Video Forensic Malaysia

An Agency Under
MOSTI
Video Forensics:
WHAT YOU NEED TO KNOW
Presented by:
MOHD SHARIZUAN B MOHD OMAR
Digital Forensics Analyst
sharizuan@cybersecurity.my
+60389926935
Securing Our Cyberspace

Copyright © 2008 CyberSecurity Malaysia
Content
q Introduction
q Definitions
q Procedures
q Tools
q Case study
q Training
q Challenges
q Conclusion

Copyright © 2008 CyberSecurity Malaysia 2
Introduction: The Reality of Video Forensic
Too many people expect great stuff from the movies or CSI.

Introduction: Reality of Video Forensic
Lesson from CSI:

Crop, Zoom in and Resize technique can
produce a CLEAR image of suspect.
Picture 1 Picture 2
To prove that it is NOT ALWAYS that easy, we will study the following slides.

To prove Crop, Zoom in and Resize technique

can produce a CLEAR image of suspect.
Picture 1 Picture 2
Picture 1 and 2 are taken using same camera with the same distance, but with
different optical zooming.

Result: Good visual image
Source: Picture 1
Result after using Crop, Zoom in and Resize technique

Result: Bad Visual image
Source: Picture 2
Picture 1
Result after using Crop, Zoom in and Resize technique
If source picture is bad, the result will be bad as well.

How about these picture?

A lot of cases received by us is coming from CCTV recordings.
Picture 3 Result after zoom in
Crop,Zoom In and Resize

is NOT HELPING!
Definition: Forensic Video Analysis
Forensic Video Analysis is the

scientific examination, comparison
and/or evaluation of video in legal
matters. ” -LEVA

Definition: Digital Video Evidence (DVE)
DVE is information of probative value

stored or transmitted in binary from
including, but not limited to, film, tape,
magnetic and optical media, and/or the
information contain therein ” -LEVA

Procedures:
Evidence Management
Playback
Storage/Archive
Processing
Output

Procedures: Evidence Management
q Principle for seizing

and maintaining video
evidence.
q The general principle

are:
§ Chain of custody.
§ Evidence preservation.

Procedures: Playback
q To view and
playback the
video evidence.
q To identify which
video files to
capture.

Procedures: Storage/Archive
q Method for retrieving recorded video from DVE.

q Process is based on this fundamental question:
§ Is the request reasonable?

§ What export method are available?
§ Is the method practical?

Procedures: Processing of DVE
q Technical Functions
§ Step-by-step process/procedure
§ Conducted by trained first
responder / analysts
q Analytical Functions
§ Required a significant amount of
judgment and/or an opinion.
§ requiring additional skills,
education, experience and/or
training.

q Technical Functions
§ Copy digital media
§ Converting digital media from one format to
another.
§ Printing images from digital media.
§ Archiving data.
§ Outputting data to an analog or digital
medium.
§ Resizing digital images.
§ Basic image adjustments.

q Analytical Functions
§ Image comparison / photographic/ video comparison
§ Conducting image aspect ratio calibration.
§ Color correction
§ Motion tracking
§ Image stabilization
§ Audio/Video Alignment
§ Image analysis

Procedures: Output
q Generate Hash
§ To verify the original condition of the evidence.
q Video format
§ Proper aspect ratio
720x480 (recommended)
§ Uncompressed video output.
mpeg (recommended)
q Image format
§ No compression or losses compression.
§ Use The Tagged Image File Format TIFF.(recommended)
q Storage media
§ CD/DVD
§ External hardisk

Tools: Video Forensics Analysis
Basic Tools
Advanced Tools

Tools: Basic
Video Editing Image Enhancing

• Handles the editing of video • A program that enable a person to
sequences on a computer. manipulate visual images on a
• Ability to capture video from other computer
devices. • Ability to enhance images.
• Video editing software comes with a
lot of video codecs

Tools: Advanced
Demultiplexer
§ Multiplexer system allows many cameras to record into a
single video file.
§ The frames jump all over the place.
§ Demultiplexer system separates the multiplex videos into
separate screens.

Tools: Advanced
Deblur Filter
§ Problem: A moving object
creates a blur image when
captured.
§ Solution: Deblur filter helps
to sharpen the video.

Tools: Advanced
Denoise Filter
§ Problem: The original

video is too dark.
§ Solution: After shifting
the histogram, more
details of the image can
be seen, but it is far too
noisy.
§ The Denoise filter rips
through the noise and
comes out with a more
decent picture
Tools: Advanced
Video Stabilization
§ Problem: A camera recording

a vehicle going from left to
right across the screen
producing a shaky image.
§ Solution: Video Stabilization
uses shape matching and
velocity estimation to freeze
the object in the same spot

Tools: Advanced
Panorama Mosaic Reconstruction
§ Problem: Getting a full image of a moving object.

§ Solution: Panorama Mosaic Reconstruction recognizes
duplicates in several frames and stitch parts of images to
form a complete object image.

Case Study
q Case Study 1:
Video/Image Enhancement
q Case Study 2:
Video/image Comparison
q Case Study 3:
Image Authentication

Case Study 1: Video/Image Enhancement
Problem: Blur image Solution: Adjust image brightness and Sharpening
Picture 1 Result: Picture 2

Case Study 2: Video/image Comparison
Problem: To identify whether Object B is similar to Object A.

Solution: Use blend technique. Object A is blend with Object B in picture C.
Object A
Picture C
Similarities of Object A and Object B

Object B are highlighted with green arrows.
Case Study 3: Image Authentication
Problem: To prove Picture A is a superimpose picture

Solution: Zoom and analyze the picture C. Identify the texture, resolution,
perspective and color balance consistency.
Original image
Manipulated image
Picture B
Image was crop and
paste
Picture A
Picture C
Training
Where to get the training?

q Professional Organizations
q Vendor Training
q Seminar
q Other resource

Training: Professional Organizations
LEVA
Law Enforcement & Emergencies Services Video Association
Resolution Video Incorporation
• These organization provides regular courses and seminars on forensic

video analysis.
• Also provide Forensics Video Analysis Certification.
Training: Vendor Training
q Company that provide digital forensic analysis

system and image processing tools.
q Also provide training in digital forensics analysis
and image enhancing techniques.
q Example:
§ Avid-Ocean
§ Adobe Photoshop

Training: Conference & Seminar
q Seminar allow analyst to compare and review

processing techniques.
q Provided by:
§ Government forensic Lab
§ Law Enforcement Agencies (LEA)
§ Professional Organization
q Example:
§ The LEVA 2008 International Video Evidence
Symposium and training Conference.

Training: Others
q Book
q Internet resource
§ Blog
• http://media-geek.com/
• http://www.deke.com/
§ Video Streaming
• http://www.youtube.com/
§ Website
• http://filext.com/

Challenges In Video Forensics
1. Low quality Source

§ Low quality images produced by low quality CCTV and
camera and also compressed video format.
§ Almost all CCTV cases received by the analyst are in low
quality format.
2. Proprietary Issue
§ Different CCTV produces different output.
§ Different codecs needed to be able to view the output.
3. Digital Video Forensic is a new technology

§ More research and more tools need to be produced.
§ It is important to maintain the integrity and to preserve the
digital video, therefore analyst must have the right tool.
Conclusion
q You almost never get a nice digital video

evidence.
q You won't always get a perfect picture.
q If source picture is bad, result will be bad as well.
q However, tools does help the analyst to produce
a better picture.
q Enhancing the image cannot fix 100% quality of
original image.
q Most important! Video Forensic is NOT JUST a
ZOOM IN IMAGE.

THANK YOU
QUESTION?
Our Websites and emails
http://www.cybersecurity.my for
Corporate website
http://www.mycert.my for
Technical website
http://www.esecurity.my for
Awareness Portal
http://cnii.cybersecurity.my for
info@cybersecurity.my → for general inquiries
cyber999@cybersecurity.my → for incidence reporting

Our Corporate
Website:

Securing Our Cyberspace Copyright © 2008 CyberSecurity Malaysia Copyright © 2008 CyberSecurity Malaysia 40

Video Forensic Malaysia

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Video Forensic Malaysia

Caricato da

Copyright:

Formati disponibili

An Agency Under

Securing Our Cyberspace

Securing Our Cyberspace

Securing Our Cyberspace

Lesson from CSI:

Securing Our Cyberspace

To prove Crop, Zoom in and Resize technique

Securing Our Cyberspace

Result: Good visual image

Result after using Crop, Zoom in and Resize technique

Result: Bad Visual image

If source picture is bad, the result will be bad as well.

Securing Our Cyberspace

How about these picture?

Picture 3 Result after zoom in

Crop,Zoom In and Resize

Forensic Video Analysis is the

Securing Our Cyberspace

DVE is information of probative value

Securing Our Cyberspace

Securing Our Cyberspace

q Principle for seizing

q The general principle

Securing Our Cyberspace

Securing Our Cyberspace

q Method for retrieving recorded video from DVE.

§ Is the request reasonable?

Securing Our Cyberspace

Securing Our Cyberspace

Securing Our Cyberspace

Securing Our Cyberspace

Securing Our Cyberspace

Securing Our Cyberspace

Video Editing Image Enhancing

Securing Our Cyberspace

Securing Our Cyberspace

Securing Our Cyberspace

§ Problem: The original

§ Problem: A camera recording

Securing Our Cyberspace

Panorama Mosaic Reconstruction

§ Problem: Getting a full image of a moving object.

Securing Our Cyberspace

Securing Our Cyberspace

Problem: Blur image Solution: Adjust image brightness and Sharpening

Picture 1 Result: Picture 2

Securing Our Cyberspace

Problem: To identify whether Object B is similar to Object A.

Similarities of Object A and Object B

Problem: To prove Picture A is a superimpose picture

Where to get the training?

Securing Our Cyberspace

Resolution Video Incorporation

• These organization provides regular courses and seminars on forensic

q Company that provide digital forensic analysis

Securing Our Cyberspace

q Seminar allow analyst to compare and review

Securing Our Cyberspace

Securing Our Cyberspace

1. Low quality Source

3. Digital Video Forensic is a new technology

q You almost never get a nice digital video

Securing Our Cyberspace

info@cybersecurity.my → for general inquiries