Video forensics basics
A practical introduction to digital video forensics — containers, codecs, compression, and the techniques used to analyze authenticity.
15 min read
What is video forensics?
Video forensics is the scientific analysis of digital video to determine its authenticity, origin, and integrity. It applies techniques from signal processing, computer vision, and information theory to detect manipulation, verify provenance, and reconstruct the processing history of video content.
Unlike simple "fake detection," forensic analysis examines multiple dimensions of a video — from container metadata to pixel-level artifacts to temporal consistency — building a comprehensive evidence profile.
Digital video anatomy
Containers
A video file is a container (MP4, MKV, AVI, WebM) that holds one or more streams of compressed video, audio, subtitles, and metadata. The container format itself can reveal information about the tools used to create the file.
Codecs
Video codecs (H.264, H.265/HEVC, VP9, AV1) compress video data using techniques like motion estimation, discrete cosine transform (DCT), and entropy coding. Each codec — and each encoder implementation — leaves distinct fingerprints in the compressed data.
Compression
Lossy compression discards information the human eye is unlikely to notice. This process creates predictable patterns in the data. When a video is re-compressed, these patterns interact in ways that forensic analysis can detect.
Metadata
Encoder tags, creation timestamps, GPS coordinates, camera model strings, and software identifiers are embedded in video containers. While metadata can be spoofed, inconsistencies between metadata and actual content are strong forensic signals.
Core forensic techniques
Error Level Analysis (ELA)
Re-compress the image at a known quality level and compare the error distribution. Regions that have been modified or inserted from a different source will show different error levels than the surrounding content.
Noise analysis
Camera sensors produce characteristic noise patterns (Photo Response Non-Uniformity). Analyzing noise consistency across regions can reveal compositing or generation. AI-generated content has fundamentally different noise characteristics.
Frequency domain analysis
Applying DCT or FFT transforms reveals patterns invisible in the spatial domain. GAN-generated content often shows characteristic peaks in the frequency spectrum due to upsampling operations.
Quantization table analysis
JPEG and video codecs use quantization tables that leave fingerprints in the DCT coefficient distributions. These fingerprints can identify the encoder and detect re-compression.
Optical flow analysis
Computing the motion field between frames reveals temporal consistency. Physically implausible motion, temporal aliasing, or inconsistent motion across object boundaries may indicate manipulation.
Copy-move detection
Searching for duplicated regions within or across frames. Content-aware duplication can be detected through local feature matching and consistency analysis.
From single techniques to multi-module analysis
No single forensic technique is sufficient to determine video authenticity. Each technique has blind spots — ELA is sensitive to compression, noise analysis requires sufficient resolution, frequency analysis can be defeated by post-processing.
Modern forensic platforms like ClipForensics combine multiple independent techniques into a unified analysis pipeline. When multiple independent methods agree, confidence increases. When they disagree, the system flags uncertainty rather than guessing.
This multi-module approach is the foundation of ClipForensics's 15 forensic analysis modules.