Forensics - Audio
and Video
Please sign-in via QR Code or
https://goo.gl/U46rfU
CTF Problem
bit.ly/2m5N1Bx
Documentation is SUPER
important
● We can’t emphasize this enough
● Preserve integrity of evidence
● This stuff may be actual evidence in court cases
Forensics
What is it?
Steganography?
Standards
Audio Engineering Society International
American Board of Recorded Evidence
American National Standards Institute
Software
GIMP / Glimpse
Audacity
Professional
Audio
Waveform Analysis
Spectrographic Analysis
Scanning Software
Audio Demo
Found some interesting words of advice left by sayonara-bye... help
me understand it!
Picture/Video Techniques
Sharpening
Masking
Deblurring
Contrast
Picture/Video Techniques
Stabilization - can be included with camera when recording
Interlacing
Demultiplexing
Example
Example Solved
Example
Metadata
Announcements
ISO
Franco - @MustardJuan
CSAW CTF
Sept 13 3 PM - Sept 15 3 PM
Open lab - ECSS 4.619
Sept 13 3 PM - 9 PM
Sept 14 10 AM - 4 PM
Team code will be in Discord
Upcoming Events
Next week - Files and Filesystems Forensics
October 7 - Paycom
November 4 - Texas Instruments
Confirming - Alkami and Cambrian Cyber Group
Announcements
Fire Talk Sign up - bit.ly/2kF7FIk
CSG Officer Application - bit.ly/2malxuB
CTF Problem Discord
Sign-in
bit.ly/2m5N1Bx

Forensics audio and video

Editor's Notes

  • #3 Audio analysis and video analysis are two separate disciplines by the American Society of Crime Laboratory Directors, Laboratory Accreditation Board, American National Standards Institue
  • #5 Audio analysis and video analysis are two separate disciplines by the American Society of Crime Laboratory Directors, Laboratory Accreditation Board, American National Standards Institute
  • #6 IDENTIFICATION: At least 90% of all comparable words must be very similar aurally and spectrally, producing not less than twenty (20) matching words. PROBABLE IDENTIFICATION: At least 80% of the comparable words must be very similar aurally and spectrally, producing not less than fifteen (15) matching words. POSSIBLE IDENTIFICATION: At least 80% of comparable words must be very similar aurally and spectrally, producing not less than ten (10) matching words. INCONCLUSIVE: Falls below either the Possible Identification or Possible Elimination confidence levels and/or the examiner does not believe a meaningful decision is obtainable due to various limiting factors. POSSIBLE ELIMINATION: At least 80% of comparable words must be very dissimilar aurally and spectrally, producing not less than ten (10) words that do not match. PROBABLE ELIMINATION: At least 80% of the comparable words must be dissimilar aurally and spectrally, producing not less than fifteen (15) words that do not match. ELIMINATION: At least 90% of the comparable words must be very dissimilar aurally and spectrally, producing not less than twenty (20) words that do not match.
  • #7 Glimpse - GIMP fork
  • #8 Waveform Analysis: The waveform display reflects graphically the relationship between the time and amplitude of recorded sounds and allows the identification and comparison of record events on evidence and test tapes. When a record event occurs such as a start, stop, stop/re-start or pause on a magnetic analog tape, a distinctive mark or signature is placed on the tape. When waveform analysis is conducted, these signatures can be seen and in most cases, heard. Digital recorders also produce small signatures which can be seen on the waveform. Spectrographic Analysis: A sound spectrograph displays the recorded material in time, frequency, and amplitude. Its distinctive display is used to further study the effects of record events, etc. Any gap in the audio signal as well as signatures can be examined on the spectrograph.
  • #9 Hint: Why does that right channel sound strange?
  • #10 Sharpening Masking Deblurring - Wiener filter
  • #11 Interlacing - In an analog system, interlaced scanning is used to record images (a technique of combining two television fields in order to produce a full frame of video). A process called de-interlacing may be used to retrieve the information in both fields of video. odd/even lines Demultiplexing - Allows for isolation of each camera. In CCTV systems, a device called a multiplexer is used to combine multiple video signals into a single signal or separate a combined signal. These devices are frequently used in security and law enforcement applications for recording and/or displaying multiple camera images simultaneously or in succession.
  • #12 From ICE 2018
  • #21 https://utdallas.qualtrics.com/jfe/form/SV_eQjGgy01OJVqkL3