Forensic Multimedia Analysis

What do we mean by “forensic multimedia analysis?” What is “analysis?”

a·nal·y·sis [əˈnaləsəs] – NOUN. Analyses (plural noun).

  • A detailed examination of the elements or structure of something. “statistical analysis” · “an analysis of popular culture”
    synonyms: examination · investigation · inspection · survey · scanning · study · scrutiny · perusal · exploration · probe · research · inquiry · anatomy · audit · review · evaluation · interpretation · anatomization
  • the process of separating something into its constituent elements. Often contrasted with synthesis. “the procedure is often more accurately described as one of synthesis rather than analysis”
    synonyms: dissection · assay · testing · breaking down · separation · reduction · decomposition · fractionation
    antonyms: synthesis

Forensic science is the systematic and coherent study of traces to address questions of authentication, identification, classification, reconstruction, and evaluation for a legal context. (Source: A Framework to Harmonize Forensic Science Practices and Digital/Multimedia Evidence. OSAC Task Group on Digital/Multimedia Science. 2017)

What is a trace? A trace is any modification, subsequently observable, resulting from an event. You walk within the view of a CCTV system, you leave a trace of your presence within that system. You send a text message, you leave a trace on at least two mobile devices, as well as the transmission networks that facilitate that transfer of data.

Thus, forensic multimedia analysis (which can include video / image / audio / metadata) can be seen as a systematic and coherent examination of multimedia traces (elements) to address questions of authentication, identification, classification, reconstruction, and evaluation for a legal context.

In the former definition, we can see the quantitative nature of analysis. The latter definition reveals it’s potential qualitative elements.

In a quantitative data analysis, things are stable, controlled – facts can be obtained (facts are measurable / objective). In a qualitative data analysis, things are dynamic. Your role as an observer may influence the analysis. What is “true” depends on the situation & setting (truths are things we “know” – subjective). A quantitative study is controlled. A qualitative study is observed.

A qualitative study’s purpose is to describe or understand something. The purpose of a quantitative study is to test, resolve, or predict something (e.g. in order to use a DVR to determine speed of an object within it’s derivative video files – results will be a range of values, one must resolve how the DVR creates files “typically” through a controlled series of tests in order to “prove” speed).

The analyst’s viewpoint during a quantitative study is logical, empirical, deductive (conclusion guaranteed). In a qualitative study, it’s situational and inductive (conclusion merely likely) or abductive (taking one’s best shot). Performing a comparative analysis with convenience samples is an example of taking one’s best shot. A quantitative study would feature an appropriate sample size calculation and note any limitations that arose as a result of not being able to achieve the appropriate samples.

From a contextual standpoint, a quantitative’s context is not taken into consideration but rather controlled via methodological procedures. In this way, potential bias is mitigated. In a qualitative study, context matters – values, feelings, opinions, individual participants matter.

In a quantitative study, the analyst seeks to solve, to conclude, or to verify a predetermined hypothesis. With a qualitative study, the orientation changes – seeking rather to discover or explore. This can occur often in investigations – new information developed leads to changes in the direction of the investigation as things / people are ruled-in / ruled-out.

In a quantitative analysis, the inputs and results are numerical – data is in the form of numbers / numerical info. A qualitative analysis is narrative in nature – data is in the form of words, sentences, paragraphs, notes, or pictures / graphics / etc.

After conducting a quantitive analysis, one’s results / findings can be generalized to other populations or situations. The results of a qualitative analysis are case specific, particular, or specialized.

With all of this in mind, what is analysis? What type of analysis are you conducting? What type of analysis are you reporting? When analyzing the work of other analysts, what type of work are they conducting / reporting?

You can use this dialog to build a template / matrix. In reviewing work, examine the elements above to determine if the work is quantitative or qualitative. For example, you’re reviewing an analyst’s work in on a measurement request (photogrammetry). The results section features a picture that has been marked up with arrows and text. No methodology is discussed. These results would be considered qualitative. If the results section featured a conclusion, a range of values, error estimation, and a reference / methodology section, it could be considered quantitative. You could take the analyst’s data and reproduce their study – which is not possible from an annotated picture.

The elements for a quantitative analysis described above, when reported back to the Trier of Fact, help ensure that you’ve maintained standards compliance (e.g. ASTM E2825-18). Rhetorical or narrative statements are fine for the introductory section of your report – a summary of the request – but are not sufficient for supporting a conclusion or describing one’s processes.

If you’d like to know more or if you have questions, click here.