Practical Examples of Forensic Analysis of Photos and Videos
Forensic analysis of photographs and video files is a rather extensive topic that could fill more than one chapter of our course. Within this topic, we will discuss several examples of tasks solved by forensic analysis of photographs and video files. This is important for a correct understanding of the capabilities of the method and the practice of its application.
Before studying this material, I recommend familiarizing yourself with the chapter What can be determined from a photo on the internet. Establishing identity, IP address, shooting location, and much more.
Example One.
This is a real-life example. A citizen suspected of child sexual abuse, which he filmed and saved on his computer, was detained by the police. By the time forensic experts gained access to the suspect's computer, the video had already been deleted using special software, and there was no way to recover the deleted file.
Experts conducted a comprehensive forensic analysis of the computer, where a thumbnail of the video file was found preserved in the system. The size of the thumbnail was insignificant, but it clearly indicated that the suspect had indeed engaged in sexual acts with a minor.
The perpetrator had securely deleted the video, but he did not know that information from viewed images and video files remains in the system in the form of thumbnails. This helped to incriminate him for his actions.
Example Two.
This is also a well-known example from real life. A gang suspected of counterfeiting banknotes was detained. On the suspect's computer, a dismantled cryptocontainer TrueCrypt was discovered. The suspects refused to provide the password, and a brute-force password attack using a dictionary failed, making the situation seem hopeless.
Then, experts used forensic software to examine the contents of the computer's hard drive and discovered thumbnails of all images opened on it, which, as you can understand, contained counterfeit banknotes. The system had carefully preserved them, and it was these that helped to gather the evidence.