ForenveraForenvera — Digital Media Forensics

Open-source video forensics tools

What the widely used open-source tools actually measure, what they cannot establish on their own, and how a manual examination puts their output into context.

Most questions about a suspicious video can be narrowed considerably with freely available tooling. None of that tooling returns a verdict. Each utility below answers a specific, bounded question about a file — how it is structured, what it claims about itself, and how its pixels behave over time. The judgement comes from combining those answers and being explicit about what remains untested.

The core toolset

Container and stream inspection

FFmpeg / FFprobe

FFprobe reads the container structure, codec parameters, frame rate, bit rate and stream ordering of a video file. Differences between a claimed capture device and the actual encoder settings are often the first indication that a file was re-encoded or assembled by an editing tool rather than written by a camera.

Limits: Re-encoding is normal for anything shared through a messaging app or social platform, so an encoder mismatch is a question to investigate, not proof of manipulation.

Metadata extraction

ExifTool

ExifTool reads and reports embedded metadata: creation and modification timestamps, device make and model, software fields, GPS tags and vendor-specific atoms. Inconsistent timestamps or an editing suite recorded in a software field are useful, cheap signals.

Limits: Metadata is trivially editable and routinely stripped in transit. Absent metadata means nothing on its own, and present metadata cannot be trusted without corroboration.

Technical profiling

MediaInfo

MediaInfo produces a readable technical profile of every stream, including muxing application, writing library and per-track encoding settings. Comparing that profile against a reference file from the claimed source device is one of the most reliable structural checks available.

Limits: It requires a trustworthy reference sample. Without one, the profile is descriptive rather than probative.

Temporal analysis

Frame extraction and differencing

Decoding a clip to individual frames allows frame-to-frame differencing, examination of compression artefacts and inspection of the boundary regions where a synthesised face meets the original footage. Blending seams, inconsistent motion blur and temporal flicker frequently survive re-encoding.

Limits: Heavy compression destroys fine detail. Low-resolution or heavily re-shared clips may simply not retain enough signal to support a conclusion.

Compression and sensor analysis

Error Level Analysis and noise residue methods

ELA-style visualisations and noise-residue methods can highlight regions whose compression history or sensor noise pattern diverges from the rest of the frame, which is where composited or generated content tends to sit.

Limits: These methods are highly sensitive to compression settings and produce visually persuasive but frequently misleading output. They are indicative only and must never be read as a verdict.

Evidence integrity

Hashing utilities (SHA-256)

A cryptographic hash recorded at the point of receipt proves the file examined is byte-for-byte the file supplied. This is the foundation of any assessment that may later be relied upon by a third party.

Limits: A hash proves integrity from the moment it was taken. It says nothing about the authenticity of the content itself.

A defensible working order

  1. 01

    Preserve the original

    Work from the most original file available, never a screen recording or re-download. Record a SHA-256 hash before anything else and keep the original untouched.

  2. 02

    Establish provenance

    Document where the file came from, who handled it and by what route. A clean technical result on a file of unknown origin is of limited value.

  3. 03

    Profile the container

    Use FFprobe and MediaInfo to describe the file structurally, then compare that description against what the claimed capture path would produce.

  4. 04

    Read the metadata critically

    Extract metadata with ExifTool and treat every field as a claim to be tested, not a fact to be accepted.

  5. 05

    Examine the pixels

    Extract frames and inspect boundaries, lighting consistency, motion coherence and compression behaviour across the sequence rather than in a single still.

  6. 06

    State the limits

    Record what could not be tested and why. An honest assessment separates what the evidence supports from what it merely suggests.

Where automated detectors fall short

  • A detector score is a probability produced by a model trained on specific generators; unfamiliar methods routinely defeat it.
  • Scores carry no reasoning, so they cannot be examined, tested or explained to a third party.
  • Compression, resampling and cropping shift detector output substantially without changing the content.
  • A confident number on an inconclusive file is worse than an honest statement that the evidence does not support a conclusion.

Frequently asked

Can open-source tools prove a video is a deepfake?

No single tool proves manipulation. Open-source utilities surface structural, metadata and pixel-level signals; a conclusion comes from reading those signals together, in context, and stating the confidence and the limits.

Are automated deepfake detectors enough?

Automated detectors return a score from a model trained on particular generators and particular compression conditions. They generalise poorly to unseen methods and give no reasoning, which makes their output difficult to rely on or to challenge.

Does compression destroy the evidence?

It degrades it. Social platform re-encoding removes metadata and fine artefacts, which is why structural and temporal analysis often outlasts pixel-level analysis on shared clips.

What should I do before sending a file for assessment?

Keep the original file, avoid re-saving or re-sharing it, note how you received it, and record the date and route. Preservation matters more than any single analytical step.

Need the examination done properly?

Forenvera performs the analysis manually, records evidence integrity from receipt, and delivers a written assessment that states its confidence and its limits.

Start a CaseHow the assessment works

This service provides an independent technical assessment of the submitted material. It does not guarantee that manipulation can always be conclusively established, and it does not replace legal advice, law-enforcement investigation or a court-appointed expert opinion.