When the Mask Comes Off

Video recording and photos are technologies that have been widely used for a long time. Many programs help users to make a real movie out of their own video recordings. Most users just delete unwanted frames, combine several video clips in one and add titles, but modern programs have a wide range of functions.

Nowadays, a compositing is a technology that is used not only by movie production companies, but also by average users and even without the compositing one can change a video in a way that it will be impossible to see what has been recorded.

It is not difficult to make changes if a video was recorded by a stationary camera and as practice shows, it is as easy to remove unwanted objects from video as from pictures (we discussed it in the previous articles). When there is an unwanted object in the frame, one can just replace it with a background that can be found in another frame. A brief video clip that has been done via free graphics editor – ffmpeg demonstrates that it is very easy:

It is obvious that an investigator needs to know not only how one can make it, but also how to find out that a video is a forgery.

Here is a separate frame of the video:

Error Level Analysis does not disclose anything.

We can check what kind of results we will get by Luminance Gradient and Principal Component Analysis, but they will not provide us with any significant results. It is unsurprisingly as a fragment of the frame has been put from one frame to another, the next one. If you choose the fragment correctly, the difference will not be seen in other frames.

It should be mentioned that we are studying not only one separate frame, but a full video recording.

Let’s take another frame:

We separate one frame from another:

Dark image regions show the area where the frames are not different from each other. On the black background, we can see only movement of the cars for the period of time that passed between the recording of one frame and another.

It is possible that we do not see everything and that is why we are going to normalize a histogram of the picture:

Now we can see all the changes in colors and brightness of pixels. Even if there is no action in the frame, you will be able to see artefacts. Charge fluctuations on the camera’s matrix always change picture from frame to frame.

We should take a closer look at the picture. There are no artefacts on the area from the middle of the frame to the left upper corner, but we can see them on the rest of the frame. It means that there was no changes from frame to frame in this area, but charge fluctuations on the camera’s matrix can not be stopped. It gives us an indication that in this area there is a fragment from another frame. A mask under which something is covered.

As we are studying the video sample, we can show you what was covered under the mask.

About the authors:

Serge Petrov

Interests: Digital Video Forensics, Forgery Detection, Audio Forensics

Igor Mikhaylov

Interests: Computer, Cell Phone & Chip-Off Forensics

Oleg Skulkin

Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics