Video shows what happened, or what someone wanted it to look like. The examination, aligned with the international SWGDE and ENFSI practices, answers which of the two: global analyses of the file, local analyses of the content and chain of custody from the recorder to the expert report.
Every forensic question has an examination of its own: is the file authentic? Was it edited? Who appears in it? What is the real measurement? The expert report declares the method and the limit of each answer.
Is the file what it is said to be? Analysis of the container structure, metadata read with multiple tools (SWGDE 23-V-001 practice), encoding and recompression history, coherence of shadows, lighting and edges, temporal continuity.
Jumps and gaps in the frame sequence, GOP and compression discontinuities, duplicated or suppressed frames, inconsistencies between the audio and video tracks.
Facial blending artefacts, inconsistencies in blinking and physiology, mismatch between lips and speech (phoneme against viseme), spatial, temporal and frequency anomalies, combined with the cloned-voice examination from forensic phonetics: the complete detection pair.
EXIF and metadata, traces of tampering (cloning, splicing, error level analysis and the like), coherence of the compression history and linking of the image to the equipment that produced it.
Real measurements extracted from the image: height, distances, vehicle speed. In prosopography, anthropometric points of the face, individualising marks (tattoos, scars) and gait pattern, with a probabilistic conclusion, never "absolute recognition" from low-resolution footage.
Sharpness and contrast enhancement, stabilisation, licence plate reading and forensic magnification. Processing reveals what is recorded; it never creates content: the same ethics as audio enhancement.
Does the soundtrack belong to this video? Examination of mismatch, suppression or replacement of the track, with a natural bridge to phonetic examination when a voice is in dispute.
Proprietary extraction from the DVR (the menu export recompresses), verification of timestamps and dating, frame-by-frame examination, ordering of events and chain of custody from the recorder to the expert report.
Technical description of audiovisual content (forensic narrative of scene and events), reconstruction and Visual Law for presentation in court, forensic redaction of video (masking of faces and licence plates for court use and LGPD (Brazil's data protection act), compliance), verification of date and time from traces in the file, rebuttal of another expert's audiovisual report.
The examination follows SWGDE best practices (18-V-001 for video analysis, 23-V-001 for authentication, 16-I-002 for images): a defined set of analyses on the file and on the content, with multiple converging methods and bias mitigation.
The chain of custody runs from end to end: acquisition of the original (ideally from the device or the DVR), hashing, working copy and a record of all processing, ensuring reproducibility. Conclusions are probabilistic here too, especially in facial comparison: the expert report declares the degree of support given by the evidence, not certainties of convenience. Quality control accompanies the whole workflow: double-checking of findings, a record of every processing step and declared mitigation of contextual bias.
Extraction of the raw file straight from the mobile phone or the DVR, in the laboratory or in the field, with hashing, binding to the equipment and documented chain of custody, is part of the same forensic work. The examination begins with the original, not with the recompressed copy that circulated through messaging apps.
Methodological grounding: SWGDE 18-V-001 · SWGDE 23-V-001 · SWGDE 16-I-002 · ENFSI practices for forensic image and video analysis.
Freezing, dropped frames and pixelation from re-encoding (VoIP, streaming, messaging apps) are normal compression behaviour and do not prove tampering. The examination distinguishes the natural artefact from the trace of editing, and that distinction brings down alarmist reports.
CCTV of crimes: who appears, what happened and when; authenticity of incriminating video, photogrammetry of height and speed, licence plate reading.
Video of a workplace accident (dynamics and speed), CCTV in dismissal for cause, authenticity of a recording used against an employee or employer.
Videos in custody disputes, verification of tampering and deepfakes in defamation, road accident footage.
Internal fraud captured on CCTV, deepfakes in video calls (CEO fraud), verification of media in a reputational crisis, evidence for compliance purposes.
Participation as a specialist in news features on the use of AI to manipulate video and audio in electoral contexts.
A voice in this recording? Speaker comparison, audio authenticity and detection of AI-cloned voices complete the examination of the video.
Chain of custodyThe foundation that supports everything: extraction of the original from the device or the DVR, hashing and preservation. Voice, image and data examined under a single signature: complete multimedia evidence.
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case