Resources
Video forensics glossary
Plain-English definitions of the terms used in video and image forensics, from frame rates and codecs to chain of custody and expert evidence. Each term has its own link, so you can share or cite a single definition.
Terms
93, A to Z
Reviewed by
[Expert name]
Last reviewed
[Month Year]
No terms match your search.
A
Admissibility
Whether a court will allow a piece of evidence to be considered at all. Expert evidence must meet the rules of evidence, including that the opinion is based on specialised knowledge.
AI upscaling
Using artificial intelligence to enlarge an image or video by generating new detail. Because the detail is invented rather than recovered, it is not suitable for identifying people or number plates.
Aliasing
Jagged edges, false patterns or shimmering that appear when fine detail is recorded at too low a resolution or frame rate. Wheels appearing to spin backwards on video is a common example.
Aspect ratio
The shape of a video frame, expressed as width to height, such as 16:9 or 4:3. Playing footage at the wrong aspect ratio stretches or squashes everything in the picture.
Authentication
The forensic examination of a recording or image to establish whether it is consistent with an original, unedited file from the claimed source. See video authentication.
B
B-frame
A compressed video frame that stores only the differences from frames both before and after it. B-frames save space but depend on other frames to be displayed.
Best evidence
The principle that the most original available version of the evidence should be used. For CCTV, that means the native export from the recorder, not a copy or screen recording.
Bit depth
The number of bits used to record each colour value in a pixel. Higher bit depth captures finer gradations of brightness and colour.
Bitrate
The amount of data used to store each second of video, usually measured in kilobits or megabits per second. Lower bitrates mean heavier compression and less detail.
Body-worn camera
A small camera worn by police, security or enforcement officers to record interactions. Exports usually come with an audit trail showing who accessed the footage.
C
CCTV
Closed-circuit television: a system of cameras that record to a local or networked recorder for security. See CCTV footage analysis.
Chain of custody
The documented record of who has handled evidence, when, and what was done to it. Gaps in the record can weaken the weight given to the evidence or lead to it being excluded.
Clarification
Processing that makes detail already recorded in footage easier to see, such as adjusting brightness, contrast or sharpness. Also called enhancement. See forensic video enhancement.
Clock drift
The gradual difference between a recorder’s clock and the real time. Drift means the time shown on CCTV may be seconds or minutes out and must be checked before it is relied on.
Codec
The method used to compress and decompress video, such as H.264 or H.265. A file can only be played by software that supports its codec.
Colour space
The range of colours a video format can represent and how they are encoded. Converting between colour spaces incorrectly can shift colours in the picture.
Compression artefacts
Blocks, smearing, ringing and other distortions caused by compressing video or images to save space. They can hide fine detail or create the appearance of detail that is not there.
Container
The file format that holds video, audio and metadata together, such as MP4, AVI or MOV. The container is separate from the codec used inside it.
Content credentials (C2PA)
An open standard for attaching a secure record of an image or video’s origin and edit history to the file. When present, it can support provenance, but its absence does not prove manipulation.
Contrast stretching
Expanding the range between the darkest and lightest parts of an image so that detail in dull or low-contrast footage becomes easier to see.
D
Dashcam
A camera mounted in a vehicle to record the road ahead, and sometimes the cabin or rear. Many record GPS speed and use loop recording that overwrites older clips.
Deblurring
Processing that reduces blur caused by focus or motion, where the cause of the blur can be modelled. It cannot restore detail that was never captured.
Deepfake
Video, audio or images in which a person’s face, voice or actions have been generated or altered using artificial intelligence.
Deinterlacing
Combining or separating the two fields of an interlaced video frame to remove the comb-like lines that appear on movement.
Double compression
Evidence that a file has been compressed more than once, which shows it has been re-saved since it was first recorded. It is a common sign of editing or re-encoding.
DVR
Digital video recorder: a box that records footage from analogue or HD-over-coax CCTV cameras to a hard drive. Exports often use proprietary formats.
Dynamic range
The span between the darkest and brightest parts of a scene that a camera can record at once. Scenes beyond it lose detail in shadows or highlights.
E
Error level analysis (ELA)
A technique that re-saves a JPEG image and maps the differences, to show areas that may have been compressed differently from the rest of the image.
EXIF
Metadata stored inside many photographs, such as camera model, date and time, settings and GPS location. It can be removed or rewritten, so it is never proof on its own.
Expert report
A written report setting out an expert’s instructions, the material examined, methods, findings, opinions and limitations, prepared for use in legal proceedings.
Expert witness
A person with specialised knowledge who gives the court an independent opinion within their expertise. See expert witness services.
Expert Witness Code of Conduct
Court rules that set out an expert’s duties, including that their paramount duty is to the court and not to the party who engages them.
F
Field
One half of an interlaced video frame, containing either the odd or the even lines. Two fields recorded a fraction of a second apart make up each frame.
Forensic acquisition
Making a verified, complete copy of evidence in a way that does not alter the original, usually with hash values recorded at the time.
Frame
A single still image within a video. Video is a sequence of frames shown quickly one after another.
Frame averaging
Combining several frames of a static scene to reduce random noise and make fixed detail clearer.
Frame insertion and deletion
Adding frames to, or removing frames from, a recording. Gaps or repeated frames in the sequence can be signs of editing, though recording faults can cause them too.
Frame rate
The number of frames recorded each second, measured in frames per second (fps). Many CCTV systems record at low or variable frame rates, which affects timing and speed calculations.
Frame-by-frame analysis
Examining footage one frame at a time to establish exactly what is visible and when each event occurs.
G
Glare
Bright light from headlights, the sun or reflections that floods part of the image and hides detail, such as number plates at night.
GOP
Group of pictures: the repeating pattern of I-, P- and B-frames in compressed video. Irregularities in the GOP can indicate editing or re-encoding.
H
H.264 / AVC
The most widely used video codec, found in most CCTV systems, phones and online video.
H.265 / HEVC
A newer codec that compresses video more efficiently than H.264. Some standard players cannot play it without additional software.
Hash value
A digital fingerprint of a file, calculated using an algorithm such as MD5 or SHA-256. If even one bit of the file changes, the hash value changes.
Height estimation
Using photogrammetry to estimate a person’s height from footage, reported as a range that allows for posture, footwear and camera angle. See speed, height and distance.
I
I-frame
A complete compressed frame that does not depend on any other frame. Also called a keyframe, it is the starting point for decoding the frames that follow.
Infrared (IR)
Light invisible to the eye that many cameras use to record at night, producing black and white footage. Colours cannot be determined from infrared footage.
Interlacing
A method of recording each frame as two fields of alternating lines, captured a moment apart. It causes comb-like lines on moving objects.
Interpolation
Estimating new pixel values from surrounding pixels, for example when enlarging an image. Interpolated pixels are calculated, not recorded.
IP camera
A network camera that sends digital video over a computer network, usually to an NVR or a cloud service.
ISO/IEC 17025
The international standard for the competence of testing and calibration laboratories, covering documented methods, validation and quality control.
K
Keyframe
Another name for an I-frame: a complete frame from which the following compressed frames are decoded.
L
Lens distortion
Bending of straight lines in an image caused by the camera lens, strongest at the edges of wide-angle views. It must be corrected before measurements are taken.
M
Macroblocking
Visible square blocks in compressed video, caused when the codec does not have enough data to describe detail or movement.
Metadata
Information stored with a file that describes it, such as dates, device details and software. It can be incomplete, altered or removed.
MJPEG
Motion JPEG: a video format in which every frame is compressed as a separate JPEG image. It is common in older and some low-cost cameras.
Motion blur
Smearing of moving objects caused by movement during the camera’s exposure. It limits what can be read from fast-moving subjects such as vehicles.
Motion-triggered recording
Recording that starts only when the system detects movement. It creates gaps between events that are normal, not evidence of deletion.
N
Native export
Footage exported from a recorder in its own original format, usually with its player software. It is the best evidence for forensic examination.
Native file
A file in the format originally created by the recording device, before any conversion.
Noise
Random speckle or grain in an image, worst in low light. Noise hides fine detail and can be reduced, but not removed without losing information.
NVR
Network video recorder: a recorder that stores footage from IP cameras over a network, typical of larger premises.
O
Original vs copy
The original is the evidence as first recorded or exported; a copy is any later version. Only a verified copy with matching hash values is treated as identical to the original.
Overwrite / loop recording
When a recorder runs out of space it records over the oldest footage. Many CCTV systems overwrite within 7 to 30 days.
P
P-frame
A compressed frame that stores only the changes from an earlier frame. It cannot be displayed without the frames it depends on.
Peer review
A check of an examiner’s methods and findings by a second qualified examiner before the results are reported.
Photogrammetry
The science of taking real-world measurements, such as height, distance and position, from images. See speed, height and distance.
Pixel
The smallest element of a digital image. Resolution is measured in pixels, and no detail smaller than a pixel can be recorded.
PRNU / sensor noise
Photo response non-uniformity: a faint, unique noise pattern left by each camera sensor. It can be used to link an image or video to a specific device.
Progressive scan
Recording each frame as a complete image in a single pass, rather than as two interlaced fields.
Proprietary format
A file format specific to one manufacturer, which often plays only in that manufacturer’s software. See video decoding.
Provenance
The documented history of a file: where it came from, who has held it and what has been done to it.
R
Re-encoding
Decoding a video and compressing it again. It discards information and removes some of the traces that authentication relies on.
Resolution
The number of pixels in a frame, such as 1920 × 1080. Higher resolution can record finer detail, but only if the subject is close enough to the camera.
Reverse projection
Recording a known object, such as a measuring pole, from the same camera position to compare directly with the original footage.
Rolling shutter
A camera sensor that records the frame line by line rather than all at once, which can skew or bend fast-moving objects.
S
Screen capture
A recording of a screen showing footage, rather than the footage file itself. It loses detail, timing and metadata, and is the weakest form of video evidence.
Sharpening
Processing that increases contrast at edges so detail looks crisper. Too much sharpening creates halos and false edges.
Source camera identification
Establishing which camera or device recorded an image or video, using sensor noise, file structure and metadata.
Speed analysis
Calculating a vehicle’s or person’s speed from the distance travelled between frames and the verified time between them, with a stated margin of error.
Splicing
Joining parts of different recordings or images so they appear to be one. It can be detected through changes in lighting, noise, compression or audio.
Stabilisation
Processing that reduces camera shake by aligning each frame to a fixed point, making movement in the scene easier to follow.
SWGDE
The Scientific Working Group on Digital Evidence, which publishes recognised best-practice guidelines for handling and examining digital and multimedia evidence.
Synthetic media
Images, video or audio created wholly or partly by artificial intelligence, rather than recorded by a camera or microphone.
T
Tampering
Deliberately altering evidence, for example by editing, deleting or adding content, or by changing metadata.
Timeline synchronisation
Aligning recordings from several cameras on one corrected timeline, allowing for each camera’s clock error and frame rate.
Timestamp
The date and time recorded with a frame or file, either burned into the picture or stored in the data. It reflects the recorder’s clock, which may be wrong.
Transcoding
Converting a video from one codec or format to another. Like re-encoding, it can change the frame rate, quality and metadata.
V
Variable frame rate
Footage in which the time between frames changes during the recording, common in phones and motion-triggered CCTV. Timing must be measured from the file, not assumed.
W
Weight of evidence
How much reliance the court places on a piece of evidence once it is admitted. Clear methods and stated limitations increase the weight of expert evidence.
Wide dynamic range (WDR)
A camera feature that combines exposures to record detail in both bright and dark areas, such as a doorway with daylight behind it.
Working copy
A verified copy of the evidence used for analysis, so the original is never altered.
Write blocker
A device or software that allows data to be read from a drive or card while preventing anything being written to it.
Get expert advice
Have a question about your footage?
If a term on this page applies to your evidence and you are not sure what it means for your matter, tell us about the footage. We will give you a candid view of what it can support.
Freecall
1800 865 190
Hours
Monday to Friday, 9.00 am to 5.30 pm
All enquiries are treated in strict confidence. Please contact us before sending any footage so we can advise on the most appropriate transfer method. If you do share footage with us, always use a secure method to protect the integrity of your evidence.