Case Study

It’s hard to imagine a modern day without video surveillance cameras, smartphones, tablet cameras, dashboard cameras, action cameras, and body cams. Thousands of cameras capture thousands of different events. Like unbiased witnesses, they are ready to share what they saw. Thus, when it comes to crime investigations, it’s not surprising that video recordings become the most imperative evidence. However, it’s not uncommon that recording’s setting, camera’s technical and other factors impact the quality of video recording. Sometimes, there’s no certainty that the video reflects real events.

As a result, video recording can contribute to uncovering the truth only with the involvement of video forensic experts. They leverage their expertise and specialized equipment to ensure that video recording can serve as uncontested and informative evidence during legal proceedings. Experts need to overcome many challenges and even simple videos can present significant problems. There are dozens of modern digital recording formats and analog recordings (for example, VHS). In most cases, law enforcement agencies and courts have tools that can reproduce data only from a handful of formats.

Converting video to a necessary format cannot be accomplished by simply consulting Google or downloading suitable conversion software. Innumerable surveillance system models have their own video formats without user-friendly and easily obtainable converter formats. Even if these conversion tools exist, there’s no guarantee that conversion will not destroy the image’s microscopic details that will be critical in the future. Only an expert with video coding training and reliable video forensic equipment can guarantee accurate outcome.

digital forensics video audio laboratory

Expert involvement is also critical when video is damaged, such as dash cam damage during automobile accident. For instance, a dash cam captured the entire incident while the camera was functional, and the data remains on the memory card. The last recorded video that captured an impact cannot be reproduced using regular tools. In this case, experts can compile small fragments of video data in the right sequence. The video that was captured seconds before the impact can then be presented during court proceedings.

Retrieval of necessary information often requires more than just viewing of the video. For instance, multiple cameras can record the same event. If recordings are reproduced one after the other, it’s hard to match details. It’s much easier to accomplish this by analyzing all recordings simultaneously. But, first, recordings need to synchronized. Synchronized recordings can simultaneously reproduce the same events. This process allows to view events from different angles and capture critical details.

Expert contribution is often required when a video is missing the necessary details. It can happen for various reasons:

Recording on handheld video devices results in shaky video.
Recording from a distance yields small image resolution.
Rapidly moving recorded object and slow working camera auto focus result in blurred image.
Insufficient light and light reflecting in camera’s direction (backlighting) produces dark image.

Camera’s characteristics, such as frame dimensions 360X250 also impact quality.

Taking all these factors into consideration, it’s not guaranteed that a video can clearly capture car license plate or criminal’s face.

When it comes to forensic video enhancement, it’s naïve to expect a miracle from an expert, similar to stories shown in fictitious crime shows. However, modern video enhancement software can sometimes produce miraculous results.

Forensic Video Enhancement

One of video forensic expert’s main responsibilities is the determination of video’s authenticity and identifying any video tampering. Video editors, even easily attainable MovieMaker, allow the deletion of video fragments or sequence editing. In this case, the resulting edited video does not capture real events. Thus, before using video evidence, it’s important to examine whether it was edited or not.

This complex task is accomplished through two phases. During the first phase, forensic expert evaluates the video to determine whether it is an original or a copy. The term original video is only used to refer to the video captured on the device during recording. Copying can simply mean that the video file was copied on a different device, the device that was not used during video recording. Copying can also refer to editing file format, resampling and recompression. Only an expert trained in video coding from different devices and video editing can conclusively indicate the video’s authenticity.

The best way to distinguish between an original and a copy is to obtain a video copy recorded on the same device as a video in question. Discovering recompressed video raises a red flag for a video forensic expert. Video recompression can indicate video editing.

However, recompressed video is not always fabricated. For instance, all YouTube videos are recompressed. Yet, very few YouTube videos were edited from the original.

As a result, the most complicated part of authenticity determination is finding remaining evidence of counterfeit video. Sometimes, easily observed simple artifacts can serve as this evidence. For instance, a suddenly appearing object in the video frame or hands of a clock that rapidly changed to a new time can prove that the video is a fake.

Professional forgery is not easily detectable without special tools such as modern forensic software. In this case, forensic experts can conclude video’s authenticity by closely inspecting various qualities of the video, such as video format, coding parameters, file structure, metadata, and, more importantly, verification of image in every one of tens or thousands of frames. It’s a very tedious and lengthy process. Without performing this analysis, experts can’t be confident that the video depicts real events and not what someone wanted us to see.

From time to time, experts are presented with a new challenge – source camera identification. This challenge can be tackled in the same way for pictures and videos. Camera ballistics technology is not very difficult. Experts needs to record several dozens of frames in a specializing setting using proven device. After that, specialized software will isolate “camera’s imprint.” Camera’s imprint is an image fragment that cannot be seen with human eyes, and that remains the same in all images. “Camera’s imprint” is then compared against “imprints” on proven authentic video and photo. This explanation might lead the reader to believe that camera identification is simple, but it’s not true. Captured image’s quality determines the simplicity with which forensic software will discover “camera’s imprints.” Poor image quality can even produce invalid “data imprints.” In order to arrive at the correct conclusion, experts need to have a deep understanding of “imprint” search algorithm, video comparison technique, and software data interpretation skillset.

Forensic expert’s contribution doesn’t stop even after proving video’s authenticity, video enhancement and ensuing that all stakeholders can view the video. Why? Because it’s not enough to see a vehicle on a video. It’s vital to be sure that a specific vehicle is shown, or, at the very least, to prove that the vehicle’s make is within the scope of the investigation.

Objects Identification

Thus, object identification comes into play. In order to solve this issue, experts need to find identifying characteristics using an image. These characteristics need to distinguish an image from thousands of similar images. Next, it’s vital to compare verifiable object’s characteristics against duplicate object’s characteristics. This job is similar to a child’s Spot the Difference Game. Forensic expert’s ability to skillfully play this game can impact the destiny of stakeholders involved in video investigation.

Forensic Photogrammetry

During investigation, questions can arise about size and distance. Forensic photogrammetry, a branch of video forensics, gives an answer. An individual with the knowledge of simple rules of advanced spatial geometry can solve this riddle using a ruler and a pencil. When a computer performs geometric measurements, results will be obtained more rapidly and data will be more accurate.

However, advanced spatial geometry is not always enough. Luckily, modern computers have the capability to produce 3D models of the geographic area and objects. Forensic engineers can determine several points with known coordinates on video or images, easily calculate coordinates of other points, and determine distance between these points.

An image can demonstrate a distance between two objects. A video can also determine time between the events. When distance and time are known, speed can easily be calculated. Cases that involve the determination of guilt after vehicular accident often require calculation of speed. Accumulated forensic expertise and video forensic methodologies allow to determine the speed under different conditions. It doesn’t matter if the video recording took place during the day or at night, up close or from a distance, whether the camera was moving fast or remained still. In any of these cases and under any of these conditions, the vehicle’s speed can usually be determined.

Video forensics can’t solve all riddles. However, experts know that even the tiniest details can make a significant impact during an investigation. Video forensic experts can’t always be magicians, but they still try to work toward a miracle.

Who Needs Forensic Data Recovery?

While it is possible that you may need to initiate forensic data collection to submit to court on your own, there are a variety of other reasons that you or your business could need forensic data recovery. Aside from expected reasons, such as uncovering or proving a crime, here are a few reasons for forensic data recovery:

Investigating Security Breaches or Other Policy Violations in a Business
- HIPAA Violations
- Theft of Trade Secrets or Intellectual Property
- Accounting Fraud
- Investigate Employee Actions
  - Inappropriate Material
  - Email Abuse
  - Instant Messaging
  - Non-Business Related Activity / Policy Violations

Investigating Use of Personal Electronic Devices
- Recover deleted call logs, IM conversations, and even track movements with geo-tagging
- Gather data from personal computers, including:
  - EMail
  - Images
  - Webmail
  - Internet artifacts
  - Web history and cache
  - Chat sessions
  - And More
- Protect your children from potential online predators
- Protect yourself from a cheating spouse

There are many reasons for Forensic Data Recovery, and law enforcement personnel are by no means the only entities utilizing forensic data recovery. If you’re considering completing a digital investigation on your own - whether for personal or business purposes - stop now! Let the experts at Digital Forensics Corporation help you complete your investigation right.

Benefits of Hiring Digital Forensics Corporation for your Forensic Data Recovery Case

While a computer savvy mom or dad believes they can adequately protect their child from online predators, a home computer guru believes that he or she would be able to tell if their spouse was cheating, that’s not necessarily the case. When someone wants to hide something, they will delete the data. While this data can be recovered, attempting to do so without the proper training and tools can not only make any evidence invalid, it can cause the data to be permanently lost.

Ensure that all potential evidence is uncovered, including deleted data

The same is true in a corporate setting. Many businesses opt not to outsource internal investigations, instead utilizing an already existing IT team that is not specifically trained for digital investigations. Even highly educated and trained IT personnel can make the same mistakes as someone completing a private investigation in their own home. Data can be compromised making it unusable in any legal setting, or even worse, inadvertently deleted, unrecoverable even to experts, like our technicians here at Digital Forensics Corporation.

Data can be gathered from nearly any digital source

Another drawback to attempting to gather digital evidence yourself is the ability to gather evidence from all digital sources that might have data present. Nearly any digital source can have evidence on it, including:

Personal Desktops and Laptops
Data can be gathered from nearly any digital source
RAID workstations
Servers
Hard Disk Drives

RAM
USB / Flash Drives
CD / DVD Disks
Smartphones
Tablets

Attempting to complete your own investigation can lead to important evidence going undiscovered because you do not have the proper tools to collect the evidence that is present.

Any data / file type can be digital evidence

Often, data that is important evidence in a digital forensic investigation can be a file in a format you are not equipped to open or process. Because we are data recovery professionals, we are equipped to handle all types of files. This ensures that no evidence is left uncovered during our digital forensic investigations. Evidence can come in any file type, including:

Documents
Images
Email
Webmail
Internet artifacts

Web History and Cache
Chat Sessions
Compressed Files
Backup Files
Encrypted Files

One of the biggest consequences of performing your own digital investigation, aside from inadvertently losing data during your search, is potentially corrupting evidence. While a digital investigation may not start out with the intention of uncovering legal evidence, if the data is not properly documented and maintained, any evidence gathered has the strong potential to be inadmissible in court, and even worse, making the ability to gather further evidence from that source legally impossible. In other words, an improperly conducted digital investigation can taint the source of the evidence.

Evidence is presented in a neat, easy to follow format that has a very good track record in court proceedings

While this doesn’t seem important if your intention is not to gather evidence for a legal proceeding, whenever you’re starting a digital investigation, there is always potential that a legal proceeding can lead from the evidence uncovered. Whether the digital investigation is for personal reasons or business reasons, you could find yourself in the middle of criminal proceedings - prosecution of a predator, prosecution of theft, etc - or civil proceedings - divorce, wrongful termination, etc - that was a direct result of the digital investigation. By allowing the trained professionals at Digital Forensics Corporation to complete your Forensic Data Recovery for you, you will ensure that your investigation is done right.

Benefit from other features available you cannot provide in your own investigation

At Digital Forensics Corporation, we can also offer other benefits during our digital forensic investigation that will ensure that you have access to all the evidence that is available on your media. These benefits include, HTML page reconstruction, data reconstruction (recover deleted data), data from incomplete RAID arrays (in some cases), deleted call history / chat conversations, location movements plotted on a map, and much more.

If you need to Forensic Data Recovery, don’t do it yourself. Let the experts at Digital Forensics Corporation help you today.

Child Custody Cases

If you ever have to fight for custody of your children, it will likely be one of the most trying, stressful, and important times in your life. Even though it might be clear to you and those around you that your child is better off with you, proving that in a court of law is another matter entirely. If you have the misfortune of your children having a parent that isn’t just a bad parent, but dangerous, it is even more pertinent that you are able to prove, beyond a shadow of a doubt, that the other parent is unfit and should have no rights. We can help you do this.

Evidence That Can Be Used In Court

Digital evidence being admitted into court cases - both civil and criminal - is becoming more and more commonplace. So much of our lives are documented on the digital devices we use, without us even being aware, that these devices are a treasure trove of information that can be used to make an undeniable case in court.

But is very important to understand what is and isn’t useful in your custody case. We can’t give you legal advice - that is best left up to your lawyer - but we can give you some ideas of what sort of evidence might be gathered from your digital devices. As one divorce law website said, “For your evidence to be deemed admissible by the Family Courts, it must be material and relevant.”

There is a wide variety of evidence that you can gather, but it is very important that you only gather evidence that is relevant to the custody case itself. This includes things that help show, define or support things like: a parent’s active involvement, current physical custody schedule, living situation and standards, willingness to co-parent, mental or emotional instability, domestic violence, substance abuse, and neglect. This evidence can be in the form of:

Emails
Text messages
Internet usage history
Voicemails
Letters
Photographs
Videos
Audio recordings
Schedules
Records (financial, medical, school, police reports, etc)

Often this type of evidence is present on your phone, email, or computer. While you might be aware it’s there, gathering this evidence to properly submit to the court is a daunting task. Don’t worry, we can help.

Getting the Evidence You Need

There is more than one benefit to having a digital forensic team gather your evidence for you. At Digital Forensics Corporation, our digital forensic investigators are trained to find both evidence you know is there, and evidence you didn’t know was there. We have a proven track record for providing evidence that the courts will admit, and can help you verify that files are authentic.

Uncover Deleted Evidence

While a lot of evidence may be present on a device that you and your ex shared, there is often a lot more evidence on the device that has been deleted. Our digital forensic investigators can find that evidence and bring it to light.

Authentic Data Verified By A 3rd Party

Even though you are paying us, we are always an impartial 3rd party. If the evidence is there, we will help you find it. But if the evidence is not there, we will not fabricate it for you. Our methods are forensically sound and verifiable, meaning that if your ex wants to hire his own expert to show that what we’ve found isn’t true, he or she just will be wasting money. All of our findings are put into a court accepted format, which translates into a report that you can provide the judge. This makes submitting digital evidence quick, easy, and sure to pass all inspections it’s put through.

Gathering New Evidence

If your digital devices don’t have the evidence you need, but you know that the other parent is a danger to your child(ren), we may be able to help you gather the evidence you need. We offer monitoring services for your digital devices that can help you capture evidence of what a device is used for, and in some cases what is going on around a device, when you’re not there.

Litigation Forensic Services
This type of investigation is suitable for uncovering evidence that will be used in court or for other legal purposes. Digital
Remote
Monitoring

Always be sure you seek the counsel of a lawyer before undertaking or contracting any monitoring actions. The details of the law are best interpreted by a lawyer, and only a lawyer can help you determine if an action you’d like to take is legal. Digital Forensics Corporation does not assume any responsibility if you misrepresent yourself to us to obtain services, and you are required to verify that you are the owner of the device being monitored and have the right to monitor the device by law. See our legal disclaimer for more information.

YOUR INTELLECTUAL PROPERTY IS SAFE WITH US

Company’s reputation is probably the most valuable asset. When it is lost, there is no amount of reinvestment that could ever be done to deal with the disastrous after-effects. The most common way how company’s good name can be destroyed beyond repair is when another unscrupulous rival or similar entity misuses the company’s intellectual property, that must be protected in the safest way possible. Sometimes, this can prove to be quite a formidable task.

Protecting your company’s intellectual property means you are securing the huge amount of investment that you poured into researching about your product or brand to make it a success on the market. Imitators are always keen to go for the most coveted brand names and trademarks out there, and if you do not take the necessary steps to guard yourself against such, they will surely take advantage of your hard-won intellectual property investments and damage your company’s reputation beyond belief.

Digital Forensics Corporation is the world’s most respected company dealing with intellectual property and brand protection issues. Over the years, we have managed to create a favorable reputation among our clients by implementing several innovative methods, products and services which we use to effectively identify and deal with Intellectual Property Theft.

Digital Forensics Corporation has accumulated lots of experience over the many years that enables us to help our clients conduct superior investigations for in-use trademarks. This may initially include all of the pertinent details such as date of first use and evidence of current use, geographical spread and channels of distribution. We can anonymously negotiate the purchase or sale of a domain name, trademark, patent or other intellectual property. Digital Forensics Corporation also has experience in dealing with different types of counterfeiting operations on a world-wide scale. DFC has proprietary databases that have decades’ worth of intelligence. We have in our possession the latest information about the network of the parties involved. Digital Forensics Corporation is also well acquainted with all the signs of product diversion. DFC’s vast experience of working in this field enable us to effectively identify the paper trail cost.

During our Intellectual Property Investigations we are involved in the following:

Investigating the unauthorized use of tademarks
Providing services for domain acquisition
Protected identification mechanisms on domain registrant
Intellectual property acquisition services
Investigations of patents
Systems for monitoring the Internet
Systems for monitoring media
Systems for monitoring brands
Auditing services for royalty compliance
Anti-counterfeiting programs
Anti-diversion programs
Valuations of trademarks and domain names
Investigations of prior art
Identification of email owners
Protection of CopyShield copyrights

Contact Digital Forensics Corporation today to be well-equipped in protecting your intellectual property. Our team of friendly, highly professional and highly-qualified staff is always ready to walk you through how you can implement our proven programs for intellectual property protection. We will safeguard you against unscrupulous profiteers and keep your company’s impeccable name and reputation.

Case Studies

Digital Forensics Corporation experts were asked by a global licensor of branded luxury clothing and accessories to carry out an investigation into the illegal use of their intellectual property. Our team managed to reveal that one of their sub-licensee’s was making use of their intellectual property by creating duplicate products, using their trademark and selling them at significantly lower prices. Through this investigation, we were able to quantify the total value lost by our client in terms of revenue. Our company played a crucial role in the settlement of this conflict. Afterwards, we devised preventative strategies that would assist our client in the future.

Procedure:

Acquire the original digital evidence in a manner that protects and preserves the evidence. The following bullets outline the basic steps:

Secure digital evidence in accordance with departmental guidelines.
Document hardware and software configuration of the examiner's system.
Verify operation of the examiner's computer system to include hardware and software.
Disassemble the case of the computer to be examined to permit physical access to the storage devices.
- Take care to ensure equipment is protected from static electricity and magnetic fields.
Identify storage devices that need to be acquired. These devices can be internal, external, or both.
Document internal storage devices and hardware configuration.
- Drive condition (e.g., make, model, geometry, size, jumper settings, location, drive interface).
- Internal components (e.g., sound card; video card; network card, including media access control (MAC) address; personal computer memory card international association (PCMCIA) cards).
Disconnect storage devices (using the power connector or data cable from the back of the drive or from the motherboard) to prevent the destruction, damage, or alteration of data.
Retrieve configuration information from the suspect's system through controlled boots.
- Perform a controlled boot to capture CMOS/BIOS information and test functionality.
- Perform a second controlled boot to test the computer's functionality and the forensic boot disk.
- Reconnect the storage devices and perform a third controlled boot to capture the drive configuration information from the CMOS/BIOS.
Power system down
Whenever possible, remove the subject storage device and perform the acquisition using the examiner's system. When attaching the subject device to the examiner's system, configure the storage device so that it will be recognized.
Exceptional circumstances, including the following, may result in a decision not to remove the storage devices from the subject system:
- RAID (redundant array of inexpensive disks). Removing the disks and acquiring them individually may not yield usable results.
- Laptop systems. The system drive may be difficult to access or may be unusable when detached from the original system.
- Hardware dependency (legacy equipment). Older drives may not be readable in newer systems.
- Equipment availability. The examiner does not have access to necessary equipment.
- Network storage. It may be necessary to use the network equipment to acquire the data.
When using the subject computer to acquire digital evidence, reattach the subject storage device and attach the examiner's evidence storage device (e.g., hard drive, tape drive, CD-RW, MO).
Ensure that the examiner's storage device is forensically clean when acquiring the evidence.

Write protection should be initiated, if available, to preserve and protect original evidence.

Note: The examiner should consider creating a known value for the subject evidence prior to acquiring the evidence (e.g., performing an independent cyclic redundancy check (CRC), hashing). Depending on the selected acquisition method, this process may already be completed.
If hardware write protection is used:
- Install a write protection device.
- Boot system with the examiner's controlled operating system.
If software write protection is used:
- Boot system with the examiner-controlled operating system.
- Activate write protection.
Investigate the geometry of any storage devices to ensure that all space is accounted for, including host-protected data areas (e.g., nonhost specific data such as the partition table matches the physical geometry of the drive).
Capture the electronic serial number of the drive and other user-accessible, host-specific data.
Acquire the subject evidence to the examiner's storage device using the appropriate software and hardware tools, such as:
- Stand-alone duplication software.
- Forensic analysis software suite.
- Dedicated hardware devices.
Verify successful acquisition by comparing known values of the original and the copy or by doing a sector-by-sector comparison of the original to the copy.