Description
HEX-Expert is a system of professional tools for the forensic examination of media files within the framework of computer-technical examination and forensic examination of video and sound recordings.
Depending on the tasks to be solved the complex may include an additional module FAT-Expert for device memory analysis.
HEX-Expert allows to establish the presence or absence of traces of modification or editing in the file structure, its metadata, compare the evidence with files obtained from known sources, identify a video/audio recording device both by the properties of the recorded file and by the device memory management method.
HEX-Expert was developed with the participation of practicing experts and uses following main approaches to authenticate audio/video evidence:
- forensic examination of video/audio recording device’s data storage;
- examination of the file header and structure of the file;
- frame allocation mapping;
- inter-stream analysis (synchronization of the video and sound sequence of the recording as well as other data streams);
- automatic extraction of significant identification features of the device used to create the file and their comparison with examples from the existing database;
- identification of the video/audio device.
Examining the device's data storage
The study of the device’s drives reveals the features of the formation of data sequences in the memory and their placement, allowing to establish whether the evidence recording was created using this device or copied to the drive from an external source.
The original method of drive structure data graphical representation allows to set the data management method implemented in the recorder.
File Header Examination
File Header Examination includes detailed analysis of the header and its compliance with the file format standard. Metadata analysis reveals signs of editing using specialized software tools.
The system allows to analyze data in hexadecimal representation with the possibility of interpreting them as a sequence of data of various types, searching traces of codecs or specialized audio/video editing software, conduct a detailed analysis to determine the characteristics of the recording device or software used to create the file or modify it.
Frame Allocation Map
Frame Allocation Map is a unique tool for establishing the authenticity of a video/audio recording and allows to detect changes that have been made to the evidence file without opening it using specialized video or audio editing software application.
Interstream Analysis
Interstream Analysis includes extraction and comparison of the continuity features and synchronization of video and audio stream, as well as other streams available. Comparison of data obtained from different streams complement each other and helps to identify traces of editing and manipulation.
Audio Video Device Identification
Identification of the audio/video recorder is the most important task in establishing the recording is original.
Automatic extraction of identification features allows to compare the characteristics of the evidence media file received for research with the characteristics of the files available in the expert's database.
Functionality
- recognition and parsing of the evidence file structure and streams;
- graphical representation (with varying detalization) of audio and video frames allocation within the file;
- byte-to-byte comparison of two or more files;
- detection and display of time parameters for playback of blocks of audio and video data;
- detection of errors in the file structure;
- comparing the structure of two or more files;
- multi-frame graphic user interface, signal synchronization and file navigation;
- batch file processing;
- export of system results in graphical and chart forms.
Special:
- Analysis of device’s media storage with FAT16 and FAT32 file systems;
- Extraction of specific features of the way the media data is allocated in device’s memory;
- Extraction of the evidence file unique properties;
- File structure analysis;
- Establishment of compliance with the file format standard, service fields filling control;
- Interpretation of data sequences as different types;
- Extracting specific information about the codec (including setting the date and time of the recording);
- Analysis of metadata;
- Frame allocation map is a unique tool for studying the placement of data in a file structure;
- Analysis of digital data storage of audio/video recording devices;
- Creation and analysis of uncompressed images of digital media with FAT16 or FAT32 file structure;
- The order of data storage blocks and sectors allocation display in tabular or chart form;
- Extraction of information about the records of directories of the entire digital media or selected directory;
- Display of information about deleted files and directories;
- Specific file’s time attributes analysis;
- Analysis of the correctness of the formation of time attributes of file sequences.
Supported file formats
- Resource Interchange File Format (RIFF), files with wav and avi extensions;
- Advanced Systems Format (ASF), files with wma, asf, and wmv extensions;
- MPEG4/QuickTime File Format (QTFF), files with extensions mov, mp4, m4a, m4v and 3gp;
- MPEG1/2/2.5 Layer 3 (mp3), files with mp3 extensions;
- Adaptive Multi Rate (AMR), files with amr extensions;
- MPEG-PS (Program Stream), mpg, mpeg and vob files;
- MPEG-TS (Transport Stream), files with mts and m2ts extensions;
- audio streams MPEG1/2/2.5 Layer 2/3;
- DolbyDigital (AC-3) audio streams;
- Advance Audio Codec (AAC) audio streams;
- h264 / Advance Video Codec (AVC) video streams;
- MPEG4 video streams;
- single JPEG images, jpg and jpeg files.
Advantages
- Unique file structure analysis technologies;
- Frame allocation map;
- Identification of the audio and video recording device.
License
The software is protected
by USB dongle;
Installation on multiple
workstations is allowed;
The license
is lifetime.
Phone/Fax: +7 (495) 679-19-28
Moscow, st. 5th Kozhukhovskaya, 22, bldg. 1, 15A
E-mail: info@ot-contact.com
