the only noticeable differentials between the two files (excepting, logically, the durations and video file sizes as one video runs for around twenty seconds and the other for circa a minute, in addition to the shorter file being filmed in portrait mode and the other predominantly - but not exclusively - landscape.

All you would see to separate the files would be the time-stamp inconsistency on one of them, being exactly what I cut and pasted to my OP (apart from emphasizing through emboldening and use of a red font).

Thanks again, anyway.

PS. LOVE your GIF, by the way. I'm gonna find me one.

[Cornucopia]

Post full, detailed MediaInfo text outputs of both the suspect video(s) and a couple known-good videos, from the same camera, close to the same general time period.

Some recording processes may create a timestamp when the recording starts, and again in a different place when it ends, so it is possible to legitimately have different stamps within the same vid, but it is rare.

That 13 minutes is just after the time it was first recorded, so in whose hands were you expecting this edit to occur if not your own?

Regardless, AFAIK, *NONE* of the folks here (or any other video board that I know of) are lawyers intimately knowledgeable in digital media evidence in your locale. I am quite familiar with much, having served as an expert witness twice regarding media restoration/enhancement, but IANAL, so my word is not gospel either. This is best handled by the authorities themselves.
If it is the case that you are not trusting those authorities, unless you procure your own lawyer, you are probably out of luck.


Scott

[SebD]

Post full, detailed MediaInfo text outputs of both the suspect video(s) and a couple known-good videos, from the same camera, close to the same general time period.

1a) I only have the two video footages
1b) One (the suspect recording) lasts just under a minute
1c) One (the none suspect recording) lasts around twenty seconds

Some recording processes may create a timestamp when the recording starts, and again in a different place when it ends, so it is possible to legitimately have different stamps within the same vid, but it is rare.

2a) Not in this case as the first (suspect) video was initially saved at 10:51:35
2b) The second (shorter) video was saved at 10:54:00
2c) The first (suspect) video was saved again at 11:04:25
2d) So the first (suspect) video could not have started at 10:51:35 and ended at 11:04:25 as those times are separated by the second video at 10:54:00
2e) I was there and I KNOW the video went on for longer than that which now remains
2f) Also, I think you are wrong inasmuch that I strongly suspect a recording is NOT timestamped at the start, only when it is saved (just like any other file because, ultimately, a file is all it is to a microprocessor; it's just DATA to all intents and purposes) for what of videos and/or word documents or soundbites created yet NOT saved? Makes absolutely no sense to me, whatsoever.


That 13 minutes is just after the time it was first recorded, so in whose hands were you expecting this edit to occur if not your own?

3a) Someone else's. The owner/operator's
3b) I have never laid hands on the camera
3c) The phone camera operator was alone, for the entire period and beyond

Regardless, AFAIK, *NONE* of the folks here (or any other video board that I know of) are lawyers intimately knowledgeable in digital media evidence in your locale. I am quite familiar with much, having served as an expert witness twice regarding media restoration/enhancement, but IANAL, so my word is not gospel either. This is best handled by the authorities themselves.
If it is the case that you are not trusting those authorities, unless you procure your own lawyer, you are probably out of luck.

4) Thanks for responding then, anyway.

Scott

I think it's quite clear the video was tampered with. Why, we cannot know. But that it seemingly was exhibits lack of probity and integrity on the part of the person who made the recording.

I'm hoping someone can confirm because, to my logical way of thinking, it's no different to a MS Word document you can open and read a million times and yet the creation and the date last saved timestamps will remain the same UNLESS you edit the document through even so little as a full-stop or comma, then save, whereupon the creation and last saved timestamps will differ.

Presumably.

[Cornucopia]

Well then certainly you know more about this than I.

You can lead a horse to water...

Btw it's easy to edit Word docs (and othe files) without changing timestamp, just as its easy for timestamps to change without editing. Have fun with this one


Scott

[poisondeathray]

I think it's quite clear the video was tampered with. Why, we cannot know. But that it seemingly was exhibits lack of probity and integrity on the part of the person who made the recording.

I'm hoping someone can confirm because, to my logical way of thinking, it's no different to a MS Word document you can open and read a million times and yet the creation and the date last saved timestamps will remain the same UNLESS you edit the document through even so little as a full-stop or comma, then save, whereupon the creation and last saved timestamps will differ.

Presumably.

Define "tampered with"

The problem with your MS Word example is the actual data in the document is changed.

Metadata tags like Encoded date, Tagged date are just "labels" .

You can change metadata tags to say anything without changing the actual audio and video bitstream data . You can change all dates to be the same, or today's date if you wanted to. A difference in metadata might be suggestive of some types of "tampering", but does not prove anything.

If you suspect some "fishy" business, examine the other tags . Use mediainfo in text mode and advanced mode. If an editing program was used, often there are other tags written, for example the muxing or writing application . Compare it to a native phone file. If someone edited it - and they were not smart enough to change the Encoded and Tagged dates back - they probably left the other stuff too . The presence of other tags written by editing software strengthens your assertion that the video was "tampered" with in some way , but that still does not prove that the important information - the actual encoded video or audio data bitstreams - were tampered with

Real evidence of "tampering" with the actual audio/video bitstream - you'd have to examine the audio/video and compression characteristics. For example, if that Samsung model only uses a certain profile, encoding settings (e.g one video might use 3 reference frames, or GOP length is fixed 30), but the video you have is different, or that phone cannot record even using those settings - that is much stronger evidence

[johns0]

The only way your video got tampered was you gave your phone to someone else,there's no way the video got tampered unless your phone is bugged with spyware.

[SebD]

Well then certainly you know more about this than I.

You can lead a horse to water...

Btw it's easy to edit Word docs (and othe files) without changing timestamp, just as its easy for timestamps to change without editing. Have fun with this one


Scott

WRONG, again.... (at least you're consistently so). I do like folk to be predictably reliable, so thanks for not letting me and the forum down, in that regard.

It is not only NOT "easy to edit Word docs (and othe files) without changing timestamp", it is IMPOSSIBLE. That the time-stamps can subsequently be doctored is not even approaching a confirmation of your erroneously ignorant attestation.

Further, time-stamps CAN be changed but claiming such to be "easy" is entirely subjective. It is "easy" for me. Maybe "easy" for you (although I would not lay money on it). But ask any group of a hundred random citizens how to do that and let us all know the results.

Meanwhile, do please keep digging and giving us all a chortle.

[TheGhost]

Is the video of a high quality (e.g. 3840x2160 with a high bitrate)? Was the phone being used for other things after the video was recorded? If so, it may have taken a few minutes for the phone to finish processing the video, perhaps.

[TheGhost]

With my phone, the encoded date/time is when the recording started and the tagged date/time is when the recording finished. What you have above is the same date/time for both, so that may be an issue. However, this could simply be a difference in how different phone makes, models, operating system versions, and camera software versions choose to record the metadata.

MediaInfo is fairly limited. There may be other software that'll give more comprehensive information, such as the name of the program used to edit it (if it was in fact edited).
e.g.
https://exiftool.org/forum/index.php?topic=2750.0
https://exiftool.org/

[SebD]

Is the video of a high quality (e.g. 3840x2160 with a high bitrate)? Was the phone being used for other things after the video was recorded? If so, it may have taken a few minutes for the phone to finish processing the video, perhaps.

Both footages are of a pretty standard 1920x1080.

Further, in the time between the suspect SHORT (under a minute duration) was initially saved (at 10:31:35am) a second recording was made on the same device and was saved (at 10:54:00am) before the first (suspect) footage was saved again (at 11:04:25am).

So the first (suspect) recording could not have started and been saved (at different times) whilst another recording was started and saved, on the same device, in the interim.

Such being the whole essence of my query and especially as I KNOW FOR SURE that the first (suspect) recorded footage duration was greater than the file which now remains.

[SebD]

With my phone, the encoded date/time is when the recording started and the tagged date/time is when the recording finished. What you have above is the same date/time for both, so that may be an issue. However, this could simply be a difference in how different phone makes, models, operating system versions, and camera software versions choose to record the metadata.

MediaInfo is fairly limited. There may be other software that'll give more comprehensive information, such as the name of the program used to edit it (if it was in fact edited).
e.g.
https://exiftool.org/forum/index.php?topic=2750.0
https://exiftool.org/

Thanks for the links but a file cannot be encoded until after it is finished as it is a component of the finishing-process, not from when it was started.

[TheGhost]

That is ABSOLUTELY how it works with my phone. MediaInfo from a 7-second long video I took a bit earlier today, which I started reecording at 15:07:30 and stopped recording at 15:07:37:

General
Complete name : ...\REC_20240706_150737.mov
Format : MPEG-4
Format profile : QuickTime
Codec ID : qt 0000.00 (qt )
File size : 25.7 MiB
Duration : 6 s 834 ms
Overall bit rate : 31.6 Mb/s
Frame rate : 24.000 FPS
Encoded date : 2024-07-06 14:07:30 UTC
Tagged date : 2024-07-06 14:07:37 UTC
Writing library : Apple QuickTime
Origin : {"fps":"24.000"}
com.apple.quicktime.make : LateNiteSoft
com.apple.quicktime.model : iPhone
com.apple.quicktime.camera.identifier : ...
com.apple.quicktime.creationdate : 2024-07-06T15:07:30+01:00
com.apple.quicktime.software : REC 7.1.1

Video
ID : 1
Format : HEVC
Format/Info : High Efficiency Video Coding
Format profile : Main 10@L5@Main
HDR format : Dolby Vision, Version 1.0, Profile 8.4, dvhe.08.06, BL+RPU, no metadata compression, HLG compatible
Codec ID : hvc1
Codec ID/Info : High Efficiency Video Coding
Duration : 6 s 833 ms
Bit rate : 30.0 Mb/s
Width : 3 840 pixels
Height : 2 160 pixels
Display aspect ratio : 16:9
Frame rate mode : Constant
Frame rate : 24.000 FPS
Color space : YUV
Chroma subsampling : 4:2:0
Bit depth : 10 bits
Bits/(Pixel*Frame) : 0.151
Stream size : 24.5 MiB (95%)
Title : Core Media Video
Encoded date : 2024-07-06 14:07:30 UTC
Tagged date : 2024-07-06 14:07:37 UTC
Color range : Limited
Color primaries : BT.2020
Transfer characteristics : HLG
Matrix coefficients : BT.2020 non-constant
Codec configuration box : hvcC+dvvC

Audio
ID : 2
Format : PCM
Format settings : Little / Signed
Codec ID : lpcm
Duration : 6 s 834 ms
Source duration : 6 s 869 ms
Bit rate mode : Constant
Bit rate : 1 536 kb/s
Channel(s) : 2 channels
Channel layout : L R
Sampling rate : 48.0 kHz
Bit depth : 16 bits
Stream size : 1.25 MiB (5%)
Source stream size : 1.26 MiB (5%)
Title : Core Media Audio
Encoded date : 2024-07-06 14:07:30 UTC
Tagged date : 2024-07-06 14:07:37 UTC

ReportBy : MediaInfoLib - v24.06
CreatedOn : UTC 2024-07-06 15:11:53

[TheGhost]

Like I said, other phone makes, models, operating systyems, and camera software versions may record the metadata differently. Perhaps you should challenge whatever preconceived notions you have about the meaning of this very limited data!

[TheGhost]

If it is an iPhone - and you have the phone, with the recording on it - you could open the Photos app, click on the suspect video and in the top right click 'Edit'. If there have been changes then you may see a red 'Revert' button in the top right, which will undo any edits to the video.

[SebD]

Like I said, other phone makes, models, operating systyems, and camera software versions may record the metadata differently. Perhaps you should challenge whatever preconceived notions you have about the meaning of this very limited data!

If that's an Apple, it's not even a phone (more a fashion accessory) LOL

I do take your point though.

However, fact remains that the Samsung Galaxy (being Android) does not handle its metadata in the same way.

The phone is not mine but I happen to own a Samsung Galaxy, also (as well as a couple of iPhones and other Androids. I just find it hard not to dump on Apple products cuz their iOS is woeful).

The Samsung shows the same timestamps throughout unless and until a file is edited and resaved.

Upon which, the General timestamps remain constant but the newly saved Audio and Video timestamps reflect the later incidence's timestamps.

They are separated because, naturally, an individual might edit the audio whilst leaving the visual intact.

Would be an interesting experiment to see if, when you edit and resave an iPhone recording, whether any of the timestamps are adjusted, accordingly.

Please have that file on my desk, by 9am tomorrow morning.

This is becoming an Agatha Christie plotline (but with a little Inspector Clouseau thrown in). Ha-ha.

[SebD]

If it is an iPhone - and you have the phone, with the recording on it - you could open the Photos app, click on the suspect video and in the top right click 'Edit'. If there have been changes then you may see a red 'Revert' button in the top right, which will undo any edits to the video.

That's interesting.

It's not an iPhone but I wonder if a similar facility exists with a Samsung.

I'll have to take a look.

If only I had access to the original phone (but I don't and cannot).... Shame!!!

[TheGhost]

However, fact remains that the Samsung Galaxy (being Android) does not handle its metadata in the same way.

It can change with phone make and model, operating system version and camera software version!!!

[TheGhost]

The Samsung shows the same timestamps throughout unless and until a file is edited and resaved.

Upon which, the General timestamps remain constant but the newly saved Audio and Video timestamps reflect the later incidence's timestamps.

They are separated because, naturally, an individual might edit the audio whilst leaving the visual intact.

It may depend on exactly how the video is edited. With some types of edits, it will re-save the whole video as a new file, in which case all the timestamps would change.

You really don't have enough information to say anything definitively.

[SebD]

The Samsung shows the same timestamps throughout unless and until a file is edited and resaved.

Upon which, the General timestamps remain constant but the newly saved Audio and Video timestamps reflect the later incidence's timestamps.

They are separated because, naturally, an individual might edit the audio whilst leaving the visual intact.

It may depend on exactly how the video is edited. With some types of edits, it will re-save the whole video as a new file, in which case all the timestamps would change.

You really don't have enough information to say anything definitively.

Seemingly except IT - almost undoubtedly - HAS BEEN edited.

Especially as (if you read my earlier posts, you'll already know) there was another recording made by the same phone 3mins and 25 seconds after the suspect file was recorded and 10mins 25secs before the suspect file was re-saved (presumably and almost irrefutably after its having been edited).

And when I say "edited" I don't mean like in "Saving Private Ryan", I simply mean "in some way interfered with", the resulting file - rather than the original - since being all that is left of said original.

Which is all I need to show.

[lordsmurf]

file cannot be encoded until after it is finished

Wrong.

This is becoming an Agatha Christie plotline (but with a little Inspector Clouseau thrown in). Ha-ha.

Or like watching a dog chase it's own tail.

...

WRONG, again.... (at least you're consistently so).
your erroneously ignorant attestation.

What an ass.

don't have enough information to say anything definitively.

^ This.

[SebD]

file cannot be encoded until after it is finished

Wrong.

This is becoming an Agatha Christie plotline (but with a little Inspector Clouseau thrown in). Ha-ha.

Or like watching a dog chase it's own tail.

...

WRONG, again.... (at least you're consistently so).
your erroneously ignorant attestation.

What an ass.

don't have enough information to say anything definitively.

^ This.

That IT?

ALL you got?

Wanker!