Forensic Multimedia Unit Training Manual /Digital and Multimedia Division

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

Table of Contents

1. Overview ...... 3 1.1. Training Program...... 3 1.2. Competency ...... 3 1.3. Practical Competency Exam ...... 4 1.4. Written Exam ...... 4 1.5. Remedial Training ...... 4 1.6. Certification ...... 4 1.7. Continuing Education ...... 5 1.8. Proficiency ...... 5 1.9. Mock Trial...... 5 1.10. Limitations...... 5 1.11. Resources ...... 5 2. Modules ...... 6 Module 1 - Evidence Handling ...... 6 Module 2 – Quality Boot Camp ...... 7 Module 3 - Media File Analysis ...... 8 Module 4 - Media Repair and Recovery ...... 9 Module 5 - Media Duplication-Format Conversion ...... 10 Module 6 - Forensic Audio Analysis ...... 12 Module 7 - Forensic Video/Image Enhancement ...... 14 Module 8 - DVR Extraction ...... 16 Module 9 - Scene Response ...... 17 Module 10 – Legal and Testimony ...... 18

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 2 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

1. Overview

The Forensic Multimedia Unit (FMU) strives to ensure that the Houston Center (HFSC) mission statement “To receive, analyze and preserve physical and digital evidence while adhering to the highest standards of quality, objectivity and ethics” is carried out on a daily basis.

The FMU is divided into two sub-disciplines; Forensic Audio Analysis and Forensic Video Analysis. Forensic Video Analysis, as defined by the Law Enforcement & Emergency Services Video Association (LEVA), is the scientific examination, comparison and/or evaluation of video evidence in legal matters. Forensic Audio Analysis, as defined by the Scientific Working Group for Digital Evidence (SWGDE), is the scientific examination, analysis, comparison, and/or evaluation of audio.

The FMU provides forensic audio and video analysis of crime related evidence. The FMU’s purpose is to serve the community by assisting in investigations and by presenting results of analysis in court. FMU analysts may testify in local, state, and federal courts concerning the procedures followed to preserve, analyze, duplicate, enhance, repair, and produce results.

This FMU training manual is designed to introduce and/or refresh Forensic Video and Forensic Audio fundamentals and concepts to new hires. This manual also establishes a competency benchmark for the unit. This manual is broken up into modules with checklists of key knowledge benchmarks at the end of most modules. Once the checklist for the module has been completed and the trainer is satisfied with the trainee’s progress during the module, a written and/or practical exam will be administered, when applicable.

1.1. Training Program As the trainee progresses toward independent casework, the training program will remain specific to the trainee’s forensic sub-discipline. In situations involving newly-hired analysts who have already been performing casework for other laboratories or organizations, the newly-hired analyst’s competency will be assessed, and the training program modified accordingly. At a minimum, new analysts will complete a competency test prior to performing casework. In any training program, additional training tasks and mock casework may be included at the discretion of the trainer or supervisor.

This training manual along with other materials generated during the training program shall be retained in a binder or electronically. All training checklists, authorization memos, and module completion dates will be documented.

1.2. Competency All analysts must successfully pass a comprehensive competency test. Competency testing can be conducted either at the end of the training program or in a modular format throughout the course of training. At any point when an analyst learns a new technique, process, and/or software to perform their duties, their competency in that area should be tested:

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 3 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

• These levels are driven by the requirements established in the forensic community for the specific tasks to be accomplished. • This curriculum is designed to provide the skills and information necessary for the analyst to attain competency in audio and/or video analysis.

1.3. Practical Competency Exam The practical exam consists of conducting analysis on known evidence with a known outcome predetermined by the trainer/supervisor. The trainee is required to correctly identify the relevant issue(s), select appropriate software and/or hardware tools to conduct the analysis, and produce an appropriately processed output result. The trainee will produce case notes and any other required documentation for the exam. A report will be issued by the trainee to the findings of the examination. All work must be conducted in compliance with current FMU and HFSC Quality Manual policies and procedures. This only applies to modules with a practical exam.

1.4. Written Exam The written exam covers general principles of forensic audio or video analysis terms and definitions, technologies, standards, and hardware and software applications used in the processing of evidence. Both analog and digital topics will be covered to insure the trainee has acquired the necessary base knowledge needed to process all forms of evidence. A minimum score of 80% is required to pass the exam. This only applies to modules with written exams.

1.5. Remedial Training If a trainee fails to pass a written or practical exam, then they will repeat the training module and have one opportunity to retake the test. If the trainee is still not successful, the supervisor, in conjunction with the manager, will determine the best course of action. The trainee may be required to take additional training courses prior to repeating modules or competency tests.

If a trainee fails to pass a mock trial, the trainee may redo the mock trial up to two times. If the trainee is still not successful, the supervisor, in conjunction with the manager, will determine the best course of action.

1.6. Certification Certifications can be comprehensive or topic specific and can be an added tool in verifying analysts’ technical skills and abilities. Certifying bodies generally require training and a minimum amount of experience in the discipline in order to sit for an exam. LEVA and IAI certification of digital and multimedia evidence analysts in all sub-disciplines in which they conduct casework is encouraged. Maintaining certification may require retesting and meeting specific continuing education requirements. Certification is not required to begin casework but is highly encouraged while employed at HFSC.

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 4 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

1.7. Continuing Education Forensic continuing education provides an analyst with the skills and knowledge of evolving technology in digital and multimedia forensics. Training in specific sub-disciplines and specialized areas may be dictated by the forensic discipline, accreditation status, and/or the requirements of the Houston Forensic Science Center.

Continuing education should be obtained annually from training conferences, trade shows, professional organizational memberships, professional publications, current literature, or specialized courses. Training should address updates and the use of new technologies as it relates to: • Hardware and equipment • Software • Techniques, procedures, and methods

1.8. Proficiency Once they are authorized to conduct casework, analysts must successfully pass an annual discipline-specific proficiency test. Proficiency testing is the continual evaluation of FMU personnel in the performance of tasks relating to their discipline. If compliance with proficiency testing is not achieved, independent casework must cease until proficiency is demonstrated. Refer to the HFSC Quality Manual for information regarding proficiency tests.

1.9. Mock Trial Testimony is an important aspect of forensic science and is something that a Forensic Audio or Video Analyst may be requested to give. A mock trial shall be used to determine the trainee’s ability to provide effective testimony. The mock trial should be completed prior to the analyst testifying in court or within a reasonable time frame determined by the unit supervisor/manager.

1.10. Limitations It is widely acknowledged in the digital and multimedia forensic scientific communities that data storage and systems used to create, store, and manage data varies. Variables include types of hardware, software, versions, and sometimes alternate use of the equipment’s original intent. Analysts should apply their education, training, skills, knowledge, ability, and experience to formulate a plan for examination.

1.11. Resources • How Video Works, Weiss/Weynard • CCTV- From Light to Pixels, Vlado Damjanovski • Digital Video Compression, Peter Symes • Photoshop CS3 for Forensic Professionals, George Reis, ISBN 978-0-470-11454-4 • Principles of Digital Audio, Ken C. Pohlmann • Modern Recording Techniques, Huber & Runstein • The Audio Dictionary, Glenn D. White & Gary J. Louie

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 5 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

• www.dmeresources.com • SWGDE/SWGIT • Spreadys.wordpress.com

2. Modules

Module 1 - Evidence Handling

Recommended Reading: HFSC Evidence Handbook HFSC Quality Manual FMU Administrative/Quality SOP

Definitions:

TERM DESCRIPTION COPY an accurate reproduction of information DIGITAL EVIDENCE information of probative value that is stored or transmitted in binary form an image that is represented by discrete numerical values organized in a DIGITAL IMAGE two-dimensional array (when viewed on a monitor or paper, it appears like a photograph) an accurate and complete reproduction of all data objects independent of DUPLICATE the physical media MEDIA objects on which data can be stored analog or digital media including, but not limited to, film, tape, magnetic MULTIMEDIA EVIDENCE and optical media, and/or the information contained therein

Training Objectives: • The trainee will learn the ways items can be submitted to the FMU. • The trainee will learn how to create cases in LIMS and how to add items to already created cases. • The trainee will learn the best practices for submission of evidence. • The trainee will learn how to properly package and seal evidence. • The trainee will complete the checklist in order to show competence in evidence handling.

Trainee’s Trainer’s Date Module 1 Checklist: Evidence Handling Initials Initials Completed Read and understands FMU Administrative/Quality SOP, HFSC Evidence

Handbook, and HFSC Quality Manual Knowledge of evidence handling practices and procedures

Knowledge of FMU submission form

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 6 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

Knowledge of creating evidence/cases in LIMS Ability to communicate best practices for identifying and seizing media evidence for subsequent laboratory examination, evidence preservation, packaging, transport, and storage. Ability to determine whether a request is within the scope of an individual’s

or the laboratory’s services. Ability to assess the risks to media evidence posed by processes from other

forensic science disciplines. Knowledge of physical media formats and how to protect them from

overwrite and environmental damage. Ability to properly package and appropriately seal all types of audio/video

evidence. Ability to properly label media for identification without damaging evidence.

Created ____ new cases using LIMS (minimum of 2)

Created ____ new items to already existing cases (minimum of 2)

Module 2 – Quality Boot Camp

Required Reading: FMU Administrative/Quality SOP HFSC Quality Manual

Recommended Training Courses: N/A

Training Objectives: • The trainee will attend a quality training course that will be conducted by a member of the Quality Division. • The trainee will learn about the Quality Management System and ISO/IEC 17025 requirements. • The following items will be discussed in this training: o Accreditation/Scope of Accreditation o Document Control o Audits o Nonconforming Work o Root Cause Analysis o Personnel o Equipment o Validations

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 7 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

o Technical Records o Technical/Administrative Reviews o Evidence Handling o Testimony Monitoring • The trainee will gain a better understanding of documentation in case records. • The trainee will gain more understanding of how the Quality Management System is managed including the use of Qualtrax to achieve and maintain document control.

Trainee’s Trainer’s Date Module 2 Checklist: Quality Boot Camp Initials Initials Completed Read and understands FMU Administrative/Quality SOP and HFSC Quality

Manual. Attended the Quality Boot Camp training

Passed a written test based on the HFSC Quality Manual and ISO/IEC 17025

requirements (test may be in Qualtrax)

Module 3 - Media File Analysis

Recommended Reading: FMU Media File Analysis SOP How Video Works, Weiss/Weynard Best Practices for Forensic Video Analysis, SWGIT/SWGDE

Recommended Training Courses: LEVA Level 1: Forensic Video Analysis & the Law LEVA Level 2: Digital Multimedia Evidence Processing

Definitions:

TERM DESCRIPTION AUTHENTICATION the process of confirming that the data is a true and accurate VERIFICATION representation of what it purports to be Information of probative value consisting of a representation of various ANALOG VIDEO brightness levels as different voltages in a series of images. Formats include EVIDENCE but are not limited to: VHS, S-VHS, VHS-C, ¾”, Betamax, Betacam, Hi8, 8 mm, Mini DV, as well as other analog /digital tape-based video formats. an analog signal which contains chroma, video, blanking and sync COMPOSITE VIDEO information and has been combined using one of the coding standards SIGNAL NTSC, PAL, SECAM, etc. S-VIDEO a signal in which the luminance and chrominance are separate

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 8 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

COMPRESSION the process of reducing the size of a data file A device or program capable of encoding and decoding digital data. Codecs CODEC encode a stream or signal for transmission, storage or encryption and (COMPRESSOR/ decode it for viewing. Codecs are necessary for playback of encoded data. DECOMPRESSOR) Generally, codecs from DCCTV systems are proprietary. FILE FORMAT the structure by which data is organized in a file

PROPRIETARY FORMAT any file format that is unique to a specific manufacturer or product

Training Objectives: • The trainee will gain the skills required to effectively complete an analysis of digital and analog media in order to identify the best technical procedures to satisfy a customer’s request. • The trainee will complete the Media File Analysis checklist. • This module must be completed before modules 4-8.

Trainee’s Trainer’s Date Module 3 Checklist: Media File Analysis Initials Initials Completed Read and understands FMU Media File Analysis SOP. Can define terminology such as: codec, compression method, storage aspect

ratio, display aspect ratio, frame rate, resolution Working knowledge of DME examination programs such as: MediaInfo, G-

Spot, FFMPEG, and Amped FIVE

Module 4 - Media Repair and Recovery

Recommended Reading: FMU Media Repair and Recovery SOP How Video Works, Weiss/Weynard

Definitions:

TERM DESCRIPTION pertaining to or being a device, recording media, or signal having the ANALOG property of continuously varying in strength or quantity, such as voltage, an audio signal, a video signal or photographic film CASSETTE a self-contained plastic housing holding video or audio tape DIGITAL EVIDENCE information of probative value that is stored or transmitted in binary form

Training Objectives: • The trainee will learn different techniques of repairing analog evidence that includes video and/or audio media.

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 9 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

• The trainee will learn ways to examine digital evidence and how to repair and/or recover evidence. • Trainee will complete checklist and practice repairing analog and digital media.

Trainee’s Trainer’s Date Module 4 Checklist: Media Repair and Recovery Initials Initials Completed Read and understands Media Repair and Recovery SOP. Knowledge of the production and assembly of forensic media, the materials from which they are made, the physical properties of those materials, and how the media are designed to function. Ability to evaluate media damage to determine whether it may affect

access, playback, or recovery of the recording. Ability to disassemble and reassemble media housings and replace

damaged components as necessary. Ability to clean magnetic tape without damaging it.

Ability to clean optical discs without damaging them. Ability to identify the following in magnetic tape reels: sticky-shed, binding,

pack slip, torn or wrinkled tape, and damage to the tape reel. Ability to determine if data has been written to a recordable optical disc.

Ability to splice magnetic tape. Completed ____ mock media repair cases (minimum of 2)

*Note: This may include the Media Repair competency exam

Module 5 - Media Duplication-Format Conversion

Recommended Reading: FMU Media Duplication-Format Conversion SOP How Video Works, Weiss/Weynard

Recommended Training Courses: LEVA Level 1: Forensic Video Analysis & the Law LEVA Level 2: Digital Multimedia Evidence Processing

Definitions:

TERM DESCRIPTION information of probative value consisting of a representation of various ANALOG VIDEO brightness levels as different voltages in a series of images (formats include EVIDENCE but are not limited to: VHS, S-VHS, VHS-C, ¾”, Betamax, Betacam, Hi8, 8 mm, Mini DV, as well as other analog/digital tape-based video formats)

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 10 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

BIT RATE the amount of bits per second that are used to make up a digital file (AUDIO/VIDEO) constant bit rate encoding means that the rate at which a codec's output CBR data should be consumed is constant no matter how complex the segment (CONSTANT BIT RATE) of media A device or program capable of encoding and decoding digital data. Codecs CODEC encode a stream or signal for transmission, storage, or encryption and (COMPRESSOR/ decode it for viewing. Codecs are necessary for playback of encoded data. DECOMPRESSOR) Generally, codecs from DCCTV systems are proprietary. an analog signal which contains chroma, video, blanking and sync COMPOSITE VIDEO information and has been combined using one of the coding standards SIGNAL NTSC, PAL, SECAM, etc. COMPRESSION the process of reducing the size of a data file DEINTERLACING separating an interlaced frame into two discrete fields information of probative value stored or transmitted in binary form DIGITAL MEDIA including but not limited to film, magnetic media, optical media, and flash EVIDENCE (DME) media and/ or information contained therein DIGITAL VIDEO a stand-alone embedded system or a computer-based system used to RECORDER (DVR) record video and/or audio data DIGITIZING the process of converting information into a digital format Lines of spatial information of a video signal. For interlaced video, a frame consists of two fields, one of odd lines and one of even lines, displayed in FRAME sequence. For progressive scan (non-interlaced) video, the frame is written through successive lines that start at the top left of the picture and finish at the bottom right. An element of a video signal containing alternate horizontal lines. For interlaced video, the scanning pattern is divided into two sets of spaced FIELD lines (odd and even) that are displayed sequentially. Each set of lines is called a field and the interlaced set of the two sets of lines is a frame. FILE FORMAT the structure by which data is organized in a file The standard for encoding interlaced analog video signals in digital video ITU-R 601 form. It includes methods of encoding 525-line 60 Hz and 625-line 50 Hz (INTERNATIONAL signals, both with an active region covering 720 luminance samples and TÉLÉCOMMUNICATIONS 360 chrominance samples per line. The color encoding system is known as UNION) STANDARD YCbCr 4:2:2. PROPRIETARY FORMAT any file format that is unique to a specific manufacturer or product S-VIDEO a signal in which the luminance and chrominance are separate TIME BASED an electronic device that improves video signal stability by correcting time- CORRECTOR (TBC) based errors inherent in mechanical video tape recorders VBR (VARIABLE BIT allows a higher bit rate to be allocated to the more complex segments of RATE) media files while less space is allocated to less complex segments

Training Objectives: • The trainee will learn the most optimal ways to convert/duplicate analog and digital media. • The trainee will demonstrate knowledge of analog and digital video compression and the pros and cons to it.

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 11 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

• The trainee will complete the checklist and practical exam to show competency.

Module 5 Checklist: Media Duplication – Format Conversion Trainee’s Trainer’s Date Initials Initials Completed Read and understands Media Duplication/Format Conversion SOP.

Ability to make CD/DVD copies using the Microboards CD/DVD duplicator Ability to articulate definitions such as bit rate, lossy and lossless compression, codec, etc. Knowledge of analog video to digital conversion while maintaining a visually lossless derivative Knowledge of universal digital format conversions

Knowledge of proprietary digital format conversion Completed ____ mock media duplication/format conversion cases (minimum of 2) *Note: This may include the video analysis competency exam. Practical Exam The practical exam will consist of three format conversions. The trainee will select the appropriate conversion method and produce an appropriate processed output result. The trainee will document the procedure as if the exam were casework. *Note: This may be fulfilled with the video analysis competency exam.

Module 6 - Forensic Audio Analysis

Recommended Reading: FMU Forensic Audio Analysis SOP Best Practices for Forensic Audio, SWGDE Core Competencies for Forensic Audio, SWGDE The Audio Dictionary Modern Recording Techniques

Recommended Training Courses: Introduction to , Resolution Video 3 Day Audio Forensics Training, Tracer Technologies Forensic Audio Enhancement, National Center for Media Forensics

Definitions:

TERM DESCRIPTION AZIMUTH the angle of a tape head’s recording gap relative to the tape ATTENUATION the weakening of a transmitted signal as it travels farther from its source

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 12 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

the complete range of frequencies over which a circuit or electronic system BANDWIDTH can function with minimal signal loss BIT DEPTH the number of bits of information in each sample DISTORTION undesired changes in the waveform of a signal, barrel, and pincushion FORENSIC AUDIO scientific examination, analysis, comparison, and/or evaluation of audio the number of complete cycles of a periodic waveform that occur in a given FREQUENCY length of time in cycles per second (Hz) INTELLIGIBILITY the state or quality of being intelligible; capability of being understood

Training Objectives: • Trainee will learn general knowledge and skills related to audio analysis. • Trainee will learn software specific for audio analysis including filters. • Trainee will learn about analog audio and the proper equipment to use when examining analog evidence. • Trainee will learn when and how to repair audio evidence (e.g. media housings)

Module 6 Checklist: Forensic Audio Analysis Trainee’s Trainer’s Date Initials Initials Completed Read and understands Audio Analysis SOP. Ability to test audio processing software using known audio data to verify it

is performing as expected. Can define terminology like forensic audio, frequency, bandwidth, bit

depth, intelligibility, and distortion Types of audio recording devices (digital and analog)

Knowledge of voice recorder operation and the function of its basic parts

Basic understanding of sound and hearing fundamentals

How to inspect audio evidence (digital and analog)

How to optimize evidence playback

Noise identification and frequency analysis Completed _____ mock audio cases (minimum of 2)

*Note: This may include the audio competency exam. Written Examination – Passing Score: 80% The exam will cover the general principles of audio forensics, terms and definitions, audio technologies, standards, and hardware and software applications used in the processing of audio evidence. Both analog and digital topics will be covered to ensure the trainee has acquired the necessary base knowledge needed to process audio evidence.

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 13 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

Practical Exam This will consist of conducting audio analysis on a mock case. The trainee will be required to correctly identify the relevant audio issue with the recording, select appropriate software and/or hardware tools to conduct the analysis, and produce an appropriately processed output result. Case notes and a report will be issued by the trainee to the findings of the examination. All work must be conducted in compliance with current FMU policies and procedures.

Module 7 - Forensic Video/Image Enhancement

Recommended Reading: FMU Forensic Video/Image Enhancement SOP How Video Works, Weiss/Weynard The Image Processing Cookbook, 2nd Edition, Dr. John C. Russ

Recommended Training Courses: LEVA Level 1: Forensic Video Analysis & the Law (LEVA) LEVA Level 2: Digital Multimedia Evidence Processing (LEVA) Forensic Imaging Techniques (LEVA) Amped FIVE Training

Key Concepts/Definitions:

TERM DESCRIPTION The specific settings for brightness and contrast filters should be set so that the level of detail for the area of interest is not adversely affected. Steps should be taken to ensure that clipping does not occur in the area of BRIGHTNESS/CONTRAST interest within the image. In a global brightness adjustment, areas of the image that are not pertinent may in fact be made less visible in order to optimize the pertinent area. the removal of the outer parts of an image to improve framing, accentuate CROPPING/RESIZING subject matter or change aspect ratio Allows the user to adjust contrast levels without affecting the color saturation of the image. It does not use the LAB color space to adjust the CURVES histogram and saturation of the image. The LAB color space does not handle color saturation properly. DAR (DISPLAY ASPECT the ratio of the width to the height of the display frame for the video; the RATIO) aspect ratio of what we see the process of converting interlaced video, such as common analog DEINTERLACING television signals or 1080i format HDTV signals, into a non-interlaced form FRAME AVERAGING frame averaging will remove noise that appears over several images A function typically used to reduce image noise and detail using a specific mathematical function known as the “Gaussian Kernel” or “bell-curve”. The GAUSSIAN BLUR visual effect of this technique is a smoothing of image features as if viewing the image through a translucent filter.

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 14 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

any process intended to improve the visual appearance of an image or IMAGE ENHANCEMENT specific features within an image A method of image processing whereby one pixel, block, or frame is displayed or stored based on the differences between the previous and INTERPOLATION subsequent pixel, block, or frame of information. This is often done to increase the apparent clarity of an image. LEVELS enhances under/overexposed images SAR (STORAGE ASPECT the frame size and aspect ratio of the digital video stored in the file RATIO) Sharpening techniques can be useful to enhance edge detail. Since the fine detail of an image lies in the high frequencies, video analysts may choose SHARPENING to boost the high frequencies of an image in an attempt to better visualize these details. Speed adjustment of forensic video is typically performed for the following reasons: to convert the playback speed of time-lapsed video recordings to a real-time rate and to slow the playback speed of video to a less-than-real- SPEED ADJUSTMENT time rate (“slow motion”). Speed adjustments are made by varying the playback frame rate and may be accomplished through hardware (e.g. time-lapse VCR) or video-processing software (e.g. Amped FIVE). any process intended to improve the visual appearance of video sequences VIDEO ENHANCEMENT or specific features within video sequences

Training Objectives: • Trainee must complete Module 3 Media File Analysis prior to this module. • Trainee will learn proper methods of examining files and deciding what process to take. • Trainee will learn software specific for video and image analysis including filters. • Trainee will learn proper methods of exporting/converting enhanced files. • Trainee will develop a workflow for video analysis casework.

Module 7 Checklist: Forensic Video/Image Enhancement Trainee’s Trainer’s Date Initials Initials Completed Read and understands Video/Image Enhancement SOP.

Knowledge of various enhancement techniques both basic and advanced, as well as their strengths and weaknesses. Knowledge of output considerations as well as the factors that can reduce output quality. Knowledge of a proper workflow from capture to enhancement and output, maintaining a nondestructive workflow with comprehensive documentation. Completed _____ mock video/image analysis cases (minimum of 2) *Note: This may include the video analysis competency exam. Written Examination – Passing Score: 80% The exam will cover general knowledge of DME enhancement, terms and definitions, and hardware and software applications used in the processing

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 15 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

of video and still images. Both analog and digital topics will be covered to insure the trainee has acquired the necessary base knowledge needed to process all video evidence. Practical Exam This practical will satisfy the Media File Analysis, Media Duplication/Format Conversion, and Forensic Video/Image Enhancement modules. This will consist of conducting an image enhancement on known evidence with a known outcome predetermined by a trained Forensic Video Analyst from analysis of the media to output of the derivative. Case notes and a report will be created by the trainee as to workflow and processes performed. All work must be conducted in compliance with current FMU policies and procedures.

Module 8 - DVR Extraction

Recommended Reading: FMU DVR Extraction SOP CCTV Networking & Digital Technology, by Vlado Damjanovski How Video Works, Weiss/Weynard Best Practices for the Analysis of Digital Video Recorders, SWGIT

Recommended Training Courses: Digital Video Recorders: Video Evidence Retrieval (LEVA) Digital Video Recorders: Byte Level Analysis (LEVA) LEVA Level 2: Digital Multimedia Evidence Processing (LEVA) Digital Video Evidence Recovery (Resolution Video) Traditional Recovery of Evidence from DVRs (DME Forensics) DVR Examiner Fundamentals (DME Forensics)

Definitions:

TERM DESCRIPTION COMPRESSION the process of reducing the size of a data file A device or program capable of encoding and decoding digital data. Codecs encode a stream or signal for transmission, storage or encryption and CODEC decode it for viewing. Codecs are necessary for playback of encoded data. Generally, codecs from DCCTV systems are proprietary. an analog signal which contains chroma, video, blanking and sync COMPOSITE VIDEO information and has been combined using one of the coding standards SIGNAL NTSC, PAL, etc. DIGITAL EVIDENCE information of probative value that is stored or transmitted in binary form DIGITAL VIDEO a stand-alone embedded system or a computer-based system used to RECORDER (DVR) record video and/or audio data

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 16 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

MULTIPLEXER/ a device used to combine multiple video signals into a single signal or DEMULTIPLEXER separate a combined signal PROPRIETARY any file format that is unique to a specific manufacturer or product FORMAT/NATIVE FILE FORMAT

Training Objectives: • Trainee will learn the types of Digital Video Recorders. • Trainee will be able to troubleshoot the best method of extracting from a DVR. • Trainee will learn the different formats used by DVRs. • Trainee will learn how to set up a DVR and properly play back video.

Module 8 Checklist: DVR Extraction Trainee’s Trainer’s Date Initials Initials Completed Read and understands DVR Extraction SOP.

Knowledge of types of DVRs

Knowledge of common ports/drives/connections associated with DVRs

Knowledge of cameras – analog and IP

Knowledge of extraction methods and pros and cons of each

Knowledge of considerations regarding DVRs

Completed _____ mock DVR cases (minimum of 2) *Note: This may include the DVR competency exam. Written Examination – Passing Score: 80% The exam will cover general knowledge of DVRs, terms and definitions, extraction methods, and hardware and software applications used in the processing of DVR evidence. Both analog and digital topics will be covered to insure the trainee has acquired the necessary base knowledge needed to process DVRs. Practical Exam This will consist of conducting DVR analysis on known evidence with a known outcome predetermined by a trained Forensic Multimedia Analyst/supervisor. Case notes and a report will be created by the trainee to the findings of the examination. All work must be conducted in compliance with current FMU policies and procedures.

Module 9 - Scene Response

Recommended Reading: FMU Scene Response SOP

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 17 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

Best Practices for the Retrieval of Video Evidence from Digital CCTV Systems LEVA Best Practices for the Acquisition of Digital and Multimedia Evidence Version: 3.0 (4/14/10)

Definitions:

TERM DESCRIPTION The procedures and documents that account for the possession of a CHAIN OF CUSTODY sample by tracking its handling and storage from its point of collection to its final disposition. EXTRACTION any method of exporting data from a source LEGAL AUTHORITY consent to search and/or seize digital and multimedia evidence the process undertaken to maintain the integrity of potential digital PRESERVATION evidence STORAGE MEDIA any object on which data is preserved

Training Objectives: • Trainee must complete and pass the Module 8 DVR Extraction written and practical exams prior to completing this module. • Trainee will learn how to take what was learned in Module 8 and apply it at a scene. • Trainee will learn how to prepare for call outs and learn protocols for them. • Trainee will learn safety procedures and protocols to follow while at a scene.

Module 9 Checklist: Scene Response Trainee’s Trainer’s Date Initials Initials Completed Read and understands Scene Response SOP and Module 8

Knowledge of types of DVRs and extraction methods

Knowledge of preparing for a scene response

Knowledge of scene arrival protocols

Knowledge of protocols for returning from a scene response Observed _____ scene responses with a trained Forensic Analyst

(minimum of 2)

Module 10 – Legal and Testimony

Recommended Reading: HFSC Code of Ethics LEVA Code of Ethics

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 18 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

Recommended Training Courses: LEVA Level 1- Forensic Video Analysis and the Law LEVA Level 2- Digital and Multimedia Evidence Processing HFSC Ethics Training Moot Court Training

Definitions:

TERM DESCRIPTION the (1.) process of substantiating that the asserted provenance of data is AUTHENTICATION true, and (2.) the process of substantiating that data are accurate representations of what they are purported to be the procedures and documents that account for the possession of a sample CHAIN OF CUSTODY by tracking its handling and storage from its point of collection to its final disposition LEGAL AUTHORITY consent to search and/or seize digital and multimedia evidence

Training Objectives: • Trainee will study important court cases and learn how they pertain to the Audio/Video discipline. • Trainee will learn how to present him or herself in court and be able to explain concepts and analysis in a clear and concise manner.

Forensic Science and the Law: Video evidence is classified as a form of photographic evidence under Federal Rules of Evidence 1001 and falls into one of three categories: illustrative, event recording, or surveillance. Forensic Science and the Law training provides the analyst ability to present clear and non-technical digital and multimedia evidence-based testimony in court. It also provides the analyst an ability to prepare accurate and reliable documentation and/or visual aids (i.e. notes, reports, printouts, audio recordings). This training should address the use of techniques such as: • Lecture-type presentation relevant to court testimony • Court monitoring • Moot court • Ethics training

Test for Relevant Evidence- Texas Rules of Evidence 401/FRE 401: Evidence is relevant if: • It has any tendency to make a fact more or less probable than it would be without the evidence; and • The fact is of consequence in determining the action.

General Admissibility of Relevant Evidence- Texas Rules of Evidence 402/FRE 402: Relevant evidence is admissible unless any of the following provides otherwise:

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 19 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

• the United States or Texas Constitution; • a statute; • these rules; or • other rules prescribed under statutory authority

1993, United States Supreme Court, Daubert v Merrell Dow Pharmaceuticals, Inc.: The judge is the “gatekeeper” to expert testimony and will only allow expert testimony to be presented to the jury if specific requirements are met. The current rules on experts were created by the United States Supreme Court in the case of Daubert v Merrill Dow Pharmaceuticals. Judge is gatekeeper: The trial judge has the job of gatekeeping or guaranteeing that expert testimony is actually “scientific knowledge”. Relevance and reliability: The trial judge must make sure that the expert’s testimony is relevant to the task at hand and rests on a reliable foundation. Any concerns about expert testimony cannot be given to the jury as a question of the weight of the evidence. Also, the Judge must find it more likely than not that the expert’s methods are reliable and reliably applied. Scientific method/methodology: A conclusion will qualify as scientific knowledge if the proponent can show that it is the product of sound scientific methodology that uses the scientific method. Factors: Scientific methodology is the process of formulating hypotheses and conducting experiments to prove or disprove the hypothesis. It is necessary to provide a no dispositive, nonexclusive, flexible set of observations considered relevant in order to determine the “validity” of any scientific testimony. Empirical testing: Whether the theory or technique is falsifiable, refutable, and/or testable, whether it has been subjected to peer review and publication, the known or potential error rate, the existence and maintenance of standards and controls concerning its operation and the degree to which the theory and technique is generally accepted by a relevant scientific community.

Testimony by Expert Witnesses- FRE 702: A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion or otherwise if: (a) The expert’s scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue; (b) The testimony is based on sufficient facts or data; (c) The testimony is the product of reliable principles and methods; and (d) The expert has reliably applied the principles and methods to the facts of the case.

Authenticating or Identifying Evidence- Texas Rules of Evidence 901/FRE 901: In general, to satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 20 of 21

Forensic Multimedia Unit FMU Training Manual Crime Scene/Digital and Multimedia Division

Authentication of evidence generally focuses on location, date, time, reliability, and integrity.

Contents of Writings, Recordings, and Photographs- Texas Rules of Evidence 1001/FRE 1001: In this article: (a) A “writing” consists of letters, words, numbers, or their equivalent set down in any form. (b) A “recording” consists of letters, words, numbers, or their equivalent recorded in any manner. (c) A “photograph” means a photographic image or its equivalent stored in any form. (d) An “original” of a writing or recording means the writing or recording itself or any counterpart intended to have the same effect by the person who executed or issued it. For electronically stored information, “original” means any printout—or other output readable by sight—if it accurately reflects the information. An “original” of a photograph includes the negative or a print from it. (e) A “duplicate” means a counterpart produced by a mechanical, photographic, chemical, electronic, or other equivalent process or technique that accurately reproduces the original.

Requirement of the Original- Texas Rules of Evidence 1002/FRE 1002: An original writing, recording, or photograph is required in order to prove its content unless these rules or other law/federal statute provides otherwise.

Admissibility of Duplicates- Texas Rules of Evidence 1003/FRE 1003: A duplicate is admissible to the same extent as the original unless a question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate.

Module 10 Checklist: Legal and Testimony Trainee’s Trainer’s Date Initials Initials Completed Knowledge of relevant federal and state case law pertaining to the forensic processing of forensic media *Note: this may be done in LEVA Level training courses. Knowledge of rules of evidence in civil and criminal procedure pertinent to admissibility and authentication *Note: this may be done in LEVA Level training courses. Knowledge of rules of evidence in civil and criminal procedure pertinent to expert witness testimony *Note: this may be done in LEVA Level training courses. Ability to present technical data in a clear and concise manner

*Note: this may be done in LEVA Level training courses. Observed _____ testimonies by other trained analysts (minimum of 2 and does not necessarily need to be audio/video testimony if not available) Practical Exam: Mock Court/HFSC Testimony Workshop

FMU Training Manual Document ID: 3378 Issued By: Section Manager Issue Date: May 23, 2018 Uncontrolled When Printed Page 21 of 21