This brief (approx. 9min.) introduction into the world of digital video evidence is intended to provide law enforcement professionals with a better understanding of the basic concepts and related issues.  It was geared towards first responders, who in many cases are the ones initially seizing video evidence.

I distinctly remember about ten years ago when a local police chief told us that there was no computer crime in his village. I also remember literally laughing out loud when I heard that.(Seriously, I was bent over from laughing so hard.) Digital evidence is being collected at an unprecedented rate each and every single day, and you’d probably be hard pressed to find anyone more intimately familiar with that then your local multimedia, computer, or mobile device analyst.

FFmpeg is a great tool to have in your toolbox if you’re a multimedia geek. If you live mostly in the world of Microsoft Windows and have dozens, hundreds, or thousands of files to process though they lose a little luster. Sure, there are tons of free applications built on FFmpeg that provide some limited batch processing capability, but usually they're just that; limited. Here’s a simple way you can process hundreds of files from one format to another, using the full capability of your FFmpeg install.

First, which scripting languages do you know? Great, we won’t need those, but that’s really cool that you know them. Given that you’re reading this, I’m going to assume you can write plain text into a text file. I don’t like to assume anything, but I’m feeling pretty good about that one. Alright, let’s get started.

Brett Shavers, author and one of the main developers of the WinFE forensic boot environment, has released a free online training course on WinFE.

Online training is a great way to supplement classroom training, providing it's from a well organized and reputable source. It's great to see more options for online and flipped classroom training related to digital forensics, and I can assure you you'll be seeing even more soon! ;)

As USB thumb drives and memory cards get larger and cheaper, it's getting easier to trust much more of your data to them. It's also much easier to mistakenly erase data or have them hiccup on you. And if you're in the habit of holding on to that data for too long -- for example, not transferring photos from your camera's memory card -- disaster is almost guaranteed to strike at some point. What happens then?

Full Story

A pair of researchers from Dartmouth University have devised a metric for quantifying how much a digital photograph has been altered by digital photo-editing techniques.

Full Story

EXT4 is a next generation file system replacement for the EXT2/EXT3 family of Linux file systems. It was accepted as "stable" in the Linux 2.6.28 kernel in October 2008[1]. As of this writing, it's starting to appear as the default file system in newer versions of several Linux distros. While the developers did try to maintain some degree of backwards compatibility with EXT2/EXT3, there is quite a bit that's new and different with EXT4. Popular forensic tools like the Sleuthkit are not fully compatible with these changes in EXT4, although some of their functionality does still work.

Full Story

The Western New York RCFL, US Attorney's Office, NY Attorney General and various other entities are sponsoring a one-day seminar entitled "Search & Seizure of Digital Evidence", to be held on March 31, 2009 at the SUNY Buffalo North Campus Center for Tomorrow.  See attached PDF for details.

A technology built into many new solid-state drives (SSDs) to improve their storage efficiency could inadvertently be making forensic analysis at a later date by police forces and intelligence agencies almost impossible to carry out to legally safe standards, researchers have discovered.

The detailed findings contained in Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Discovery? by Graeme B. Bell and Richard Boddington of Murdoch University in Perth, Australia, will make unsettling reading for professionals in the digital forensics field and beyond.

Full Story

"Who designed this user interface, Stevie Wonder?" Actual statement from a LE technician and point well taken when it comes to proprietary DCCTV players. They're often horribly designed, and like all multimedia players/editors/tools regardless of who makes them, they are time & resource dependent (e.g. hardware resources, drivers, frameworks, codecs, etc.).

The Technical Support Working Group (TSWG) recently made their flip-book "Best Practices for the Retrieval of Video Evidence from DCCTV Systems" available electronically as a PDF file.  Visit the URL below to access the PDF and other TSWG resources:

http://www.tswg.gov/subgroups/isf/electronic-evidence/products.html

Until about two years ago, it wasn't that often that I’d encounter Variable Frame Rate (VFR) video evidence, unless of course the case included video recorded by mobile phones. Times, they are a changing my friend.

DVR/NVR manufacturers are leveraging the advantages of VFR more often these days. And why shouldn't they be, especially when we’re seeing even the high-end professional video recording equipment start to use VFR more frequently. Throw in the want/need to get to Ultra HD before the next guy, and suddenly you've got a decent argument for VFR.