Citation
Compression level analysis

Material Information

Title:
Compression level analysis
Creator:
Badgley, Patrick Michael ( author )
Language:
English
Physical Description:
1 electronic file (53 pages) : ;

Subjects

Subjects / Keywords:
Signal processing -- Digital techniques ( lcsh )
Image processing -- Digital techniques ( lcsh )
Image compression ( lcsh )
Genre:
bibliography ( marcgt )
non-fiction ( marcgt )

Notes

Review:
With more digital devices such as cameras, smartphones, and tablets currently in use than there are humans in the world, forensic analysis of videos is here to stay. While there are many tools available to forensic examiners to determine the authenticity of a video, this document focuses on the Compression Level Analysis of videos recorded on different digital cameras. This study will examine videos recorded on 30 different devices including digital cameras, smartphones, and tablets. The acquired test videos were recompressed using multiple programs including Adobe Premiere Pro, HandBrake, FFmpeg, QuickTime Player 7 Pro, as well as YouTube. The recompressed videos were processed with MATLAB to generate data showing the Compression Level Analysis. The data will provide the differences between recompression generations from each program. Also, this data will discover visual cues left behind during the recompression process, which were created by the programs used.
Thesis:
Thesis (M.S.) - University of Colorado Denver
Bibliography:
Includes bibliographic references.
System Details:
System requirements: Adobe Reader.
General Note:
College of Arts and Media
Statement of Responsibility:
by Patrick Michael Badgley.

Record Information

Source Institution:
|University of Colorado Denver
Holding Location:
|Auraria Library
Rights Management:
All applicable rights reserved by the source institution and holding location.
Resource Identifier:
946449663 ( OCLC )
ocn946449663
Classification:
LD1193.A70 2015m B33 ( lcc )

Downloads

This item has the following downloads:


Full Text
COMPRESSION LEVEL ANALYSIS:
EXAMINING VIDEO RECOMPRESSION LEVELS
FOR FORENSIC EXAMINATION
by
PATRICK MICHAEL BADGLEY
B.S, University of Colorado Denver, 2013
A thesis submitted to the
Faculty of the Graduate School of the
University of Colorado in partial fulfillment
of the requirements for the degree of
Master of Science
Recording Arts
2015


2015
PATRICK MICHAEL BADGLEY
ALL RIGHTS RESERVED


This thesis for the Master of Science degree by
Patrick Michael Badgley
has been approved for the
Recording Arts Program
by
Catalin Grigoras, Chair
Jeff Smith
Pete Buchwald
November 19, 2015


Badgley, Patrick Michael (M.S., Recording Arts)
Compression Level Analysis: Examining Video Compression Levels from Commercial
Software
Thesis directed by Dr. Catalin Grigoras
ABSTRACT
With more digital devices such as cameras, smartphones, and tablets currently in
use than there are humans in the world, forensic analysis of videos is here to stay. While
there are many tools available to forensic examiners to determine the authenticity of a
video, this document focuses on the Compression Level Analysis of videos recorded on
different digital cameras. This study will examine videos recorded on 30 different devices
including digital cameras, smartphones, and tablets. The acquired test videos were
recompressed using multiple programs including Adobe Premiere Pro, HandBrake,
FFmpeg, QuickTime Player 7 Pro, as well as YouTube. The recompressed videos were
processed with MATLAB to generate data showing the Compression Level Analysis. The
data will provide the differences between recompression generations from each program.
Also, this data will discover visual cues left behind during the recompression process,
which were created by the programs used.
The form and content of this abstract are approved. I recommend its publication.
Approved: Catalin Grigoras
IV


ACKNOWLEDGEMENTS
I would like to thank my professors Catalin Grigoras and Jeff Smith for the assistance
with this thesis and their outstanding instruction throughout the graduate program.
Also, I would also like to thank my parents and grandparents for all of their
encouragement and help, both mentally and financially, during my entire college career. I
would not be where I am today without the love and support you have afforded to me.
Finally, I would like to thank my loving wife who has also provided me with her love and
support over the last few years. You helped me stay motivated when I needed it the most.
Im excited to see where we go from here!
v


TABLE OF CONTENTS
CHAPTER
I: INTRODUCTION
1.1 Background..................................................1
1.2 Scope and Intent of Thesis..................................2
II: TESTING PARAMETERS
2.1 Cameras/Smartphones/Tablets.................................5
2.2 Video Creation Parameters...................................8
2.3 Method to Create Each New Video Generation..................9
2.4 Software and YouTube Overview..............................10
2.5 Adobe Premiere Pro CC......................................11
2.6 QuickTime Player 7 Pro.....................................11
2.7 HandBrake..................................................12
2.8 FFmpeg.....................................................13
2.9 YouTube....................................................14
2 .10 MATLAB...................................................16
III: RESULTS
3.1 Overview...................................................17
3.2 Original Video Comparison..................................17
3.3 VideoResolution............................................20
3.4 More Change in Green and Blue Levels.......................25
3.5 Differences Between Generations............................27
VI


3.6 Visual Cues to Determine Software Used Overview
34
3.7 Visual Cues for FFmpeg.................................35
3.8 Visual Cues for QuickTime Player 7 Pro.................37
3.9 Visual Cues for HandBrake..............................39
3.10 Visual Cues for YouTube and Adobe Premiere............41
IV: CONCLUSION...................................................42
REFERENCES.......................................................43
vii


LIST OF TABLES
Table
1. Cameras used with a resolution of 320x240.......................................6
2. Cameras used with a resolution of 640x480.......................................6
3. Video Camera with a resolution of 720x480.......................................6
4. Cameras used with a resolution of 1280x720......................................7
5. Cameras used with a resolution of 1920x1080.....................................7
6. Smartphones/Tablets with a resolution of 1280x720..............................7
7. Smartphones/Tablets with a resolution of 1920x1080.............................8
8. FFmpeg recompression command...................................................13
9. Older camera information.......................................................20
viii


LIST OF FIGURES
Figure
1. Example of export settings for Adobe Premiere Pro CC......................11
2. Example of export settings used for QuickTime Player 7 Pro................12
3. HandBrake export settings..................................................12
4. Example of full FFmpeg command............................................13
5. MacX YouTube downloader resolution options................................15
6. Apple iPhone 5 Original Video 1...........................................18
7. Apple iPhone 5 Original Video 2...........................................18
8. Panasonic Lumix DMC-TS5 Original Video 1..................................19
9. Panasonic Lumix DMC-TS5 Original Video 2..................................19
10. Original CLA for the Sony DSC-S930........................................21
11. CLA results from FFmpeg Generation 1......................................21
12. CLA results from HandBrake Generation 1...................................22
13. CLA results from Adobe Premiere CC 2015 Generation 1......................22
14. CLA results from QuickTime Player 7 Pro Generation 1......................23
15. CLA results from YouTube Generation 1.....................................23
16. CLA from Sony DSC-W80.....................................................24
17. CLA results from FFmpeg...................................................24
18. Example of a Bayer CFA....................................................25
19. CLA of original video from JVC Everio.....................................26
20. CLA after first recompression.............................................26
IX


21. HandBrake Generation 1.................................................27
22. HandB rake Generation 2................................................28
23. HandB rake Generation 3................................................28
24. Apple iPhone 5 Generation 1............................................29
25. Apple iPhone 5 Generation 2............................................30
26. Apple iPhone 5 Generation 3............................................30
27. LG G2 Original CLA.....................................................31
28. LG G2 FFmpeg Generation 1..............................................32
29. LG G2 HandBrake Generation 1...........................................32
30. LG G2 Premiere Generation 1 CLA........................................33
31. LG G2 QuickTime Player 7 Pro Generation 1 CLA..........................33
32. LG G2 YouTube Generation 1 CLA.........................................34
33. Canon DIO FFmpeg CLA...................................................35
34. Samsung Galaxy Note 4 FFmpeg CLA.......................................36
35. Kodak ZiS FFmpeg CLA...................................................36
36. Canon EOS 5D Mark II QuickTime Player CLA..............................37
37. Samsung HZ50W QuickTime Player 7 Pro CLA...............................38
38. GoPro Hero4 Silver QuickTime Player 7 Pro CLA..........................38
39. Samsung Nexus 10 HandBrake CLA.........................................39
40. Panasonic Lumix DMC-TS5 HandBrake CLA..................................40
41. Canon EOS 7D HandBrake CLA.............................................40
x


CHAPTERI
INTRODUCTION
1.1 Background
With the rise in popularity of digital cameras in the early 2000s and the addition
of cameras on mobile phones, the use and availability of videos to record daily events is
continuing to grow. According to an article published in late 2014 by The Independent,
The number of active mobile devices and human beings crossed over somewhere around
the 7.19 billion mark. [1] This means there are more active devices than humans.
With the ever-increasing number of digital devices, its safe to say some videos
will be recorded, which contain crimes or subject matter that can be used in a court of
law. In order for these videos to be admitted into evidence, an analysis sometimes needs
to be conducted to determine authenticity of the recording. One method used to evaluate
authenticity is the Compression Level Analysis or CLA.
When a video is an original or was provided directly from the source, the CLA
produces little or no signs of recompression depending on the device.
Recompression occurs when a video is loaded into a video editing software or
uploaded to YouTube and resaved or downloaded.
In order to fully understand how CLA works, it is important to note how video
compression works. Popular video codecs such as H.264, MPEG-2, and MPEG-4 use
motion estimation to compress a file. Motion Estimation (ME) and compensation
techniques, which can eliminate temporal redundancy between adjacent frames
effectively. [2] This is accomplished when information is extracted to become
represented by a motion vector. The motion vector indicates the displacement of a pixel
1


or a pixel block from the current location due to motion. This information is used in
video compression to find best matching blocks in reference frame to calculate low
energy residue to generate temporally interpolated frames. [3] All of this is used to find
redundancies that can be exploited to reduce the file size. The compression process can
leave behind traces that can be seen on a CLA test.
In order to produce a CLA plot, the video needs to complete a few steps to
generate a proper reading. This can include frame averaging, which will create one
averaged image that contains all of the frames from the video. The image is then analyzed
using the Discrete Cosine Transform coefficients, which looks at the quantization values
of the image. [4] The recompression of the video (which is a lossy process) creates
periodicity in the DCT. The CLA examines the second derivative of the DCT coefficient.
The plots produced usually have a larger center spike with smaller spikes on each side.
Each new generation should produce smaller spikes to the left and right of the center
spike. [5]
When using the CLA test, the analyst cannot see what has changed, however, the
test can give you a good idea as to what has happened before it was received. This is
important information to determine the authenticity of the file or to possibly determine
which program was used to recompress the file.
1.2 Scope and Intent of Thesis
The purpose of this thesis is to analyze how the Compression Level Analysis can
be tied to a specific video editing/encoding software and YouTube. Every time a video is
recompressed, the editor or website will add artifacts that, in most cases, can be detected
upon visual inspection of the CLA plots. Recognizing those visual markers will help the
2


analyst be able to determine the video software that was used to recompress the video. In
addition to identifying the visual markers, this thesis examines the reliability of
determining the number of recompressions created from the original video with the same
software. This will help the examiner gain a better understanding of the data handling
before it reaches their desk.
This thesis will use a testing pool of 30 different video devices, which include
digital cameras, smartphones, and tablets. All of these cameras had the ability to record
digital videos. The video resolution was reset to the default setting before each test
recordings was created.
The next component of this test dealt with the different software and YouTube
that was utilized to recompress the test videos. It was decided to use a commercial video
editing software (Adobe Premiere Pro), three video transcoders including one
commercial program (Apple Quicktime Pro), two freeware programs (FFmpeg and
HandBrake), and finally YouTube. YouTube was included in this test because of the
documentation about the encoding process that is unique to the popular video-sharing
website. While each video program mentioned above has multiple output options that can
change the video container and video coding options, I decided to use the very popular
mp4 container and H.264 video codec across all of the programs. In most cases, this was
the default setting for the program.
In order to see the changes that occur from each generation of video
recompression, each video will recompress five times, which creates five generations
from the original video. This is an important test to help determine how many times the
video might have been altered before it was received by the examiner.
3


Finally, each camera was used to record two digital videos used for analysis. The
first video was used as the control to show CLA results directly from the device. The
second video was used to create the different generations in each of the software/websites
listed above. All of the created videos were then analyzed using a custom MATLAB
script designed to provide the CLA results.
4


CHAPTER II
TESTING PARAMETERS
2.1 Cameras/Smartphones/Tablets
With so many different digital cameras, smartphones, and tablets available today,
I decided it was important to try and generate a diverse testing group consisting of many
different makes and models of digital cameras. This is because one never knows what
kind of camera a criminal or an eyewitness to a crime would use. Therefore, the greater
the test group, the larger the database created from which to compare the results. I was
fortunate to have acquired a wide range of test cameras.
These cameras included older point and shoot cameras like the Olympus Stylus
710, which at the time of its release in February 2006 [6] only had the capability to record
low resolution videos. At the other end of the spectrum, I was able to gather videos from
a professional Blackmagic Pocket Cinema camera that had the ability to record HD RAW
videos. The rest of the cameras fell in-between these two cameras either as a professional,
pro-sumer, or consumer quality.
In addition to the digital cameras tested, I was also able to acquire test videos
from a variety of different smartphones and tablets. With the convenience of having a
camera on most mobile phones or tablets, the amount of potential video sources is
significantly increased. However, maintaining an updated database for mobile phone
images would prove challenging due to constant model updates and releases. In addition
to new mobile phone releases, the version of the software running on each device can
have an effect on the outcome of a CLA analysis.
5


The following tables break down the make and model of the mobile phone or
camera that was used for testing based upon the default resolution after reverting the
settings back to factory defaults.
Table 1: Cameras used with a resolution of 320x240
320x240
Make Model Release Date
Olympus Stylus 710 June 2003
Olympus Stylus 790SW February 2008
Olympus X-560WP September 2007
Sony DSC-S930 February 2009
Table 2: Cameras used with a resolution of 640x480
640x480
Make Model Release Date
Canon D10 May 2009
FujiFilm Z30 February 2009
Samsung BL103 Mid 2009
Sony DSC-W80 March 2007
Table 3 Video Camera with a resolution of 720x480
720X480
Make Model Release Date
JVC Everio GZ-MG630RU February 2009
The JVC video is one of three cameras in this test group that is a dedicated video
camera. This camera was relevant to testing, since unlike its older predecessors, it records
videos to an internal hard disk drive to store the media verses recording videos to a tape
on older cameras.
Cameras in the next two tables record digital videos in what is considered high
definition or HD. HD videos have better image quality when compared with the cameras
previously listed.
6


Table 4: Cameras with a resolution of 1280x720
1280x720
Make Model Release Date
Canon SD3500 April 2010
Samsung HZ50W May 2010
Table 5: Cameras with a resolution of 1920x1080
1920x1080
Make Model Release Date
Blackmagic Pocket Cinema* July 2013
Canon EOS 5D Mark II November 2008
Canon EOS 7D October 2009
Canon Rebel T3i February 2011
FujiFilm S9400W January 2014
GoPro Hero4 Silver* October 2014
Kodak Zi8 September 2009
Panasonic Lumix DMC TS5 March 2013
* These cameras are the other two cameras that are dedicated video cameras meaning
their primary function is to record videos verses taking pictures as well as recording
video.
The smartphones become more challenging to categorize for a few reasons. First,
if two different phones that are the same make and model have different versions of an
operating system, the CLA might produce different results. Secondly, two smartphones
that look identical will have different model numbers that are specific to the carrier they
are compatible with. The following tables will provide information about the different
smartphones and tablets that were used during testing.
Table 6: Smartphones/Tablets with a resolution of 1280x720
1280x720
Make Model Operating System Version Hardware Release Date/OS Release Date
Apple iPhone 4 MC608II/A 7.1.1 June 2010/April 2014
Apple iPhone 4 MD127LL/A 6.1.3 June 2010/March 2013
Apple iPod Touch MC544LL/A 6.1.3 September 2010/March 2013
7


Table7: Smartphones/Tablets with a resolution of 1920x1080
1920x1080
Make Model Operating System Version Release Date/OS Release Date
Apple iPad Mini MD533LL/A 8.4.1 November 2010/ August 2015
Apple iPhone 5 MD646LL/A 8.4.0 September 2012/ June 2015
Apple iPhone 6 Plus NGAU2LL/A 9.0 Beta September 2014/ July 2015
LG G2 LG-D801 4.4.4 September 2013/ June 2014
LG G3 LG-D850 5.0.1 May 2014/ December 2014
Samsung Galaxy Note 4 SM- N910T 5.0.1 October 2014/ December 2014
Samsung Galaxy S5 SM- G900A Unavailable April 2014/ Unavailable
Samsung Nexus 10 5.1.1 April 2015
2.2 Video Creation Parameters
In order to complete the CLA for this thesis, test videos needed to be created for
the research. In order to control some of the variables that can accompany video
recording, some steps were taken to minimize those variables. It was decided each video
would be approximately ten seconds in length. Since most cameras default to 30 frames
per second (a few defaulted to 24 frames per second and one had a default of 60 frames
per second) each video would have about 300 frames that would be averaged together.
Most people dont know the intricacies of manual settings on a digital camera; therefore,
all of the cameras were reset to factory default settings.
The second controlled parameter was the type of content to be recorded. As I was
not able to gather test videos from all the cameras at the same time, it was decided the
best video content would be a white wall. White walls are easy to find and they create
8


consistent content that can be easily recorded. However, there is another good reason
why white walls were most suitable for this test. Due to whites color profile, it will pass
through all of the primary colors of red, green, and blue in the color filter array of the
camera before reaching the image sensor.
In order to compare the results of each generation with the original video taken
from the camera, two 10-second videos were created with each camera. The first video
was left unchanged while the other video would be used as a starting point to create the
new video generations with the different software and uploaded/download from
YouTube. A CL A was performed on the original video to provide a baseline result for
each camera.
2.3 Method to Create Each New Video Generation
As mentioned earlier in the previous section, two videos were created; one to
provide a baseline for the CLA test and the other to create new videos. The process of
creating each new generation is fairly simple, however, it is time consuming. Most are a
one step process, but the videos recompressed using YouTube required an extra step.
To create each new generation, I started with the second recording from each
camera, as designated for this purpose. This video was loaded into the program. Then
without editing or altering the video, I immediately exported the video as a new file.
Special consideration was taken to ensure the resolution matched the original video; and
also, I made sure the program exported as an .mp4 file using the H.264 codec. Next, the
soon to be recompressed video was labeled and finally exported. The process was then
repeated with the newly created video to produce another recompressed generation. This
process was repeated five times for each program.
9


Since YouTube is a web-based video sharing site, a few extra steps were required
to create multiple recompressed generations. The video designated for recompression
from each camera was uploaded to YouTube using the file upload section of the
website. Unlike the other programs where the examiner is required to export the video
and chose the settings, YouTube automatically compressed the video upon upload. Once
uploaded to the site, a YouTube video downloader was used to download the videos. The
downloaded videos were labeled and saved for later analysis.
After the videos were downloaded and saved, they were re-uploaded to create a
new generation. Like before, the process was repeated to generate five recompressed
generations of the original video.
2.4 Software and YouTube Overview
While the cameras are vital to the success of this thesis, they are only one part of
the equation to complete the testing. The second and equally important part of the testing
was the different software and YouTube used to create the different generations of videos
from the cameras. The following outlines the different settings used for each program
when the examiner created each new generation.
2.5 Adobe Premiere Pro CC
Adobe Premiere Pro Creative Cloud 2015 is Adobes answer for video editing.
This program can hold its own against other popular video editing software and had no
problems handling the easy task of video recompression. Out of all the software I had
access to, this was the only true video editing software that was used. Since this program
has more editing features, there were also a lot of options that could be changed when
exporting. As mentioned earlier, careful consideration was taken to ensure the resolution
10


was identical to the original video, as well as setting the .mp4 container with the H.264
codec.
Source Output
Source Scaling: Scale To Fit
A 3m
* Export Setting*
Match Sequence Settings
Format: H.264
Preset. Match Source High bit rate
Comments:
Output Name: Canon-EOS~Rebei-T3i.mp4
/ Export Video / Export Audio
w Summary
Output:/Users/..Jkdobe/Premiere Pro/9.0/Canon-EOS-Rebel-T3l.mp4
1920x1080 (1.0), 29.97 fps, Progressive, 00:00:10 08
VBft, 1 pass, Target 10.00 Mbps, Max 12.00 Mbps
AAC, 320 kbps, 48 kHz, Stereo
Source: Sequence. Canon-EOS-Rbc(~T3i
1920x1080 (1.0). 29.97 fps, Progressive, 00:00 10 08
48000 Hz, Stereo
Source Range: Sequence In/Out
Effects Video Audio
w Basic Video Settings
Width- :
Height:
Frame Rate- . -j
Field Order r .
Aspect: '-a: i
TV Standard- "
Profile'
Level-
Use Maximum Render Quality
Use Frame Blending
Set Start Timecode
Estimated File Size. 12 M8
Metadata... Q
Multiplexer Captions
Match Source
Use Previews
Import Into project
Figure 1: Example of export settings for Adobe Premiere Pro CC
2.6 QuickTime Player 7 Pro
Created by Apple, QuickTime Player 7 Pro is an affordable solution for basic
video tasks. The advantage of this program over many of the others is its simplicity. This
program lets you record, convert videos, and perform basic edits, while exporting to
popular video standards.
11


MPEG-4 Export Settings
I
File Format: MP4
JB
Audio Streaming
Video Format: H.264
Data Rate: 256
Image Size: [ Current
Optimized for: Download

Preserve aspect ratio using:
Frame Rate: Current
Key Frame: ^ Automatic Q Every
Video Options...
Video:
Audio:
Streaming:
File Size:
Data Rate:
Conformance:
Compatibility:
H.264 Video. 1920 x 1080 (Current). 256 kbps, current frame rate
None
None
Approx. 320 KB
Total data rate 256 kbps, will stream over 364 kbps DSL/Cable
The file conforms to MP4 file format specification
?
Figure 2. Example of export settings used for QuickTime Player 7 Pro
2.7 HandBrake
HandBrake is a very popular freeware program that is used to convert videos from
a wide variety of formats to popular common video codecs. While HandBrake is easy to
use, it also has numerous advanced options that can be used when converting videos.
Below is an example of the settings used for this thesis.
m ^
Source Stan Add to Queue Show Queue
Source Canon-EOS-Rebel-T3I.MOV
Title: Canon-EOS-Reboi-T3l 1 OOhOOmlOs
Destination
File: /Volumes/Forenslos/ThesIs-Medla/Canon/EOS Rebel T3l/Canon-EOS-Rebei-T3i.mp4
Output Settings: Normal (Default)
Format; MP4 File________________0 Web optimized iPod 5G support
sai
Picture Settings Preview Window Activity Window Toggle Presets
Q Angle: 1 Q Chapters 0 j_0 through 1 0 Duration: 00:00:10
Video Codec; 1 H.264 (x264)_______
Framerate (FPS): Same as source_______0
O Variable Framerate
Constant Framerate
Audio Subtitles Chapters
0 Quality: 0 Constant Quality RF 20
Average Bitrate (kbps): 2500
Encoder Options
Preset: veryfast
Tune: non* Q Fast Decode
Profile: mam R Additional Options;
Level: 4.0 B
x264 Unparse: leveU4.0:ref= :8x8dc?-0:welghtp=1:subme^2:mme Picture Settings: Source: 1920x1080. Output: 1920x1080. Anamorphlc: 1920x1080 Loose, Modulus: 2. Crop: Auto 0/Q/0/0 Picture Filters:
No encode pending
Figure 3. HandBrake export settings
12


2.8 FFmpeg
FFmpeg is another freeware that requires the use of Command Prompt in
Windows or Terminal on an Apple machine. Since it is not a standalone program, this
was the most complicated converter used during the testing. Even though it might be
more complicated to operate, it provided an amazing amount of conversion and playback
options for both audio and video. In order to recompress the videos using this program, I
had to adapt a previously acquired script to run FFmpeg so as to provide the desired
results. The following FFmpeg command was used to convert the videos.
Table 8. FFmpeg recompression command________________________________________
ffrnpeg -i Input-File.MOV -vcodec libx264 Output.mp4
Breaking down the different components of the script include:
-i Input-File.mov = the directory and desired original file to be converted
-vcodec libx264 = this specifies the resulting video will use the H.264
codec
Output.mp4 = This is where the new video file is named and the output
files container is specified, which in this case is .mp4
# # iMac bash 80x5
Last login: Fri Oct 23 02:49:12 on ttys000
Patricks-iMac-5:~ iMac$ ffmpeg -i /Volumes/Forensics\ /Thesis-Media/Canon/EOS\ R
ebel\ T3i/Canon-E0S-Rebel-T3i.M0V -vcodec libx264 Canon-E0S-Rebel-T3i-ffmpeg-Gen
-l.m4a|
Figure 4. Example of full FFmpeg command
It should also be noted that FFmpeg is used as the core makeup or converter
engine in many different programs. According to the FFmpeg website, FFmpeg is
incorporated into programs or software including Google Chrome, HandBrake, and VLC,
just to name a few. Due to the wide use of FFmpeg, if the settings that use FFmpeg are
13


selected on a program such as HandBrake, the results from a CLA will be very similar, if
not the same, which makes determination of the specific program much harder.
2.9 YouTube
Unlike the programs that have been previously discussed in this section, YouTube
is the only one tested where one doesnt have control over the conversion settings. In
order for the user uploaded videos to have optimum playback online, the popular video
sharing site makes the tough decision about proper settings for all of us. An article by
Wiger van Houston and Zeno Geradts states, When the uploaded (natural) video content
has a resolution lower than the maximum resolution from YouTube, there is no change in
resolution. [7], In order for the video to playback on the website, every uploaded video
is encoded but the video will not be upsized to a larger resolution and will remain at its
maximum resolution.
Normally, when a forensic investigator is downloading a video, careful
consideration is given to the resolution of the video. The downloaded video should have
the same resolution as the original to avoid any recompression or encoding. However,
during Zac Giammarruscos research, he found, The video will always re-encode
regardless if the dimensions are identical upon upload and download. [8] This is
important to remember when analyzing a video from YouTube.
In order for YouTube to provide better streaming, it utilizes dynamic adaptive
streaming over HTTP (DASH). It works by letting the video playback with different bit
rates and resolutions, so there isnt any buffering. Since this is the protocol that YouTube
uses, a screen video recorder should not be used when trying to recover a video for
forensic analysis.
14


Downloading videos directly from YouTube isnt possible, so there are many
different freeware, command lines, and software that can be used to download a video.
While there are many different programs available, I chose to use MacX YouTube
Downloader. This is a freeware program created for Mac, which provides the ability to
download the videos. Once again, the research by Zac Giammarrusco shows MacX yields
the same results as YouTube Downloader by GreenTree Applications. This tool uses
FFmpeg licensed under the LGPL v3. [8] This illustrates the versatility and wide use of
FFmpeg in many different applications.
In order to download a video, the URL of the video needs to be copied and pasted
into the program. The program then provides the user with all of the available format
options for download. An example of the resolution and codecs available for download is
shown below in Figure 5.1 chose the highest resolution available for download, which
happened to be the same as the original resolution. Once the resolution is selected, the
user can choose the destination folder and download the video.
Video URL:
(I) Paste & Analyze
https://ww w. youtube.com/watch?v=fOZSbEFOHUM
Analyze
Resolution
0 1920x1080
1280x720
854x480
IO 640x360
H 426x240
1 256x144
lO 176x144
320x240
400x240
IO 640x360
Size
3.80 MB
1.56 MB
820.00 KB
403.53 KB
305.94 KB
137.91 KB
N/A
N/A
N/A
N/A
Codec
H.264
H.264
H.264
H.264
H.264
H.264
MPEG-4
MPEG-4
H.263
VPX
Format
mp4
mp4
mp4
mp4
mp4
mp4
3gp
3gp
flv
webm
Cancel
Figure 5. YouTube downloader resolution options
15


2.10 MATLAB
The third and final component to complete the data gathering for this thesis
required the use of MATLAB for the purpose of generating a CLA for each video created
with the 30 cameras. The custom script combined multiple functions, which included
reading.mp4 files and analysis of the RGB color layers. The results from this part of the
research provided a very useful charts and plots for analysis. Those include histograms
and CEPSTRUMs (which is a numerical value of the spectrum of the image.) All of this
information is combined to help provide a visual and numerical representation of the
CLA for each video.
16


CHAPTER III
RESULTS
3.1 Overview
Upon analyzing the data gathered from the experiments outlined in this thesis,
many different findings emerged. While I was able to draw conclusions on my original
questions, I was also able to report unexpected findings. When looking back through the
data, these additional findings helped to answer more questions and solidify answers to
the original questions. The next few sections will explain the results from the testing.
3.2 Original Video Comparison
In order to help validate the results below, CLA plots were generated for the two
original videos recorded with each camera. One would expect the CLA results of each
video to look very similar to each other, since they were recorded with the same camera,
same settings, and same scene.
As expected, the results from the original videos look almost identical. Since all
of the test videos were shot without the use of a tripod and many had natural lighting,
there were slight variations between the two. However, the subtle variations can be
expected and could be a result of camera shake or different angles when recording. The
following figures illustrate the similarities between the two original videos.
17


Apple-iPhone-5-1 -Original, CLCepstrum: 61 / 0.044492
Figure 6. Apple iPhone 5 Original Video 1
Apple-iPhone-5-1, CLCepstrum: 61 / 0.055223
Figure 7. Apple iPhone 5 Original Video 2
18


Figure 8. Panasonic Lumix DMC-TS5 Original Video 1
Panasonic-Lumix-DMC-TS5-Original, CLCepstrum: 125/0.012863
Figure 9. Panasonic Lumix DMC-TS5 Original Video 2
19


3.3 Video Resolution
Fortunately, for this test I was able to gather videos from cameras that had a wide
range of resolution extending from 320x240 to 1920x1080. This wide range helped to
illustrate a point when resolution starts to affect the results of the CLA.
My research found four cameras that recorded video at the 320x240 resolution
when returned to factory defaults. The camera would default to this resolution due to the
amount of space available on memory cards in the mid to late 2000s. While there were
larger memory cards available at that time, the price was very high. According to a press
release from the Consumer Electronics Show in January of 2007, Sony announced it
would be doubling its 4 GB memory card (released the prior year at CES) to 8 GB. The
press release stated 8 GB cards would sell for $300 at the time of release [9], Also,
according to Olympus archives, the largest available memory card for their Stylus
cameras was 2GB.
Table 9: Older camera information
Camera Specifications (Oldest to Newest)
Make Model Release Date
Olympus X-560WP June 2003
Olympus Stylus 710 February 2007
Olympus Stylus 790SW September 2007
Sony DSC-S930 February 2009
Since the amount of space was limited when these cameras were released, they
also used higher levels of compression when recording on the camera to save space on
the card. The figures below illustrate how the Sony DSC-S930 already begins with a high
compression level.
20


Sony-DSC-S930-Original, CLCepstrum: 188/49.937
0 50 100 150 200 250
CLCepstrum: 127/48.3524
CD
O
cr
E
E
to
O
CLCepstrum: 127/49.3692
index
Figure 10. Original CLA for the Sony DSC-S930 showing high starting compression
level
Once this video was run through the programs outlined in this thesis, the visuals
didnt change very much. The only way the examiner could tell if there was
recompression was by the corresponding numbers for each color and scale of the plot.
Sony-DSC-S930-ffmpeg-G1, CLCepstrum: 188/69.5244
0 50 100 150 200 250
CLCepstrum: 188/66.6262
0 50 100 150 200 250
CLCepstrum: 188/69.3052
index
Figure 11. CLA results from FFmpeg Generation 1
21


cr
E
O
E
CQ
E
2
O
CD
0
Sony-DSC-S930-HandBrake-G1, CLCepstrum: 188/45.8946
CLCepstrum: 188/45.1889
index
Figure 12. CLA results from HandBrake Generation 1
Figure 12 illustrates the change in the scale from the original plot to to the
HandBrake Generation 1. This would tell the examiner there was recompression, but only
if the examiner could compare it with an original video from the same device.
QC
<3
E
Q.
(L>
O
CD
E
Sony-DSC-S930-Premiere-G1, CLCepstrum: 188/46.7656
0 50 100 150 200 250
CLCepstrum: 188/46.224
40
20
0
-20
-40
..ji 'i
;lti ( )
inflow*


"IS r|-f'li
CLCepstrum: 188/45.3857
CLCepstrum: 188/46.1245
0 50 100 150 200 250
index
Figure 13. CLA results from Adobe Premiere CC 2015 Generation 1
22


Sony-DSC-S930-QuickTime-G1, CLCepstrum: 188/59.4275
O
E
CLCepstrum: 188/59.2218
CD
O
QC
E
CLCepstrum: 188/58.6896
index
Figure 14. CLA results from QuickTime Player 7 Pro Generation 1
O
£
CD
E
40
20
0
-20
-40
40
20
0
-20
-40
0 50 100 150 200 250
40
20
0
-20
-40
40
20
0
-20
-40
0 50 100 150 200 250
index
CLCepstrum: 188/44.183
Sony-DSC-S930-YouTube-G1, CLCepstrum: 188/46.372
-jjiuy
50 100 150 CLCepstrum: 188/46.4272 200 250
- r I IjiM,'', ',i: 0 fl'jf
Figure 15. CLA results from YouTube Generation 1
As demonstrated in the previous figures, the CLA test on a video with a resolution
of 320x240 will not provide much useful information for the analyst. However, better
23


results can be more prevalent with videos that have a resolution of 640x480 or higher, as
shown in Figure 16 and 17.
Sony-DSC-W80-Original, CLCepstrum: 61 / 0.16016
0 50 100 150 200 250
CLCepstrum: 61 / 0.070892
index
Figure 16. CLA from Sony-DSC-W80 with a resolution of 640x480
Sony-DSC-W80-ffmpeg-G1, CLCepstrum: 61 / 0.057555
CLCepstrum: 189/0.010047
Figure 17. CLA results from FFmpeg
24


As one can perceive in the previous two charts, there is a clear difference between
the original and FFmpeg Generation 1 showing recompression.
3.4 More Change in Green and Blue Levels
Another interesting finding from the testing is more change in the green and blue
levels as opposed to the red. The change in green is easy to explain. Fluman eyes are
more sensitive to the color green when compared to red and blue. Consequently, camera
manufactures try to mimic how the human eye sees color with color filter arrays. The
most popular CFA is the Bayer Array. The design of this array is laid out in a grid
pattern, which consists of red, green, and blue filters. To mimic the ability of the human
eye to see green, there are twice as many green filters as opposed to red and blue filters.
Figure 18. Example of a Bayer CFA [10]
Most of the results from recording a white wall included stronger green and blue
levels. This can lead to a great change in those colors during the CLA tests. The
following figures are the best examples of change in either the green or blue analysis.
25


JVC-Everio-GZ-Original, CLCepstrum: 61 / 0.03926
0 50 100 150 200 250
x -jo3 CLCepstrum: 61 / 0.02049
Figure 19. CLA of original video from JVC Everio
JVC-Everio-GZ-ffmpeg-G1, CLCepstrum: 61 / 0.10695

0 50 100 150 CLCepstrum: 189/0.01471 200 250
i i t t i I
0 50 100 150 CLCepstrum: 61 / 0.21597 200 250
! < prr:;:r:
0 50 100 150 CLCepstrum: 61 / 0.11076 200 250
- p - '

cc 0.1
I 0.05
& 0.01
| 0
-0.01
-0.02
co o.2
£
.fc 0.1
o
0
co
g 0.1
| 0.05
a. 0
<1>
o
50
100
150
200
250
Figure 20. CLA after first recompression
When viewing the two charts above, one can see a noticeable difference in the red
and green layers. However, when considering the peak value numbers and location for
those color layers, there is minimal change. While the analysis number for the green layer
26


might seem small as well, the location of the central spike and the scale between the two
are vastly different. Further analysis on the changes in the green and blue layers will be
discussed later in this section.
3.5 Differences Between Generations
Since it is well known in the industry that video compression works to reduce
redundancies in the video data for the purpose of reducing overall file size, the CLA
script used in MATLAB is able to show the original file with a central spike and some
smaller spikes to the left and right. With each subsequent generation, the compression
level should show an increase after the initial conversion. Figures 21 and 22 illustrate the
difference between HandBrake Generation 1 and 2 from the Panasonic Lumia DMC-TS5.
Figure 21. Handbrake Generation 1
27


r-(o'3 Panasonic-Lumix-DMC-TS5-QuickTime-G2, CLCepstrum: 29/0.010844
100 150
CLCepstrum: 29/0.017387
Figure 22. HandBrake Generation 2
As you can see, there is an increase in the maximum point for each color layer
between the first and second generation. There is even a noticeable difference between
generation 2 and 3.
Panasonic-Lumix-DMC-TS5-HandBrake-G3, CLCepstrum: 61 / 0.0039537
Figure 23. HandBrake Generation 3
28


The generations beyond generation 3 start to yield poor results. Some of the color
layers in generation 4 and 5 began to stabilize out, while others had odd jumps where the
peak value changed significantly. However, these types of results did not occur
consistently with all 30 cameras.
For example, the Apple iPhone 5 had increases in the maximum peak value
between the first three generations on the red and blue layer, while the green layer
decreased then increased.
Apple-iPhone-5-1-ffmpeg-G1, CLCepstrum: 61 /0.058445
Figure 24. Apple iPhone 5 Generation 1
29


Apple-iPhone-5-1-ffmpeg-G2, CLCepstrum: 61 / 0.065796
Figure 25. Apple iPhone 5 Generation 2
Apple-iPhone-5-1-ffmpeg-G2, CLCepstrum: 61 /0.065796
Figure 26. Apple iPhone Generation 3
30


While the difference between the different generations may not always be clear,
there is a clear difference between the original file and every generation 1 recompressed
video. The only exception was the cameras with a lower resolution, as discussed earlier in
this chapter.
LG-G2-0riginal, CLCepstrum: 13/0.00053674
CLCepstrum: 13/0.00042833
Figure 27. LG G2 Original CLA
31


LG-G2-ffmpeg-G1, CLCepstrum: 29/0.027086
Figure 28. LG G2 FFmpeg Generation 1
LG-G2-HandBrake-G1, CLCepstrum: 93/0.020881
Figure 29. LG G2 Hand Brake Generation 1 CLA
32


LG-G2-Premiere-G1, CLCepstrum: 13/0.0127
CLCepstrum: 13/0.0098475
Table 30. LG G2 Premiere Generation 1 CLA
LG-G2-QuickTime-G1, CLCepstrum: 125/0.025463
CLCepstrum: 125/0.017727
Table 31. LG G2 QuickTime Player 7 Pro Generation 1 CLA
33


LG-G2-YouTube-G1. CLCepstrum: 61 / 0.045885
Table 32. LG G2 YouTube Generation 1 CLA
The initial difference between the original and the first generation of each
program and YouTube is seen on almost all of the cameras, smartphones, and tablets used
during this test.
3.6 Visual Cues to Determine Software Used Overview
One of the primary questions tested was the determination of any visual cues that
could lead a forensic examiner to determine the program used to recompress the video.
While these different visual cues may be subtle due to the content of the video, original
compression from the camera, and/or recompression generation, a pattern began to
emerge that linked the CLA charts to the program.
34


3.7 Visual Cues for FFmpeg
While analyzing the data repeatedly, FFmpeg always stood out as the most
uniform CLA with each subsequent generation created. At first, I didnt notice this
uniformity but soon discovered this was the unique trait for FFmpeg.
With almost every video, FFmpeg would result in a CLA chart with noteworthy
narrow peaks or valleys. Further, the content between the narrow peaks or valleys nearly
flattens itself along the 0 line of the plot. These next few examples show the characters of
a video that was recompressed with FFmpeg.
It is important to point out the camera used for the CLA in Figure 33 is one of the
cameras with a lower resolution of 640x480. Even though the original CLA plot has more
movement to a lesser extent than what was seen in section 3.2, FFmpeg still transformed
it to its familiar characteristics.
Canon-PowerShot-D10-ffmpeg-G2, CLCepstrum: 61 / 0.089419
cn
E
0.08
0.06
0.04
0.02
0
-0.02
0 50 100 150 200 250
CLCepstrum: 29/0.011824
0 50 100 150 200 250
CLCepstrum: 29 / 0.053609
Figure 33. Canon DIO FFmpeg CLA
35


Samsung-Galaxy-Note-4-ffmpeg-G2, CLCepstrum: 61 / 0.052319
CLCepstrum: 61 / 0.048964
Figure 34. Samsung Galaxy Note 4 FFmpeg CLA
Kodak-Zi8-ffmpeg-G1, CLCepstrum: 61 / 0.029604
Figure 35. Kodak Zi8 FFmpeg CLA
36


3.8 Visual Cues for QuickTime Player 7 Pro
Unlike the narrow peaks and valleys created with FFmpeg, the characteristics of
QuickTime Player 7 are quite different. In fact, they are the opposite. QuickTime seems
to generate wider peaks and valleys. Additionally, the data between the peaks and valleys
creates an almost wavy shape by rolling positively and negatively off of the 0 line. These
visual cues help to identify QuickTime Player and the software used in these next few
examples.
Canon-EOS-5D-Mark-ll-QuickTlme-G2, CLCepstrum: 61 / 0.0012663
Figure 36. Canon EOS 5D Mark II QuickTime Player CLA
At this point, it is important to note the visual artifacts generated from QuickTime
Player became more noticeable with each generation. This means generation 2 will show
more of these traits when compared to generation 1.
37


Samsung-HZ50W-Original, CLCepstrum: 61 / 0.031574
or
£
0
50 100 150 200 250
CLCepstrum: 29 / 0.006729
Figure 37. Samsung HZ50W QuickTime Player 7 Pro CLA
GoPro-Hero4-Silver-QuickTime-G2, CLCepstrum: 1 / 0.0024317
Figure 38. GoPro Hero4 Silver QuickTime Player 7 Pro CLA
The QuickTime CLA for GoPro exhibited the most extreme example of these
characteristics. Since it was so extreme, the CLA results from the other programs were
38


checked to see if the original compression could have caused this type of shape across the
board. By analyzing the other CLA results, I was able to determine the original
compression did not create this type of extreme shaping.
3.9 Visual Cues for HandBrake
The visual cues for HandBrake were a little more difficult to decipher. I finally
determined this was a result of the programs effect on two of the three color levels and
not three as in the previous programs. After analyzing the CLA plots from the videos,
there was a pattern that started to emerge. HandBrake generated more drastic changes in
the blue and more dominate green color layers. In order to really notice these changes, an
examiner needs look at the scale of the plots, as well as the shape of the plot. In most
cases, the scale and shape for the red color layer stayed almost identical to the original
video, while the green and blue layers had extreme changes.
x 10
Samsung-Nexus-10-HandBrake-G1, CLCepstrum: 93/0.010576
CLCepstrum: 93/0.012964
Figure 39. Samsung Nexus 10 HandBrake CLA
39


Panasonic-Lumix-DMC-TS5-HandBrake-G1, CLCepstrum: 93/0.012746
Figure 40. Panasonic Lumix DMC-TS5 HandBrake CLA
Canon-EOS-7D-HandBrake-G1, CLCepstrum: 125/0.033711
m
C5
01
O
CLCepstrum: 125/0.041905
.1 . -:1 :: :~r:: : : . I l
50 100 150 200 250
index
Figure 41. Canon EOS 7D HandBrake CLA
40


3.10 Visual Cues for YouTube and Adobe Premiere
While the visual cues for the other programs began to stand out after looking at the
data, I had issues with the cues for YouTube and Premiere. When comparing the CL A
from the original image and the results from these programs, there are noteworthy
differences. However, there is nothing consistent about the shape, reduction, or gain of
the peak values for each color level.
Like the other programs, I would imagine with further research and analysis,
traces and patterns would start to emerge, which could be used as identifiers for the use
of YouTube or Adobe Premiere.
41


CHAPTER IV
CONCLUSION
Overall, there are many positive and interesting conclusions that can be derived as
a result of this research. The results reiterate the understanding that Compression Level
Analysis is a positive method for identifying video compression. When comparing the
CLA results from the original video to the results from all of the recompressed videos,
the visual differences between the CLA plots are easily identifiable. When comparing the
first three generations from any of the programs used, there are clear indications showing
the recompressions of the video. However, the results from generation 4 and generation 5
start to yield inaccurate results due to the high levels of compression.
It was interesting to discover how much the resolution of the original video
affects the CLA results. For the most part, any analysis at a resolution of 320x240 would
be undesirable to draw a conclusion. Next, the ability to tie specific visual cues to most of
the programs creates an advantage for the examiner. This will save time during the
analysis phase and help produce detailed information. It was unfortunate conclusions
could not be drawn for YouTube and Adobe Premiere, but with further research and
analysis, perhaps a conclusion will be determined.
While Compression Level Analysis may still not be useful as a sole method for
forensic video authentication, its results when combined with other authentication
methods can help the examiner draw a scientifically valid conclusion. Finally, the
original test videos will help add to the database of videos and images that can be used as
references during forensic examinations.
42


REFERENCES
1. Boren, Zachary D. "There are officially more mobile devices than people in the
world." Independent. N.p., 7 Oct. 2014. Web. 19 Oct. 2015.
2. Nagpal, Pooja, and Seema Baghla. "Video Compression by Memetic Algorithm."
Internation Journal of Advanced Computer Science and Applications 2.6 (2011): 142-
45. Web. 2015.
3. Murali E. Krishnan, E. Gangadharan and Nirmal P. Kumar. H.264 Motion Estimation
and Applications, Video Compression, Dr. Amal Punchihewa (Ed.), Video
Compression 23 Mar. 2012. Web. 2015
4. Popescu, Alin C., and Hany Farid. "Statistical Tools for Digital Forensics."
Darthmouth.edu. Dartmouth College, 2005. Web. 22 Oct. 2015.
5. Ng, Nicholas Kian-Seng. "Cell Phone Images in Social Media: An Analysis of
Cellphone Image Structure Before and After Social Media Compression." Thesis.
2014. National Center for Media Forensics. University of Colorado Denver, 2014.
Web. 17 Nov. 2015.
6. "Olympus Announces New Stylus 710: Sleek Design, Superior Performance and All-
Weather Durability." Olympus. N.p., Jan. 2006. Web. 21 Oct. 2015.
7. Van Houten, Wiger, and Geradts, Zeno. Using Sensor Noise to Identify Low
Resolution Compressed Videos from YouTube. International Workshop on
Computational Forensics (2009): 104-115
8. Giammarrusco, Zachary Paul. "Source Identification of High Definition Videos: A
Forensic Analysis of Downloaders and YouTube Video Compression Using a Group
of Action Cameras." Thesis. 2014. National Center for Media Forensics. University
of Colorado Denver, 2014. Web. 17 Nov. 2015.
9. "Sony Memory Stick Duo 8 GB." Digital Photography Review. N.p., 8 Jan. 2007.
Web. 21 Oct. 2015.
10. Lukac, Rastislav, and Konstantinos N. Plataniotis. "Color Filter Arrays: Design and
Performance Analysis." IEEE Transactions on Consumer Electronics 51.4 (2005):
1260-67. Web. 21 Oct. 2015.
11. Grigoras, Catalin, and Jeff Smith. "Digital Imaging: Enhancement and
Authentication." Encyclopedia of Forensic Sciences (Second Edition) (2013): 303-14.
Skyline. Web. 17 Nov. 2015.
12. Michalos, M G., S P. Kessanidis, and S L. Nalmpantis. "Dynamic Adaptive
Streaming over HTTP." Journal of Engineering Science and Technology Review 5.2
(2012): 30-34. Web. 17 Nov. 2015.
43


Full Text

PAGE 1

! COMPRESSION LEVEL ANALYSIS: EXAMI NING VIDEO RECOMPRESSION LEVELS FOR FORENSIC EXAMINATION by PATRICK MICHAEL BADGLEY B.S, Uni versity of Colorado Denver, 2013 A thesis submitted to the Faculty of the Graduate School of the University of Colorado in partial fulfillment of the requirements for the degree of Master of Science Recording Arts 2015

PAGE 2

! "" ! 2015 PATRICK MICHAEL BADGLEY ALL RIGHTS RESERVED

PAGE 3

""" This thesis for the Master of Science degree by Patrick Michael Badgley has been approved for the Recording Arts Program by Catalin Grigoras Chair Jeff Smith Pete Buchwald November 19, 2015

PAGE 4

"# Badgley, Patrick Michael (M.S., Recording Arts) Compression Level Analysis: Examining Video Compression Levels from Commercial Software Thesis directed by Dr. Catalin Grigoras ABSTRACT With more digital devices such as cameras, smartphones, and tablets currently in use than there are humans in the world forensic analysis of videos is here to stay While there are many tools available to forensic examiners to determine the authenticity of a video this document focuses on the Compression Level A nalysis of videos recorded on different digital cameras T his study will examine videos recorded on 30 different devices including digital cameras, smartphones, and tablets The acquired test videos were recompressed using multipl e programs including Adobe Premiere Pro, HandBrake, FFmpeg, QuickTime Player 7 Pro, as well as YouTube. The recompressed videos were processed with MATLAB to generate data showing the Compression Lev el Analysis. The data will provide the differences betwee n recompression generations from each program. Also, this data will discover visual cues left behind d uring the recompression process, which were created by the programs used The form and content of this abstract are approved. I recommend its publicatio n. Approved: Catalin Grigoras

PAGE 5

# ACKNOWLEDGEMENTS I would like to thank my professors Catalin Grigoras and Jeff Smith for the assistance with this thesis and the ir outstanding instruction throughout the graduate program. Also, I would also like to thank my parents and grandparents for all of the ir encouragement and help, both mentally and financially during my entire college caree r I would not be where I am today without the love and support you have afforded to me. Finally, I would like to thank my lo ving wife who has also provided me with her love and support over the last few years. You helped me stay motivated when I needed it the most I'm exci ted to see where we go from here!

PAGE 6

#" TABLE OF CONTENTS CHAPTER I: INTRODUCTION 1.1 Background .. .. 1 1.2 Scope and Intent of Thesis...... ... 2 II: TESTING PARAMETERS 2.1 Cameras/Smartpho nes/Tablets... 5 2.2 Video Creatio n Parameters............ 8 2.3 Method to Create Each New Video Generation9 2.4 Software and You Tube Overview... 10 2.5 Adobe Premi ere Pro CC.. 11 2.6 QuickTime Player 7 Pro..11 2.7 HandBrake...12 2.8 FFm peg 13 2.9 YouTu be..14 2.10 MAT LAB..16 III: RESULTS 3.1 Overvi ew..17 3.2 Original Video Comparison .17 3.3 Video Reso lution . 20 3.4 More Change in Green a nd Blue Levels..25 3.5 Differences Betwee n Generations27

PAGE 7

#"" 3.6 Visual Cues to Determine Soft ware Used Overview...34 3.7 Visual Cues fo r FFmpeg..35 3.8 Visual Cues for QuickT ime Player 7 Pro .... 37 3.9 Visual Cues for HandBrake.39 3.10 Visual Cues for YouTube and Adobe Premiere.. ..41 IV: CONCLUSION .......42 REFERENCES ..43

PAGE 8

#""" LIST OF TABLES Table 1. Cameras used with a resolution of 320x2406 2. Cameras used with a resol ution of 640x480.... 6 3. Video Camera with a resol ution of 720x480... 6 4. Cameras used with a resolution of 1280x720..7 5. Cameras used with a resolu tio n of 1920x1080.... 7 6. Smartphones/Tablets with a resolution of 1280x720 .. 7 7. Smartphones/Tablets with a resolution of 1920x10808 8. FFmpeg recompression command 13 9. Older camera information .......... .... 20

PAGE 9

"$ LIST OF FIGURES Figure 1. Example of export settings for Adobe Premiere Pro CC . ..11 2. Example of export settings used for QuickTime Player 7 Pro...1 2 3. HandBrake export settings.12 4. Example of full FFmpeg command13 5. MacX YouTube downloader resolution options. ...1 5 6. Apple iPhone 5 Original Video 1...18 7. Apple iPhone 5 Original Video 2...18 8. Panasonic Lumix DMC TS5 Original Video 1..19 9. Panasonic Lumix DMC TS5 Original Video 2..19 10. Original CLA for the Sony DSC S930... 21 11. CLA results from FFmpeg Generation 1 21 12. CLA results from HandBrake Generation 1... 22 13. CLA results from Adobe Premiere CC 2015 Generation 1 22 14. CLA results from QuickTime Player 7 Pro Generation 1.. 23 15. CLA results from YouTube Generation 1 .. 23 16. CLA from Sony DSC W80 24 17. CLA results from FFmpeg.2 4 18. Example of a Bay er CFA...25 19. CLA of original video from JVC Everio2 6 20. CLA after first recompression 2 6

PAGE 10

$ 21. HandBrake Generation 12 7 22. HandBrake Generation 22 8 23. HandBrake Generation 32 8 24. Apple iPhone 5 Generation 1.2 9 25. Apple iPhone 5 Generation 2. 30 26. Apple iPhone 5 Generation 3. 30 27. LG G2 Original CLA . 31 28. LG G2 FFmpeg Ge neration 1.... 32 29. LG G2 HandBrake Generation 1 32 30. LG G2 Premiere Generation 1 CLA... 33 31. LG G2 QuickTime Player 7 Pro Generation 1 CLA.. 33 32. LG G2 YouTube Generation 1 CLA.. 34 33. Canon D10 FFmpeg CLA ..35 34. Samsung Galaxy Note 4 FFmpeg CLA. 36 35. Kodak Zi8 FFmpe g CLA... 36 36. Canon EOS 5D Mark II Quick Time Player CLA..37 37. Samsung HZ50W QuickTime P layer 7 Pro CLA..38 38. GoPro Hero4 Silver QuickTime P layer 7 Pro CLA...38 39. Samsung Nexus 10 Ha ndBrake CLA .39 40. Panasonic Lumix DMC TS5 HandBrake CLA..40 41. Canon EOS 7D HandB rake CLA...40

PAGE 11

% CHAPTER I INTRODUCTION 1.1 Background With the rise in popularity of digital cameras in the early 2000s and the addition of cameras on mobile phones, the use and availability of videos to record daily events is continuing to grow. According to an art icle published in late 2014 by T he Independent, "T he number of active mobile devices and human beings crossed over som ewhere around the 7.19 billion mark." [1] This means there are more active devices than humans With the ever increasing number of digital devices, it s safe to say s ome videos will be recorded, which contain crimes or subject matter that can be used in a court of law. In order for these videos to be admitted into evidence, an analysis sometimes need s to be conducted to determine authenticity of the recording. One method used to evaluate authenticity is the Compression Level Analysis or CLA. When a video is an original or was provided directly from the source, the CLA produces little or no signs of recompression depending on the device Recompression occurs when a video is loaded into a video editing software or uploaded to YouTube and resaved or downloaded. In order to fully understand how CLA work s, it is important to note how video compression works. Popular video codecs such as H.264 MPEG 2 and MPEG 4 use motion estimation to compress a file. "Motion Estimation (ME) an d compensation techniques, which can eliminate temporal redundancy between adjacent frames effectively." [2] This is accomplished when information is extracted to beco me represented by a motion vect or. "The motion vector indicates the displacement of a pixel

PAGE 12

& or a pixel block from the current location due to motion. This information is used in video compression to find best matching blocks in reference frame to calculate low energy residue to generate temporally interpolated frames." [3] All of this is used to find redundancies that can be exploited to reduce the file size. The compression process can leave behind traces that can be seen on a CLA test. In order to produc e a CLA plot the video needs to complete a few steps to generate a proper reading. This can include frame averaging which will create one averaged image that contains all of the frames from the video. The image is then analyzed using the Discrete Cosine Transform coefficients which looks at the quantization values of the image [4] T he recompression of the video (which is a lossy process) creates periodic ity in the DCT. The CLA examines the second derivat ive of the DCT coefficient. The plots produce d usually have a larger center spike with smaller spikes on each side. Each new generation should produce smaller spikes to the left and right of the center spike. [5] When using the CLA test the analyst cannot see what has changed, however, the test can g ive you a good idea as to what has happened before it was received This is important information to determine the authenticity of the file or to possibly determine which program was used to recompress the file. 1.2 Scope and Intent of Thesis The purpose o f this thesis is to analyze how the Compres sion Level Analysis can be tied to a specific video editing/encoding software and YouTube. Every time a video is recompressed, the editor or website will add artifacts that, in most cases, can be detected upon vis ual inspection of the CLA plot s. Recognizing those visual markers will help the

PAGE 13

' analyst be able to determine the video software that w as used to recompress the video In addition to identifying the visual markers, this thesis examines the reliability of determining the number of recompressions created from the original video with the same software. This will help the examiner gain a better understanding of the data ha ndling before it reaches their desk. This thesis will use a testing pool of 30 different video devices, which include digital cameras, smartphones, and tablets. All of these cameras had the ability to record digital videos. The video resolution was reset to the default setting before each test recordings was created. The next component of this test dealt with the different software and YouTube that was utiliz ed to recompress the test videos. I t was decided to use a commercial video editing software (Adobe Premiere Pro), three video transcoders including one commercial program (Apple Quicktime Pro), two freeware programs (FFmpeg and HandBrake), and finally YouTube. YouTube was included in this test because of the documentation about the encoding process tha t is unique to the popular video sharing website. While each video program mentioned above has multiple output options that can change the video container and video coding options, I decided to use the very popular .mp4 container and H.264 video codec acro ss all of the programs. In most cases, this was the default setting for the program In order to see the changes that occur from each generation of video recompression, each video will recompress five times, which creates five generations from the original video. This is an important test to help determine how many times the video might have been altered before it was received by the examiner.

PAGE 14

( Finally, each camera was used to record two digital videos used for analysis. The first video was used as the cont rol to show CLA results directly from the device. The second video was used to create the different generations in each of the software/websites listed above. All of the created videos were then analyzed using a custom MATLAB scrip t designed to provide the CLA results.

PAGE 15

) CHAPTER II TESTING PARAMETERS 2.1 Cameras /Smartphones/Tablets With so many different digital cameras, smartphones, and tablets available today, I decided it was important to try and generate a diverse testing group consisting of many different makes and models of digital cameras. This is because one never knows what kind of camera a criminal or an eyewitness to a crime would use. Therefore, the greater the test group, the larger the database created from which to com pare the results. I was fortunate to have acquire d a wide range of test cameras. These cameras included older point and shoot cameras like the Olympus Stylus 710, which at the time of its release in February 2006 [6 ] only had the capability to record low resolution videos. At the other end of the spectrum, I was able to gather videos from a professional Blackmagic Pocket Cinema camera that had the ability to record HD RAW videos. The rest of the cameras fell in between these two cameras either as a profess ional, "pro sumer", or consumer quality. In addition to the digital cameras tested, I was also able to acquire test videos from a variety of different smartphones and tablets. With the convenience of having a camera on most mobile phones or tablets, the a mount of potential video sources is significantly increased. However, maintaining an updated database for mobile phone images would prove challenging due to constant model updates and releases. In addition to new mobile phone releases, the version of the s oftware running on each device can have an effect on the outcome of a CLA analysis.

PAGE 16

* The following tables break down the make and model of the mobile phone or camera that was used for testing based upon the default resolution after reverting the settings b ack to factory defaults. Table 1: Cameras used with a resolution of 320x240 320x240 Make Model Release Date Olympus Stylus 710 June 2003 Olympus Stylus 790SW February 2008 Olympus X 560WP September 2007 Sony DSC S930 Feb ru ary 2009 Table 2: Cameras used with a resolution of 640x480 640x480 Make Model Release Date Canon D10 May 2009 FujiFilm Z30 February 2009 Samsung BL103 Mid 2009 Sony DSC W80 March 2007 Table 3 Video Camera with a resolution of 720x480 720X480 Make Model Release Date JVC Everio GZ MG630RU February 2009 The JVC video is one of three cameras in this test group that is a dedicated video camera. This camera was relevant to testing since unlike its older predecessors, it records videos to an internal hard disk drive to store the media verses recording videos to a tape on older cameras. Cameras in the next two tables record digital videos in what is considered high definition or H D. HD videos have better image quality when compared with the cameras previously listed.

PAGE 17

+ Table 4: Cameras with a resolution of 1280x720 1280x720 Make Model Release Date Canon SD3 500 April 2010 Samsung HZ50W May 2010 Table 5: Cameras with a resolution of 1920x1080 1920x1080 Make Model Release Date Blackmagic Pocket Cinema* July 2013 Canon EOS 5D Mark II November 2008 Canon EOS 7D October 2009 Canon Rebel T3i February 2011 FujiFilm S9400W January 2014 GoPro Hero4 Silver* October 2014 Kodak Zi8 September 2009 Panasonic Lumix DMC TS5 March 2013 These cameras are the other two cameras that are dedicated video cameras meaning their primary function is to record videos verses taking pictures as well as recording video. The smartphones become more challenging to categorize for a few reasons. First, if two different phones that are the same make and model have different versions of an operating system, the CLA might produce different results. Secondly, two smartphones that look identical will have different model numbers that are specific to the carrier they are compatible with. The following tables will provide information about the different smartphones and tablets that were used during testing. Table 6: Smartphones/Tablets with a resolution of 1280x720 1280x720 Make Model Operating System Version Hardware Release Date/OS Release Date Apple iPhone 4 MC608II/A 7.1.1 June 2010/April 2014 Apple iPhone 4 MD127LL/A 6.1.3 June 2010/March 2013 Apple iPod Touch MC544LL/A 6.1.3 September 2010/March 2013

PAGE 18

, Table7: Smartphones/Tablets with a resolution of 1920x1080 1920x1080 Make Model Operating System Version Release Date/OS Release Date Apple iPad Mini MD533LL/A 8.4.1 November 2010/ August 2015 Apple iPhone 5 MD646LL/A 8.4.0 September 2012/ June 2015 Apple iPhone 6 Plus NGAU2LL/A 9.0 Beta September 2014/ July 2015 LG G2 LG D801 4.4.4 September 2013/ June 2014 LG G3 LG D850 5.0.1 May 2014/ December 2014 Samsung Galaxy Note 4 SM N910T 5.0.1 October 2014/ December 2014 Samsung Galaxy S5 SM G900A Unavailable April 2014/ Unavailable Samsung Nexus 10 5.1.1 April 2015 2.2 Video Creation Parameters In order to complete the CLA for this thesis, test videos needed to be created for the research. In order to control some of the variables that can accompany video recording, some steps were taken to minimize those variables. It was decided each video would be approximately ten seconds in length. Since most cameras default to 30 frames per second (a few defaulted to 24 frames p er second and one had a default of 60 frames per second) each video would have about 300 frames that wou ld be averaged together. M ost people don't know the intricacies of manual settings on a digital camera; therefore, all of the cameras were reset to fact ory default settings. The second controlled parameter was the type of content to be recorded. As I was not able to gather test videos from all the cameras at the same time, it was decided the best video content would be a white wall. White walls are easy to find and they create

PAGE 19

! consistent content that can be easily recorded. However, there is another good reason why white walls were most suitable for this test. Due to white's color profile, it will pass through all of the primary colors of red, green, and blue in the color filter array of the camera before reaching the image sensor. In order to compare the results of each generation with the original video taken from the camera, two 10 second videos were created with each camera. The first video was left unchanged while the other video would be used as a starting point to create the new video generations with the different software and uploaded/download from YouTube. A CLA was performed on the original video to provide a baseline result for each camera. 2 .3 Method to Create Each New Video Generation As mentioned earlier in the previous section, two videos were created; one to provide a baseline for the CLA test and the other to create new videos. The process of creating each new generation is fairly simpl e, however, it is time consuming. Most are a one step process, but the videos recompressed using YouTube required an extra step. To create each new generation, I started with the second recording from each camera, as designated for this purpose. This video was loaded into the program. Then without editing or altering the video, I immediately exported the video as a new file. Special consideration was taken to ensure the resolution matched the original video; and also, I made sure the program exported as an .mp4 file using the H.264 codec. Next, the soon to be recompressed video was labeled and finally exported. The process was then r epeated with the newly created video to produce another recompressed generation. This process was repeated five times for each program.

PAGE 20

%. Since YouTube is a web based video sharing site, a few extra steps were required to create multiple recompressed gener ations. The video designated for recompression from each camera was uploaded to YouTube using the file "upload" section of the website. Unlike the other programs where the examiner is required to expo rt the video and chose the settings, YouTube automatical ly compressed the video upon upload. Once uploaded to the site, a YouTube video downloader was used to download the videos. The downloaded videos were labeled and saved for later analysis. After the videos were downloaded and saved, they were re uploaded to create a new generation. Like before, the process was repeated to generate five recompressed generations of the original video. 2.4 Software and YouTube Overview While the cameras are vital to the success of this thesis, they are only one part of the equation to complete the testing. The second and equally important part of the testing was the different software and YouTube used to create the different generations of videos from the cameras. The following outlines the different settings used for ea ch program when the examiner cr eated each new generation. 2.5 Adobe Premiere Pro CC Adobe Premiere Pro Creative Cloud 2015 is Adobe's answer for video editing. This program can hold its own against other popular video editing software and had no problems handling the easy task of vid eo recompression. Out of all the software I had access to, this was the only true video editing software that was used. Since this program has more editing features, there were also a lot of options that could be changed when exporting. As mentioned earlier, careful consideration was taken to ensure the resolution

PAGE 21

%% was identical to the original video as well as setting the .mp4 container with the H.264 codec. Figure 1: Example of export settings for Adobe Premiere Pro CC 2.6 QuickTime Player 7 Pro Created by Apple, QuickTime Player 7 Pro is an affordable solution for basic video tasks. The advantage of this program over many of the others is its simplicity. This program lets you record, convert videos, and perform basic e dits, while exporting to popular video standards.

PAGE 22

%& Figure 2. Example of export settings used for QuickTime Player 7 Pro 2.7 HandBrake HandBrake is a very popular freeware program that is used to convert videos from a wide vari e ty of formats to popular common video codecs. While HandBrake is easy to use, it also has numerous advanced options that can be used when converting videos. Below is an example of the settings used for this thesis. Figure 3. HandBrake export settings

PAGE 23

%' 2.8 FFmpeg FFmpeg is another freeware that requires the use of Command Prompt in Windows or Terminal on an Apple machine. Since it is not a standalone program, this was the most complicated converter used during the testing Even though it might be more com plicated t o operate, it provided an amazing amount of conversion and playback options for both audio and video. In order to recompress the videos using this program, I had to adapt a previously acquired script to run FFmpeg so as to provide the desired results. The following FFmpeg command was used to convert the videos. Table 8. FFmpeg recompression command ffmpeg i Input File.MOV vcodec libx264 Output .mp4 Breaking down the different components of the script include: i Input File.mov = the directory and desired original file to be converted vcodec libx264 = this specifies the resulting video will use the H.264 codec Output.mp4 = This is where the new video file is named and the output file's container is specified, which in this case is .mp4 Figure 4. Example of full FFmpeg command It should also be noted that FFmpeg is used as the core makeup or converter engine in many different programs. According to the FFmpeg website, FFmpeg is incorporated into programs or software including Google Chrome, Ha ndBrake, and VLC, just to name a few. Due to the wide use of FFmpeg, if the settings that use FFmpe g are

PAGE 24

%( selected on a program such as HandBrake, the results from a CLA will be very simi lar, if not the same, which makes determination of the specific progra m much harder. 2.9 YouTube Unlike the programs that have been previously discussed in this section, YouTube is the only one tested where one doesn't have control over the conversion settings. In order for the user uploaded videos to have optimum playback online, the popular video sh aring site makes the tough decision about proper settings for all of us. An article by Wiger van Houston and Zeno Geradts states, "When the uploaded (natural) video content has a resolution lower than the maximum re solution from YouTube there i s no change in resolution." [7 ] In order for the video to playback on the website, ev ery uploaded video is encoded but the video will not be upsized to a larger resolution and will remain at its maximum resolution Normally, when a forensic investigator is download ing a video, careful consideration is given to the resolution of the video. The downloaded video should have the same resolution as the original to avoid any recompression o r encoding. However, during Zac Giammarrusco's research he found, "The video will always re encode regardless if the dimensions are identical upon upload and download." [8] This is important to remember when analyzing a video from YouTube. In order for YouTube to provide better streaming, it utilize s dynamic adaptive streaming over HTT P (DASH). It works by letting the video playback with different bit rates and resolutions so there isn't any buffering. Since this is the protocol that YouTube uses, a screen video recorder should not be used when trying to recover a video for forensic an alysis.

PAGE 25

%) D ownloading videos directly from YouTube isn't possible, so t here are many different freeware, command lines, and software that can be used to download a video. While there are many different programs available I chose to use MacX YouTube Downloader. This is a freeware program created for Mac which provides the ability to download the videos. Once again, the research by Zac Giammarrusco shows MacX yields the same results as YouTube Downloader by GreenTree Appli cations. "This tool uses FFmpeg licensed under the LGPL v3." [8] This illustrates the versatility and wide use of FFmpeg in many different applications. In order to download a video, the URL of the video needs to be copied and pasted into the program. The program then provides the user with all of the available format options for downl oad. An example of the resolution and codecs available for downl oad is shown below in Figure 5. I chose the highest resolution available for download, which happened to be th e same as the original resolution. Once the resolution is selected the user can choose the destination folder and download the video. Figure 5. YouTube downloader resolution options

PAGE 26

%* 2.10 MATLAB The third and final component to complete the data gath ering for this thesis required the use of MATLAB for the purpose of generating a CLA for e ach video created with the 30 cameras. The custom script combined multiple functions, which included reading.mp4 files and analysis of the RGB color layers. The results from this part of the research provided a very useful charts and plot s for analysis Those include histograms and CEPSTRUMs ( which is a numerical value of the spectrum of the image. ) All of this information is combined to help provide a visual and numeri cal representation of the CLA for each video.

PAGE 27

%+ CHAPTER III RESULTS 3.1 Overview Upon analyzing the data gathered from the experiments outlined in this thesis, many different findings emerge d While I was able to draw conclusion s on my original questions, I was also able to report unexpected findings. When looking back through the da ta, these additional findings helped to answer more questions and solidify answers to the original questions. The next few sections will explain the results from the testing. 3.2 Original Video Comparison In order to help validate the results below, CLA p lots were generated for t he two original videos recorded with each camera. One would expect the CLA results of each video to look very similar to each other since they were recorded with the same camera, same settings, and same scene. As expected, the re sults from the original videos look almost identical. Since all of the test videos were shot without the use of a tripod and many had natural lighting there were slight variations between the two. However the subtle variations can be expected and could b e a result of camera shake or different angle s when recordi ng. The following figures illustrate the similarities between the two original videos.

PAGE 28

%, Figure 6. Apple iPhone 5 Original Video 1 Figure 7. Apple iPhone 5 Original Video 2

PAGE 29

%! Figure 8. Panasonic Lumix DMC TS5 Original Video 1 Figure 9. Panasonic Lumix DMC TS5 Original Video 2

PAGE 30

&. 3.3 Video Resolution Fortunately, for this test I was able to gather videos from cameras that had a wide range of resolution extending from 320x240 to 1920x1080. This wide range helped to illustrate a point when resolution starts to affect the results of the CLA. My research found four cameras that recorded video at the 320x240 resolution when returned to factory defaults. The camera would default to this resolution due to the amount of space available on memory cards in the mid to late 2000s. While there were larger memory ca rds available at that time, the price was very high. According to a press release from the Consumer Electronics Show in January of 2007, Sony announced it would be doubling its 4 GB memory card (released the prior year at CES) to 8 GB. The press release st ated 8 GB card s would sell fo r $300 at the time of release [9 ]. Also, according to Olympus archives, the largest available memory card for their Stylus cameras was 2GB. Table 9: Older camera information Camera Specifications (Oldest to Newest) Make Mode l Release Date Olympus X 560WP June 2003 Olympus Stylus 710 February 2007 Olympus Stylus 790SW September 2007 Sony DSC S930 February 2009 Since the amount of space was limited when these cameras were released, they also used higher levels of compression when recording on the camera to save space on the card. The figures below illustrate how the Sony DSC S930 already begins with a high compre ssion level.

PAGE 31

&% Figure 10 Original CLA for the Sony DSC S930 showing high starting compression level Once this video was run through the programs outlined in this thesis, the visuals did n't change very much. The only way the examiner could tell if there was recompression was by the corresponding numbers for e ach color and scale of the plot Figure 11 CLA results from FFmpeg Generation 1

PAGE 32

&& Figure 12 CLA results from HandBrake Generation 1 Figure 12 illustrates the change in t he scale from the ori ginal plot to to the HandBrake Generation 1. This would tell the examiner there w as recompression, but only if the examiner could compare it with an original video from the same device. Figure 13 CLA results from Adobe Premiere CC 2015 Generation 1

PAGE 33

&' F igure 14 CLA results from QuickTime Player 7 Pro Generation 1 Figure 15 CLA results from YouTube Generation 1 As demonstr ated in the previous figures, the CLA test on a video with a resolution of 320x240 will not provide much useful information for the analyst. However, better

PAGE 34

&( results can be more prevalent with videos that have a resolution of 640x480 or higher as shown in Figure 16 and 17 Figure 16 CLA from Sony DSC W80 with a resolution of 640x480 Figure 17 CLA results from FFmpeg

PAGE 35

&) As one can perceive in the previous two charts, there is a clear difference between the original and FFmpeg Generation 1 showing recompression. 3.4 More Change in Green and Blue Levels Another interesting finding from the testing is more change in the gre en and blue levels as opposed to the red. The change in green is easy to explain. Human eyes are more sensitive to the color green when compared to red and blue. C onsequently, camera manufactures try to mimic how the human eye sees color with color filter arrays. The most popular CFA is the Bayer Array. The design of this array is laid out in a grid pattern, which consists of red, green, and blue filters. To mimic the ability of the human eye to see green, there ar e twice as many green filters as opposed to red and blue filters Figure 18 Example of a Bayer CFA [10 ] Most of the results from recording a white wall included stronger green and blue levels. This can lead to a great change in those colors during the CLA tests. The following figures are the best example s of change in either the green or blue analysis.

PAGE 36

&* Figure 19 CLA of original video from JVC Everio Figure 20 CLA after first recompression When viewing the two charts above, one can see a noticeable difference in the red and green layers. However, when considering the peak value numbers and location for those color layers, there is minimal change. While the analysis number for the green layer

PAGE 37

&+ might seem small as well, the location of the central spike and the scale between the two are vastly different. Further analysis on the changes in the green and blue layers will be discussed later in this section. 3.5 Differences Between Generations Si nce it is well known in the industry that vi deo compression works to reduce redundancies in the video data for the purpose of reducing overall file size, the CLA script used in MATLAB is able to show the original file with a central spike and some smaller spikes to the left and right. With each subsequent generation, the compression level should show an increase after t h e initial conversion. Figures 21 and 22 illustrate th e difference between HandBrake G eneration 1 and 2 from the Panasonic Lumia DMC TS5. Figure 21 Handbrake Generation 1

PAGE 38

&, Figure 22 HandBrake Generation 2 As you can see, there is an increase in the maximum point for each color layer between the first and second generation. There is even a noticeable difference between generation 2 and 3. Figure 23 HandBrake Generation 3

PAGE 39

&! The generations beyond generation 3 start to yield poor results. Some of the color layers in generation 4 and 5 began to stabilize out while others had odd ju mps where the peak value changed significantly. However, these types of results did not occur consistently with all 30 cameras For example, the Apple iPhone 5 had increases in the maximum peak value between the first three generations on the red and blue layer while the green layer d ecreased then increased Figure 24 Apple iPhone 5 Generation 1

PAGE 40

'. Figure 25 Apple iPhone 5 Generation 2 Figure 26 Apple iPhone Generation 3

PAGE 41

'% While the difference between the different generations may not always be clear, there is a clear differen ce between the original file and every generation 1 recompressed video. The only exception was the cameras with a lower resolution as discussed earlier in this chapter. Figure 27 LG G2 Original CLA

PAGE 42

'& Figure 28 LG G2 FFmpeg Generation 1 Figure 29 LG G2 HandBrake Generation 1 CLA

PAGE 43

'' Table 30 LG G2 Premiere Generation 1 CLA Table 31 LG G2 QuickTime Player 7 Pro Generation 1 CLA

PAGE 44

'( Table 32 LG G2 YouTube Generation 1 CLA The initial difference between the original and the first generation of each program and YouTube is seen on almost all of the cameras, smartphones, and tablets used during this test. 3.6 Visual Cues to Determine Software Used Overview One of the primary questions tested was the determination of any visual cues that could lead a forensic examiner to determine the program used to recompress the video. While these different visual cues may be subtle due to the content of the video, original compression from the camera, and /or recompression generation, a pattern began to emerge that linked the CLA charts to the program.

PAGE 45

') 3.7 Visual Cues for FFmpeg While analyzing the data repeatedly FFmpeg always stood out as the most uniform CLA with each subsequent generation created. At first I didn't notice this uniformity but soon discovered this was the unique trait for FFmpeg. With almost every video, FFmpeg would result in a CLA chart with noteworthy narrow peaks or valleys. Further the content between the narrow pe aks or valleys nearly flattens itse lf along the 0 line of the plot These next few examples show the characters of a video that was recompressed with FFmpeg. It is important to point out the camera used for the CLA in Figure 33 is one of the cameras with a lower resolution of 640x480. Ev en though the original CLA plot has more movement to a lesser extent than what was seen in section 3. 2, FFmpeg still transformed it to its familiar characteristics Figure 33 Canon D10 FFmpeg CLA

PAGE 46

'* Figure 34 Samsung Galaxy Note 4 FFmpeg CLA Figure 3 5 Kodak Zi8 FFmpeg CLA

PAGE 47

'+ 3.8 Visual Cues for QuickTime Player 7 Pro Unlike the narrow peaks and valleys created with FFmpeg, the characteristics of QuickTime Player 7 are quite different. In fact, they are the opposite. QuickTime seems to genera te wider peaks and valleys. Additionally the data betwee n the peaks and valleys create s an almost wavy shape by rolling positively and negatively off of the 0 line. These visual cues help to identify QuickTime Player and the softw are used in these next few examples. Figure 36 Canon EOS 5D Mark II QuickTime Player CLA At this point, it is important to note the visual artifacts generated from QuickTime Player beca me more noticeable with each generation. This means generation 2 wi ll show more of these traits when compared to generation 1.

PAGE 48

', Figure 37 Samsung HZ50W QuickTime Player 7 Pro CLA Figure 38 GoPro Hero4 Silver QuickTime Player 7 Pro CLA The QuickTime CLA for GoPro exhibited the most extreme example of the se charact eristics. Since it was so extreme the CLA results from the other programs were

PAGE 49

'! checked to see if the original compression could have cause d this type of shape across the board. By analyzing the other CLA results I was able to determine the original compression did not create this type of extreme shaping. 3.9 Visual Cues for HandBrake The visual cues for HandBrake were a little more difficult to decipher I finally determined this was a result of the program's effect on two of the three color levels and not three as in the previous programs After analyzing the CLA plots from the videos, there was a pattern that started to emerge. HandBrake generated more d rastic changes in the blue and more dominate green color layers. In order to really notice the se changes an examiner needs look at the scale of the plots, as well as the shape of the plot In most cases, the scale and shape for the red color layer stay ed almost identical to the original video while the green and blue layers had extreme changes. Figure 39 Samsung Nexus 10 HandBrake CLA

PAGE 50

(. Figure 40 Panasonic Lumix DMC TS5 HandBrake CLA Figure 41 Canon EOS 7D HandBrake CLA

PAGE 51

(% 3.10 Visual Cues for YouTube and Adobe Premiere While the visual cues for the other programs began to stand out after looking at the data, I had issues with the cues for YouTube and Premiere. When comparing the CLA from the original image and the results from t hese programs there are noteworthy differences. However, there is nothing consistent about the shape, reduction or gain of the peak values for each color level. Like the other programs I would imagine with further research and analysis, traces and pat terns would start to emerge which could be used as identifiers for the use of YouTube or Adobe Premiere.

PAGE 52

(& CHAPTER IV C ONCLUSION Overall, there are many positive and interesting conclusions that can be derived as a result of this research T he results reiterate the understanding that Compression Level Analysis is a positive method for identifying video compression. When comparing the CLA results from the original video to the results from all of the recompressed videos the visual difference s between the CLA plots are easily identifiable. When comparin g the first three generations from any of the programs used, there are clear indications showing the recompressions of the video. However, the results from generation 4 and generation 5 start to yield inaccurate results due to the high levels of compression. It was interesting to discover how much the re solution of the original video a ffects the CLA results. For the most part, any analysis at a resolution of 320x240 would be undesirab le to draw a conclusion. Next the ability to tie specific visual cues to most of the programs creates an advantage for the examiner. This will save time during the analysis phase and help produce detailed information. It was unfortunate conclusions could not be draw n for YouTube and Adobe Premiere but with further research and analysis, perhaps a conclusion will be determined. While Compression Level An alysis may still not be useful as a sole method for forensic video authentication, it's results when combined with other authentication methods can help the examiner draw a scientifically valid conclusion. Finally, the original test videos will help add to the database of videos and images that can be used as references during forensic examinations.

PAGE 53

(' REFERENCES 1. Boren, Zachary D. "There are officially more mobile devices than people in the world." Independent N.p., 7 Oct. 2014. Web. 19 Oct. 2015. 2. Nagpal, Pooja, and Seema Baghla. "Video Compression by Memetic Algorithm." Internation Journal of Advanced Computer Science and Applications 2.6 (2011): 142 45. Web. 2015. 3. Murali E. Krishnan, E. Gangadharan and Nirmal P. Kumar. H.264 Motion Estimation and Applications, Video Compression, Dr. Amal Punchihewa (Ed.), Video Compression 23 Mar. 2012. Web. 2015 4. Popescu, Alin C., and Hany Farid. "Statistical Tools for Digital Forensics." Darthmouth.edu Dartmouth College, 2005. Web. 22 Oct. 2015. 5. Ng, Nicholas Kian Seng. "Cell Phone Images in Social Media: An Analysis of Cellphone Image Structure Before and After Social Media Compression." Thesis. 2014. National Center for Media Forensics University of Colorado Denver, 2014. Web. 17 Nov. 2015. 6. "Olympus Announces New Stylus 710: Sleek Design, Superior Performance and All Weather Durability." Olympus N.p., Jan. 2006. Web. 21 Oct. 2015. 7. Van Houten, Wiger, and Geradts, Zeno. "Using Sensor Noise to Identify Low Resolution Compressed Videos from YouTube." International Workshop on Computational Forensics (2009): 104 115 8. Giammarrusco, Zachary Paul. "Source Identific ation of High Definition Videos: A Forensic Analysis of Downloaders and YouTube Video Compression Using a Group of Action Cameras." Thesis. 2014. National Center for Media Forensics University of Colorado Denver, 2014. Web. 17 Nov. 2015. 9. "Sony Memory Sti ck Duo 8 GB." Digital Photography Review N.p., 8 Jan. 2007. Web. 21 Oct. 2015. 10. Lukac, Rastislav, and Konstantinos N. Plataniotis. "Color Filter Arrays: Design and Performance Analysis." IEEE Transactions on Consumer Electronics 51.4 (2005): 1260 67. Web. 21 Oct. 2015. 11. Grigoras, Catalin, and Jeff Smith. "Digital Imaging: Enhancement and Authentication." Encyclopedia of Forensic Sciences (Second Edition) (2013): 303 14. Skyline Web. 17 Nov. 2015. 12. Michalos, M G., S P. Kessanidis, and S L. Nalmpantis. "Dynamic Adaptive Streaming over HTTP." Journal of Engineering Science and Technology Review 5.2 (2012): 30 34. Web. 17 Nov. 2015.