18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection

18.3 Multimedia Forensics: Image, Audio & Video Authentication, EXIF, PRNU and Deepfake Detection

Quick Answer: The blueprint names multimedia basics (Domain 1), multimedia forensics as an investigative methodology (Domain 4), and multimedia forensics using Python (Domain 5). Multimedia forensics answers three distinct questions: what does the metadata say (EXIF, container atoms — easy to read, easy to forge), which device produced this (PRNU sensor pattern noise, which identifies an individual camera body), and has this been altered (compression-domain analysis such as ELA, JPEG ghosts, and double-quantization artifacts). Metadata alone never authenticates a file.

---

Image Metadata: EXIF, IPTC, XMP

EXIF (Exchangeable Image File Format) is embedded by the capturing device in JPEG and TIFF files.

exiftool -a -u -g1 evidence.jpg          # all tags, including unknown, grouped
exiftool -ThumbnailImage -b evidence.jpg > thumb.jpg   # extract the embedded thumbnail

[!WARNING] EXIF is user-writable and platform-stripped. exiftool edits any field in one command, so metadata is evidence of convenience, never of authenticity. Conversely, most major social platforms strip EXIF on upload, so absence of EXIF is normal for a downloaded file and proves nothing. The presence of intact GPS EXIF on a file recovered from a chat app usually means it came directly from a device, not from a platform — which is itself a useful provenance signal.

IPTC and XMP carry editorial and rights metadata; XMP in particular preserves an edit history in some Adobe workflows, listing prior document identifiers and operations.

---

Source Device Identification: PRNU

Photo-Response Non-Uniformity is the multimedia equivalent of ballistics matching. Manufacturing tolerance makes each photosite on a sensor slightly more or less sensitive than its neighbors, producing a fixed, deterministic noise pattern unique to that individual sensor — not to the model, to the specific body.

Method:

1. Estimate the reference pattern by averaging the noise residual across many known images from the suspect camera (flat, evenly lit images work best).
2. Extract the noise residual from the questioned image.
3. Correlate the two; a correlation significantly above the null distribution supports common origin.

Strengths: survives moderate JPEG compression and resizing; identifies the individual device; applies to video frames as well as stills. Limits: requires access to the candidate camera or a corpus of its images; defeated by heavy cropping (which misaligns the pattern), strong denoising, and aggressive re-encoding; in-camera and computational-photography pipelines on modern phones apply processing that weakens the pattern.

Other source signatures: CFA (Bayer) demosaicing artifacts differ by manufacturer pipeline; JPEG quantization tables are device- and software-specific, so a table that does not match any known camera profile for the claimed Make/Model indicates re-encoding; and lens chromatic aberration and vignetting profiles are optics-specific.

---

Tamper Detection in the Compression Domain

Editing a JPEG forces a re-save, and re-saving leaves statistical traces.

[!IMPORTANT] ELA is a triage indicator, not proof. It is heavily affected by an image's own compression history, by texture and edge density, and by the sweep quality chosen. Published forensic practice treats a bright ELA region as a prompt for deeper analysis — DQ artifacts, PRNU, and a documented provenance chain — not as a conclusion. Presenting an ELA heat map alone as evidence of forgery does not survive competent cross-examination.

---

Video Forensics

Container and Codec Structure

An MP4/MOV file is a tree of atoms (boxes):

Container fingerprinting is the practical authentication method: the exact set and order of atoms, the encoder string (Lavf/FFmpeg, HandBrake, a specific phone firmware), and the timescale values differ between a device's native output and any re-encode. A video claimed to be straight off a phone but carrying an FFmpeg encoder string in the metadata has been processed.

ffprobe -v quiet -print_format json -show_format -show_streams evidence.mp4
mp4dump evidence.mp4        # atom tree
mediainfo --Full evidence.mp4

Frame-Level Analysis

• GOP structure: frame-accurate editing of an inter-frame-compressed stream forces re-encoding, which disturbs the I/P/B frame pattern. An anomalous GOP boundary, or an unexpected I-frame, marks a splice point.
• Frame extraction (ffmpeg -i in.mp4 -vf fps=... out%05d.png) allows still-image techniques — PRNU, ELA, copy-move — to be applied per frame.
• Frame-rate and timestamp consistency: dropped, duplicated, or reordered presentation timestamps indicate manipulation.
• CCTV/DVR exports frequently use proprietary containers; native export with the vendor's player and the original file is always preferable to a transcoded copy, because transcoding destroys the very artifacts authentication depends on.

---

Audio Forensics

Tools: Audacity and iZotope RX for spectral work, Amped Authenticate and Medex for formal authentication, plus Python ENF pipelines.

---

Synthetic Media and Deepfake Detection

Detection approaches: temporal inconsistency across frames (a per-frame generator produces flicker); physiological signals such as remote photoplethysmography (subtle blood-flow color changes a synthetic face does not reproduce); generator spectral fingerprints; and provenance-first standards such as C2PA Content Credentials, which cryptographically bind capture and edit history to the asset.

[!WARNING] Detection is an arms race and any classifier's accuracy degrades on newer generators. For this reason a multimedia examiner leads with provenance — the acquisition path, the device, the container fingerprint, and the hash chain — and treats any deepfake classifier's score as corroboration rather than as the finding. This is the same Daubert reasoning applied to AI-derived conclusions in Section 1.4.

---

Multimedia Forensics Using Python

The blueprint names Python multimedia forensics explicitly. The practical toolchain:

from PIL import Image
from PIL.ExifTags import TAGS, GPSTAGS
import hashlib, imagehash

def image_triage(path):
    with open(path, 'rb') as fh:
        sha256 = hashlib.sha256(fh.read()).hexdigest()
    img = Image.open(path)
    raw = img._getexif() or {}
    exif = {TAGS.get(k, k): v for k, v in raw.items()}
    gps = {GPSTAGS.get(k, k): v for k, v in exif.get('GPSInfo', {}).items()}
    return {
        'sha256': sha256,
        'format': img.format,
        'dimensions': img.size,
        'make': exif.get('Make'),
        'model': exif.get('Model'),
        'software': exif.get('Software'),          # names any editor that touched the file
        'captured': exif.get('DateTimeOriginal'),
        'modified': exif.get('DateTime'),
        'gps': gps,
        'phash': str(imagehash.phash(img)),        # perceptual hash for near-duplicate matching
    }

Perceptual hashing deserves emphasis. Cryptographic hashes change completely with a single altered bit, so they cannot group re-saved or resized copies of the same picture. A perceptual hash stays close under recompression, resizing, and minor cropping, which makes it the standard way to cluster a large seized image corpus and to match a recovered image against a known reference set.