SUPERIOR COURT CAUSE: 24-1-00253-04SHERIFF INCIDENT: 24C06401

Video Forensics Tools & Guide

by Ryan Hell

Professional-grade free tools and techniques to analyze video evidence for tampering, manipulation, and authenticity verification. Used by law enforcement, journalists, and legal professionals worldwide.

About This Resource

This guide was created to help analyze the Chelan County evidence videos for signs of tampering. All tools listed are free or have free versions available. These are the same tools used by law enforcement, forensic experts, and legal professionals to verify video authenticity in court cases.

Quick Start Guide

1

Start with Metadata

Begin by extracting all metadata using ExifTool or MediaInfo. Look for inconsistencies in timestamps, device information, and encoding details.

exiftool -a -G1 video.mp4
2

Analyze with Professional Tools

Use VideoCleaner or ForeVid to perform deeper analysis including tamper detection, frame analysis, and compression verification.

  • • Check for double compression
  • • Analyze frame sequences
  • • Verify timestamps
3

Document Everything

Screenshot all findings, export reports, and maintain a chain of custody log. Documentation is critical for legal proceedings.

  • • Save all metadata exports
  • • Screenshot analysis results
  • • Note file hashes

Professional Forensics Tools

Enterprise-grade video forensics software used by law enforcement and legal experts.

VideoCleaner

FREEintermediate

Free forensic video enhancement and authentication software used by law enforcement, CSI labs, and intelligence agencies worldwide.

Key Features:

  • Tamper detection algorithms
  • Video enhancement and restoration
  • Metadata logging and verification

Best for: Law enforcement-grade analysis, detecting edits and alterations

Download / Learn More

Amped FIVE

TRIAL AVAILABLEadvanced

Professional forensic video enhancement with scientifically validated filters for deblurring, stabilizing, and correcting lens distortions. Trial and academic versions available.

Key Features:

  • Scientific validation for court admissibility
  • Advanced video enhancement
  • Automatic documentation of all steps

Best for: Court-admissible professional analysis

Download / Learn More

Amped Authenticate

TRIAL AVAILABLEadvanced

Examines metadata, compression patterns, and sensor noise to detect splicing, edits, or inconsistencies in video recordings. Includes deepfake detection.

Key Features:

  • Deepfake detection
  • Compression analysis
  • Metadata verification

Best for: Detecting sophisticated video manipulation and forgeries

Download / Learn More

ForeVid

FREEbeginner

Free forensic video analysis software specifically designed for surveillance videos from CCTV, video cameras, and mobile devices.

Key Features:

  • Frame bookmarking
  • Built-in image editor
  • Video encoding and format conversion

Best for: Surveillance and dashcam footage analysis

Download / Learn More

VidForensicsTool

FREEintermediate

Open-source video forensics analysis tool designed to ensure authenticity and integrity of digital video content for law enforcement and journalism.

Key Features:

  • Open source and transparent
  • Hash verification
  • Timeline analysis

Best for: Open-source video tampering detection

Download / Learn More

Metadata Analysis Tools

Essential tools for extracting and analyzing video metadata to detect inconsistencies.

ExifTool

FREEintermediate

The gold standard for metadata extraction. Free and open-source software for reading, writing, and manipulating metadata from images, audio, video, and PDFs.

Key Features:

  • Extract ALL metadata fields
  • Cross-platform (Windows, Mac, Linux)
  • Command-line and GUI versions

Best for: Deep metadata extraction and detecting metadata inconsistencies

Download / Learn More

MediaInfo

FREEbeginner

Free and open-source utility providing comprehensive metadata for video and audio files including codec, bitrate, frame rate, and container information.

Key Features:

  • User-friendly GUI interface
  • Command-line version available
  • Export to multiple formats

Best for: Quick technical specifications and container format analysis

Download / Learn More

FFmpeg/FFprobe

FREEadvanced

Industry-standard multimedia framework for video processing, conversion, and analysis. Extremely powerful command-line tools.

Key Features:

  • Frame-by-frame extraction
  • Stream verification
  • Format conversion

Best for: Advanced frame-by-frame analysis and stream verification

Download / Learn More

Specialized Analysis Tools

Additional tools for specific forensic tasks and quick verification.

InVID Verification Plugin

FREEbeginner

Browser extension for quick online video verification with reverse image search, metadata extraction, and fragmentation detection.

Key Features:

  • Browser-based (Chrome/Firefox)
  • Reverse image search integration
  • Quick metadata extraction

Best for: Quick online video verification and fact-checking

Download / Learn More

Ghiro

FREEintermediate

Digital forensic tool for image analysis with integrity verification, histogram analysis, and compression detection capabilities.

Key Features:

  • Compression artifacts detection
  • Histogram analysis
  • Metadata extraction

Best for: Analyzing video frames for compression artifacts

Download / Learn More

What to Look For: Tampering Red Flags

Key indicators that a video may have been tampered with, edited, or manipulated.

Metadata Inconsistencies

  • Creation timestamp doesn't match recording device clock
  • Multiple software signatures (evidence of re-encoding)
  • GPS coordinates that don't match the stated location
  • Modified date is before creation date
  • Missing expected metadata fields for the device type

Compression Artifacts

  • Double compression (video re-encoded after initial recording)
  • Different compression levels in different sections
  • Mismatched GOP (Group of Pictures) structures
  • Inconsistent bitrate patterns
  • Unexpected codec for the recording device

Frame Analysis

  • Missing frames in the sequence
  • Inconsistent or variable frame rates
  • Duplicate frames inserted
  • Discontinuous timestamps between frames
  • Sudden changes in frame properties

Container/Codec Mismatches

  • Container format doesn't match camera model capabilities
  • Codec not available on the recording device
  • Stream order inconsistencies
  • Multiple audio/video streams where device only supports one
  • Unexpected file size for duration and quality

Command Line Analysis Guide

Step-by-step commands for analyzing your evidence videos.

1. Extract All Metadata

Get comprehensive metadata from all videos

exiftool -a -G1 -s -ee -csv *.mp4 > all_videos_metadata.csv

2. Get Technical Specifications

Detailed codec, container, and stream information

mediainfo --Full video.mp4 > video_technical_report.txt

3. Check for Double Compression

Detect if video has been re-encoded (sign of editing)

ffprobe -v error -show_entries frame=pict_type,coded_picture_number -of csv video.mp4

4. Extract I-Frames

Extract keyframes to check for inconsistencies

ffmpeg -i video.mp4 -vf "select='eq(pict_type,I)'" -vsync 0 frames/frame_%04d.png

5. Generate Video Hash

Create cryptographic hash for verification

ffmpeg -i video.mp4 -f md5 - | tee video_hash.md5

6. Compare Multiple Videos

Batch analyze all videos and compare metadata

for file in *.mp4; do echo "=== $file ==="; exiftool "$file" | grep -E '(Create|Modify|Software|Model)'; done

Recommended Analysis Workflow

  1. 1

    Preserve Original Files

    Make copies of all original videos. Never work directly on originals. Calculate and store SHA-256 hashes of originals.

  2. 2

    Extract Basic Metadata

    Use ExifTool and MediaInfo to extract all metadata. Export to CSV for easy comparison across multiple files.

  3. 3

    Look for Obvious Red Flags

    Check for timestamp inconsistencies, wrong device models, missing GPS data, or unexpected software signatures.

  4. 4

    Deep Technical Analysis

    Use FFprobe to analyze compression, GOP structure, and stream details. Look for double compression or mismatched codecs.

  5. 5

    Professional Tool Verification

    Run videos through VideoCleaner or Amped Authenticate for automated tamper detection and professional reports.

  6. 6

    Document All Findings

    Screenshot every finding, export all reports, and maintain a detailed analysis log with timestamps.

Analyzing the Chelan County Evidence

Based on the evidence tampering claims in this case, here are specific things to check in the Chelan County police videos:

Priority Checks:

  • Dropbox timestamps: Compare file creation times with actual recording times to verify the evidence tampering claims
  • Body camera metadata: Verify camera model, serial numbers, and officer assignment match police records
  • Dashcam footage: Check GPS coordinates, speed data, and timestamps for consistency with police reports
  • Audio synchronization: Verify 911 audio matches video timestamps and wasn't spliced or edited
  • File hashes: Compare original file hashes with any copies to verify chain of custody

All tools and techniques listed on this page can be used to independently verify these claims. The evidence is publicly available for download and analysis.

Legal & Ethical Use Notice

These tools and techniques are provided for legitimate forensic analysis, legal proceedings, journalism, and public interest investigations. Always:

  • Maintain chain of custody documentation
  • Never work on original files directly
  • Document all analysis steps with timestamps
  • Use scientifically validated methods
  • Consult with legal counsel when appropriate

The Chelan County evidence is provided as part of public record requests and whistleblower protection. Analysis and verification by independent parties is encouraged and protected under First Amendment rights.