[0:14]Hi everyone. I'm Lucy from Amped Software, and welcome back to another video in which we're going to be taking a detailed look at Amped Authenticate's video mode. And I'll explain some of the filters and tools to hopefully help you with investigating the history, authenticity, and context of a video file. So let's take a look. Let's start with the user interface. In the center, you can see this is the viewer panel where our evidence video file is displayed. And just next to this is where you can adjust any filter parameters, in this case, levels adjustment.
[0:50]To the left, you'll see all of Authenticate's filters that we'll look at in more detail shortly, followed by the projects panel underneath this, where you can add any project bookmarks. At the bottom of the interface is where you'll find the plot and table viewers, which you'll see in action when we start using some of the filters later on. And of course, if you want to, you can choose any frame to send to Authenticate's image mode for even further analysis.
[1:18]Advanced file info is where we recommend you start your analysis workflow so you can gather as much metadata information from the file as possible. You can see what options are available to you here from FF probe information, to frame analysis, hashing, an AVI viewer, and a hex data viewer.
[1:40]We'll use this example to take a look at the XIF tool within advanced file info. And already we can see that there are file creation dates available, which could be very useful, as well as device model, Android version, and more importantly, we've got some location data. If you're connected to the internet, you can simply click here to show the video location on Google Maps, particularly invaluable during safeguarding investigations. We can even look at the position of the sun at the time and place of capture to check that this matches the scene within the video.
[2:22]Using the camera identification filters, we can utilize photo response non-uniformity, or PRNU for short, to help identify if a video has been taken or not with a certain camera. By comparing the sensor noise pattern. We can create a camera reference pattern or CRP by loading a file that we know has come from a source device. I'll just move the filter parameter panel slightly to make this clearer, but you can see I've selected to auto detect digital stabilization. And this is important because if digital stabilization is present, then camera identification won't work. Otherwise, you'll receive a message letting you know that the CRP was created along with a log file. Now we have our camera reference pattern, we can compare evidence files against it, and the result will be displayed in the table viewer, along with the PCE or picked correlation energy value.
[3:15]Let's go through the compression analysis filters, and we'll start with the VPF filter, useful for identifying traces of double compression, meaning a video may have been resaved and recompressed. This means it's no longer a camera original. In this example, we see double compression is reported in the table viewer, as the periodic peak value of VPF is 1.28 over the threshold of 0.60. We can also use the advanced file info again to look at the Gop structure of this file, as we can see a peak in the VPF plot viewer, indicating the trace of a previously encoded Gop structure. Certainly useful for further determining the integrity of a video file. We can then use the macro block filter to examine the encoding patterns within an Mpeg-based video, along with visualizing any motion vectors. You can see in this file, and using the legend towards the side of the interface, the frame types are now more clearly visualized. We can also generate a plot table to visualize this further, and, if required, the processed video showing this macro block analysis can be exported, should you need to present it. If we're dealing with a HEVC or H265 video file and want to look at the encoding in more detail, we can use the coding tree units filter. H265 doesn't use macro blocks within its encoding, instead it uses CTUs that are tiles of 64x64 pixels. These can contain further coding units that may be subdivided into 32x32 pixels, 16x16 pixels, and 8x8 pixels. I've applied the filter to this HEVC video, and you can see the larger 64x64 CTUs here, whilst when we zoom in, other coding units can be seen, sometimes horizontally or vertically. The legend can be seen at the side for interpreting the types of CTU being visualized. And this filter is particularly useful for demonstrating encoding and prediction within a HEVC file. Whilst the macro blocks filter allows for finer inspection of motion vectors, as we've just seen, the motion vectors filter provides a plot that demonstrates a more general idea of the direction and magnitude of motion vectors throughout the video.
[5:33]The continuity analysis filters make it easier to spot any changes in a video, such as repeating a frame or any suspicious similarities. We can see in this example, using the channels filter, that the explosions in this video occur three times as is visible through the repeating pattern in the average RGB channels. Very useful for identifying the edit within this video. The block difference filter helps you to see pixels in the video that either changed a lot or very little between each consecutive frame. You can see in this example, I've changed the color so that we can see that the areas that don't change remain blue, and we can again create a plot of the differences, and, as we did with macro blocks earlier, we can easily export the processed video if we need to present this outside of the software. Last but not least, the PRNU tampering filter allows you to identify sections of a video that match with a camera reference pattern, and those that don't. In this example, I've already created a CRP, and I'm first using the frame group size of 50. When I run the analysis, I don't see any matches. However, if I increase the frame group size here to 150, we can now see some portions of the video that peak above the threshold, indicating a match. This filter can be very useful for detecting video montages if you don't have access to the original device. Hopefully, that helps to demystify some of the filters and features of Amped Authenticate's video mode. If you enjoyed this video and you want to know more, we have a host of articles dedicated to Amped Authenticate on our blog. So be sure to check that out, along with our social pages and subscribe to our YouTube channel for more content in the future. Bye for now.
