Service · Video authentication
Video authentication to test whether footage is original
Video authentication is the forensic examination of a recording to establish whether it is consistent with an original, unedited file from the claimed device. We test file structure, metadata, frames and audio for signs of editing, re-encoding, splicing and deepfake manipulation.
Expert Witness Code of Conduct
Reports prepared in line with court rules on expert evidence
SWGDE best practice
Recognised methods for digital and multimedia evidence
Repeatable methods
Documented workflow that another examiner can reproduce
Hash-verified custody
SHA-256 recorded on receipt and at every hand-off
Strictly confidential
Encrypted transfer and secure storage of evidence
Overview
What is video authentication?
Video authentication tests whether a recording is what it claims to be: an original, unaltered file, recorded by the stated device at the stated time. It answers a different question from enhancement or analysis, which assume the footage is genuine.
Every camera, phone and recorder leaves characteristic traces in the files it creates: how the file is structured, how frames are compressed, what metadata is written and how the sensor marks each image. Editing, re-saving or generating a video changes those traces. We compare the questioned file with what the claimed device would produce, examine it frame by frame and check its history. The conclusion is one of three: the file is consistent with an original recording, there is evidence of alteration, or authenticity cannot be determined from the material available. We explain which applies, why, and how confident we are.
What we examine
Tests we use to authenticate video
No single test proves a video is genuine. We combine independent tests, so that a finding rests on several lines of evidence rather than one.
Metadata analysis
Dates, device details and encoder tags, checked for consistency with the claimed source.
File structure
The container and its internal layout, compared with reference files from the same model.
Frame sequence
Frame by frame review for missing, duplicated or inserted frames and timestamp jumps.
Compression analysis
GOP structure and signs of double compression that indicate the file was re-saved.
Audio continuity
Breaks, background noise changes and mains hum that reveal edits in the soundtrack.
Source device comparison
Sensor noise patterns (PRNU) linking a recording to a specific camera or phone.
Deepfake detection
Examination for signs of face swapping, lip-sync manipulation and AI-generated content.
Provenance and custody
Where the file came from, who has handled it, hash values and content credentials.
What we look for
Signs of manipulation, and their innocent explanations
Many signs of alteration have ordinary explanations. A careful examination separates deliberate editing from the effects of exporting, sharing and normal device behaviour.
Re-encoding
The file has been decoded and compressed again, rather than copied in its original form.
Not always editing: messaging apps, social media and many export tools re-encode every file they handle.
Deleted or inserted frames
Frames missing from, or added to, the sequence, often seen as a jump in time or motion.
Not always editing: motion-triggered recording and dropped frames on busy recorders create gaps too.
Splicing
Footage from different recordings, times or cameras joined to look like one continuous clip.
Not always editing: some systems split recordings into segments that are later joined on export.
Altered metadata
Dates, times or device details that do not match the content or the claimed source.
Not always editing: copying, cloud syncing and wrong device clocks change or misreport dates.
Deepfakes and synthetic video
Faces, voices or whole scenes generated or altered using artificial intelligence.
Not always manipulation: phone beauty filters and stabilisation can produce similar artefacts.
Mismatched source
A file whose structure or sensor noise does not match the device it is said to come from.
Not always editing: firmware updates change how a device writes its files, so reference files must match.
Related forensic services
Services often used with authentication
Authentication often sits alongside decoding, image work and expert evidence. Each of these services has its own page.
Video Decoding
Recovering proprietary CCTV files and their embedded timestamps without altering the original.
Video decoding →
Digital Image Authentication
The same principles applied to photographs and screenshots, including AI-generated images.
Image authentication →
Expert Witness
Independent reports and testimony explaining authentication findings to the court.
Expert witness services →
Common questions
What lawyers and insurers ask us about authenticity
Short, direct answers to the questions that most often decide whether a recording can be relied on.
How do you prove a video hasn’t been edited?
By running a series of independent tests and showing that the file is consistent, at every level, with an original recording from the claimed device. We compare its structure with reference files, check every frame in sequence, test the compression and audio, and review where the file came from.
Strictly, no examination can prove a negative. What we can say is whether the file shows any sign of alteration, and how confident we are in that conclusion. The example below shows the structure of a set of findings. In a report, each test is described so another examiner can repeat it.
Can you detect deepfakes and AI-generated video?
Often, yes, but not by any single automatic tool. We combine visual examination, file analysis and provenance checks. Detection software is one input, and its results are weighed with everything else rather than accepted on their own.
| Indicator | What we examine |
|---|---|
| Facial detail | Blending at the edges of the face, unnatural skin texture, teeth, eyes and blinking. |
| Lip sync and voice | Whether mouth movements match the speech, and whether the voice shows signs of synthesis. |
| Lighting and physics | Shadows, reflections and motion that do not behave as they would in a real scene. |
| File and encoder | Software tags, structure and compression that point to generation or editing tools. |
| Provenance | Where the file first appeared, earlier versions and any content credentials (C2PA). |
What does it mean if a video has been re-encoded?
It means the file is not the original as recorded. It has been decoded and compressed again, by an export tool, an app or editing software. Re-encoding on its own is not evidence of editing, but it does remove some of the traces that authentication relies on.
Footage sent through WhatsApp, posted to social media or exported from a phone gallery is almost always re-encoded. That limits how strong a conclusion can be, because evidence of earlier editing may have been overwritten. This is why we always ask for the earliest available copy, and for the original device where possible. More on video decoding.
What conclusions can an authentication report reach?
One of three: the recording is consistent with an original, unedited file; there is evidence that it has been altered; or authenticity cannot be determined from the material available. Each conclusion is given with its level of confidence and the reasons for it.
Where there is evidence of alteration, we describe what was changed and where, for example the frames that were removed or the point at which two recordings were joined. Where a conclusion cannot be reached, we explain what is missing, such as the original device or reference files, and whether obtaining it would help. More on expert witness services.
Instructing us
What to send us, and what you receive
Authentication depends on the file and on its history. Please contact us before sending footage so we can arrange a secure transfer.
What to send us
- The earliest available copy of the file, not a forwarded or downloaded version
- How and when the file was obtained, and who has handled it
- The make, model and software of the recording device, if known
- Any other copies or versions of the same recording
- The date, time and device the recording is claimed to come from
- Which part of the recording is disputed, and why
- The specific questions you need answered
If the original device is available, tell us early. It allows reference recordings and a much stronger comparison.
What you receive
An independent expert report, prepared in line with the Expert Witness Code of Conduct, that sets out:
- InstructionsThe questions we were asked to address
- Materials examinedEvery file, with its hash value
- ProvenanceWhere the file came from and how it was handled
- ExaminationsEach test, so another examiner can repeat it
- FindingsWhat each test showed, with supporting exhibits
- OpinionThe conclusion and its level of confidence
- LimitationsFactors affecting reliability and interpretation
Our process
How an authentication examination works
We tell you what the file can support before you commit. You receive a written scope and quote before any work begins.
Initial assessment
We review the file and its history, and tell you what conclusions are possible.
Secure evidence transfer
Encrypted transfer or original media by courier. SHA-256 hash recorded on receipt.
Provenance and reference files
File history reviewed and reference recordings obtained from the same device model.
Examination and peer review
Structure, metadata, frames, compression and audio tested, then independently reviewed.
Report and testimony
A reasoned opinion with its confidence, and court attendance if required.
Authentication of a single file typically takes two to four weeks. Multiple files, deepfake questions or device testing take longer, and urgent court deadlines can be accommodated.
See the full process7–30
days to overwrite
Keep the earliest copy, and don’t re-save it
Every export, forward or upload can remove the traces authentication relies on. Keep the earliest copy unchanged, preserve the original device if you can, and secure CCTV recorders before they overwrite within 7 to 30 days.
Frequently asked questions
Video authentication FAQs
Answers to the questions we are asked most often about testing whether a video is genuine.
See all FAQsAuthentication of a single file typically takes two to four weeks. Multiple files, deepfake questions or testing the original device take longer. We confirm a timeframe in writing before work starts, and urgent court deadlines can be accommodated.
Yes, but the conclusions may be more limited. These platforms re-encode every file, which removes some of the traces authentication relies on. We can still examine the content, frames and audio, and the earliest available copy or the original device makes a stronger conclusion possible.
Often. Metadata, embedded timestamps, device clocks and the content itself can all indicate when a recording was made. Each can be wrong or altered, so we test them against one another and report how reliable the date and time are.
Not always, but it helps. With the original device we can make reference recordings and compare sensor noise directly. Without it, we use reference files from the same make and model, and the strength of the conclusion may be lower.
It can show that a recording is consistent with an original, unedited file and give a level of confidence in that conclusion. No examination can rule out every possible manipulation, so we explain exactly what was tested and what the findings support.
Fees depend on the number of files, the questions to be answered, whether device testing or deepfake analysis is needed and whether court attendance is required. We offer fixed-fee and hourly engagements, and you receive a written quote before any work begins.
Related services
Other video and image forensic services
Authenticity questions often lead to analysis, enhancement or image work. These services are provided by the same team.
Video Forensics
Analysis of CCTV, dashcam, body-worn and phone video.
All video forensic services →
CCTV Footage Analysis
Event reconstruction and multi-camera timelines from CCTV.
CCTV footage analysis →
Video Enhancement
Clarifying detail in footage while documenting every step.
Forensic video enhancement →
Digital Image Forensics
Authentication and analysis of photographs and still images.
Digital image forensics →
Get expert advice
Find out whether your footage is original
Tell us what the recording shows, where it came from and what is disputed. We will give you a candid view of what an examination can establish before you commit to any work.
Freecall
1800 865 190
Hours
Monday to Friday, 9.00 am to 5.30 pm
All enquiries are treated in strict confidence. Please contact us before sending any footage so we can advise on the most appropriate transfer method. If you do share footage with us, always use a secure method to protect the integrity of your evidence.