±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 2 Overall: 36764
New Yesterday: 9 Visitors: 149

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Metadata Interrogator

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 


Re: Metadata Interrogator

Post Posted: Feb 10, 19 22:39

- Mark_Thompson
Thanks and I've looked at the metadata through the free forensic software, Video Cleaner and it tells me that it originated from the cam but I understand and read somewhere that metadata can be edited. I found it a bit peculiar that it doesn't show that it's been date and time-stamped even though it clearly shows the time and date at the bottom righthand corner in the video. Unless I've got it wrong I think what goes in my favour is the video is over an hour long with each file being 15mins long except the last one and he's on one of the 15-min files doing his act. Each 15-min file being exactly 10800000 samples in length helps?

You're correct that all metadata can be edited. Unfortunately in your case, I don't think there's anything you can do forensically with this - even if you can prove that it's from the same camera, it doesn't help prove your case as the issue is that you can't see that it's him.  


Re: Metadata Interrogator

Post Posted: Feb 11, 19 02:49

Thank you very much for your reply, although I can just about get his face by freeze framing it after he put the second bin in then goes off screen to sit down on the other side of the room before returning on screen to proceed with his act. Even though his face can't be seen whilst he's doing his act, I believe it can be put into context that it's him if it can be proven that it's not been edited between those 2 points because he's the only one who uses that room on that shift. The only thing that's left is for me to use the sound of the cam one last time to make sure he's still taking it outside, but if he isn't and he's transferring it instead of directly then I guess that there may be a chance I may be able to get his face if I can devise a way of where to put a cam. Although it wouldn't be showing him doing it directly but using a vessel, I believe it would support the above that it was him because it can be put into context. It would still only be good enough evidence to leave behind if I got another job but failing that I guess the only thing left would be a forensics company to verify that it's not been edited. Thanks for your help.

One last thing is I ran analysis pass through Video Cleaner which processed the file to check that it really is 18000 frames as with the other 15-min files and it's verified them as being 18000 frames so I'm guessing this confirms the metadata hasn't been edited so if it was to be edited it'd only be in the scope of an expert because I'd have to get the other files the same to reflect it



Re: Metadata Interrogator

Post Posted: Feb 17, 19 01:24

There are 5 files which make up the video and all of them are 15mins long except the last one which is under that so that's just over an hour long. All of the files except the last one again are 18000 frames so even if the metadata can be changed it can be analysed like I did for 18000 frames unlike say the cam it originated from. So if that 15min file was edited it'd have to be exactly 18000 frames to reflect the other ones and the only question that remains to be asked is if there's any video editing software that'd enable me to achieve that? I'm not aware that there is so it goes in my favour if there isn't. I'll have to try to find out.  


Re: Metadata Interrogator

Post Posted: Feb 17, 19 17:30

- MI_creator
First up, I don't want this to sound like an advert as I know how annoying they are - the software is free and I'm actively looking for feedback from other practitioners rather than trying to promote it. I built it as it was something I had a working need for, and I'd like to share it with you all and get your opinions.

I decided that I needed something that would pull out absolutely any and all metadata possible from files, and display it in a useful way. There are lots of options that sort of do the same thing (Jeffery's Exif tool etc.) but I had a few specific requirements (such as completely offline, portable, any file type, GUI interface etc.) which weren't met by others.

I've also tried to build in some counter fraud specific tools such as match and timeline analysis, highlighting important fields (like author names) and similar.

You can get it here if you're interested - www.metadataanalysis.com

As mentioned, I'd love your feedback and suggestions for new features.

Great tool you got here. Gave it a go and found it pretty interesting. Now i am really interested in the online training course you mentioned. Would check out the PDA website. Thanks.  


Re: Metadata Interrogator

Post Posted: Feb 20, 19 09:30

- sovietpecker

Great tool you got here. Gave it a go and found it pretty interesting. Now i am really interested in the online training course you mentioned. Would check out the PDA website. Thanks.

Really glad you've found the tool useful - makes it all worth while to hear that people have enjoyed using it.

I've got a new release coming up which I think has some much better features (a much improved timeline, better data set analysis and so on) - I'll post here later once it's all cooked.  


Re: Metadata Interrogator

Post Posted: Feb 22, 19 23:25

Just a quick message to say that I've just released a new version with a much fancier timeline, better data set and match analysis and a lot of performance improvements.



Re: Metadata Interrogator

Post Posted: Dec 16, 19 16:32

That's a great tool you've created there. Thank you.
I've had a play with it from various file types of my own that I know the history of.
On all the (Word) Docs it gives a "Creation Date" and "Created" row.
In all cases the former shows 01.01.1980 00:00.00hrs and the latter gives me the times/date I created my document - precisely.
Can you tell me the intended difference between the two?
Thanks again.  

Page 2 of 3
Page Previous  1, 2, 3  Next