Corrupted DVDs: an emerging forensic problem that may constitute untrustworthy evidence.
Subject: Digital video disk (Production processes)
Digital video disk (Properties)
Author: Cain, Steve
Pub Date: 12/22/2008
Publication: Name: The Forensic Examiner Publisher: American College of Forensic Examiners Audience: Professional Format: Magazine/Journal Subject: Health; Law; Science and technology Copyright: COPYRIGHT 2008 American College of Forensic Examiners ISSN: 1084-5569
Issue: Date: Winter, 2008 Source Volume: 17 Source Issue: 4
Topic: Event Code: 320 Manufacturing processes Computer Subject: Digital video disk
Geographic: Geographic Scope: United States Geographic Code: 1USA United States
Accession Number: 189957243
Full Text: [ILLUSTRATION OMITTED]

With technology increasing, so is the number of formats of a DVD, which when produced on a home computer results in defective DVDs. DVDs are normally derived from some form of digital tape media, and the tape media are sometimes not totally devoid of any defects. One problem in particular is the lag of audio and video synchronization, which could be corrupted on DV tape and may be contaminated during playback. Forensically, DVDs and their different formats must be analyzed with more effective data recovery software to remain admissible as reliable tape evidence.

There has been an increasingly larger amount of submitted DVDs as evidence both to litigation firms and ultimately to forensic labs. Quite often the submitter from the law firm provides a DVD that is obviously corrupted and contains visible artifacts such as color banding, blockiness, blurriness, missing detail, and other suspicious visual events that are not consistent with a normal DVD. As individuals are increasingly creating their own DVDs (using their home computer and inappropriate DVD software and burner hardware), there is increasing corruption and degradation on submitted DVDs. Corrupted CDs made on defective hardware and software can result in unreliable evidence (audio or video). This was documented in an earlier published paper (Cain, 2004).

This paper will attempt to document the more fundamental causes and factors for poor DVD production and what forensic artifacts are normally associated with defective DVD manufacturing. Attention will also be focused on poorly made DVD-Videos and the disadvantages of DVD, especially concerning different manufacturer recording and playback units, regional or country codes that preclude nationwide playback capability, copy protection issues, and out-of-sync audio and video components of a DVD. There also are incompatible DVD disks that cannot be played back on different DVD recorders and improper usage of DVD authoring systems that together result in corrupted DVDs' features, which would add to their untrustworthiness as forensic evidence.

Modern day DVDs hold about two hours of high-quality video, but in early 2002, Japanese DVD manufacturers adjusted the nature of their playback laser beam, which had a narrower focus, and expanded the DVD capacity from 4.7 GB to 27 GB. Double-sided disks will hold about 50 GBs of storage capability. Unfortunately, the blue laser drives are not automatically backward-compatible with DVD drives, and manufacturers will have to develop a new type of playback system for these larger DVDs.

DVD is data-compressed technology that essentially matches broadcast quality, but normally plays back at a standard DVD rate of MPEG-2 Video (Motion Expert Group No. 2).

[ILLUSTRATIONS OMITTED]

Unfortunately, DVDs have become more complex as the authoring tools improve, so there are more engineering flaws within the DVD player mechanism to include firmware upgrades in both the software and hardware. Problems can also exist during playback because of damaged or defective disks, and defective players--more than 100 different DVD players--that are unable to play back certain types of DVDs. (Taylor, 2004)

Different DVD Formats

As of 2005, there were 144 possible variations of the DVD format, which produced 24 different physical format variations. The first standard DVD format was DVD-R which stands for DVD recordable. The DVD-R can hold 4.7 GB on each side of the disk for a total of 9.4 GB of data on a double-sided disk. DVD-R subsequently became one of the most popular formats because you could record a disk that had been used in a standard DVD player. On the rewritable side, the standard is called DVD-RW. These disks can also store 4.7 GB, but unfortunately not all DVD players can read DVDRWs. Two more recent DVD standards including DVDR and DVDRW have become available and are cheaper to manufacture and may or may not be playable on stand alone DVD players or computer drives. There are also approximately a dozen new DVD hybrids that combine features on one or more of the earlier formats. Despite the many differences between writable DVD formats, they do have similar capabilities and perform a similar job recording data. One of the primary physical incompatibilities between the DVD recording formats is that some are designed for video, one for audio data, and one for "streaming" such as from a camcorder or a digital video receiver. None of these recording file formats are readable by standard DVD video or audio players. Synchronization problems are also found where a "lip sync" breakdown occurs as the audio lags somewhat behind the video.

These problems are often caused during film production or editing or involve the improper matching of audio and video tracks and the DVD encoding-authoring process (Taylor, 2006).

Today it is estimated that there are more than 100 million DVD players or recorders within the United States. To permit different DVD recorders to copy DVD disks without copyright protection violations, different hardware and software devices were developed in the late 1990s. The foremost piece of hardware is the IEEE1394/Firewire connector, which transfers audio and video data between a multitude of DVD products including computers and digital cameras (Taylor, 2006).

Much of the submitted DVD disks' evidence involves audio and video data that has not been manufactured on an optimized computer or a DVD burner to include poor authoring software. A lack of DVD calibration tests exist that would verify there are no defects on either the physical layer of the disk or within the content itself. The majority of evidence disks involve the capture of analog or digital videotape information, which may or may not be transferred to a computer before the DVD is ultimately manufactured.

Whether the capture device is an analog or digital camcorder or a large scale CCTV surveillance system, it is essential the captured analog and digital involves optimum data rates, resolution, frame rate, audio format rate, and efficient capture cards for A/D conversion purposes. Dropped or missing frames can occur when the capture computer is incapable of storing the video to disk data fast enough. The capture software often repeats the last successfully captured frame on a multitude of occasions, which can cause interruptions in the video stream. Another important consideration for effective hard drive capture is to defragment the computer hard drive through an appropriate Windows tool such as disk defragmenter or disk optimizer (Ozer, 2003).

Artifacts and Other Editing Annoyances

DVDs are normally derived from some form of digital tape media including DV consumer digital mini DV tape or broadcast digital tape format such as DV PRO or DV CAM, D1, D2, D3, D4, etc. These digital tape formats are sometimes not totally devoid of any defects. There are a number of artifacts and other picture defects that are part of the digital recording world and usually come in three varieties, "mosquito noise," "quilting," and "motion blocking." Other picture defects include "drop outs" or "banding" (a sign of tape damage or head clogging). The most noticeable spatial artifacts are "feathering" or "mosquito noise," which involve diagonally fine detail corruption. These are compression-induced errors usually seen around sharp-edged text, and they show up as pixel noise within eight pixels of the edge detail. Spatial quilting artifacts can also be observed on certain diagonal lines, typically long straight edges about 20 degrees off of the horizontal axis.

[ILLUSTRATION OMITTED]

Sometimes it's possible to notice the quilting artifacts while panning slowly across a particular scene. Motion blocking occurs when the two fields in a frame are too different for the DV codec to compress them together. Motion blocking is best observed in a static scene shot through which objects are moving or in the immediate vicinity of the moving object. Dropouts may appear as small signal block errors or as multiple blocks depending upon the nature of the degradation (Puhovski, 2000).

Unlocked Audio or Poorly Synced Video with Audio

There have been numerous reports of "lip sync" problems where the audio lags behind the video or sometimes precedes the video. There have been numerous problems reported in the past with a variety of Pioneer and Sony models to include some PC decoder cards. The contributing factors to the sync problems include:

1. Improper sync in audio/video encoding or DVD-video formatting.

2. Poor sync during film production or editing.

3. Loose sync tolerance in the player.

4. Delay in the external decoder receiver.

Unfortunately, because DV was designed as a consumer format, unlocked audio was allowed to exist as a cost-saving measure where the internal audio clock is somewhat imprecise and up to plus or minus 25 audio samples can be written to tape in an imprecise manner. Normally the unlocked audio should not drift for too long a period of time before it does sync up with the video signal. The way the audio is recorded depends upon the type of DVD burner employed in producing the sound. The standard sampling rates are 32 KHz or two channels of 16 bit each of 48 KHz quality. The audio is interleaved with the video and both are recorded by the two rotating video heads. Along with the audio/video and other sub-code data, there exists small guard bands in DV tape production, which includes "header" information--basically a data packet and further includes SYMPTE time code, user bits, scene markers, camera location, etc. DV tape also contains sufficient "header" data that would result in possible corruption during playback if the sub-code data is improperly encoded on the tape (Puhovski, 2000). MLP is an auto coding scheme using proprietary technology developed by Meridian Audio and Associates. This lossy data reduction coding method operates by discarding information that is less important to the listener. In effect, MLP coding distributes the audio data more efficiently into small data rates for transmission and carries it in a protected environment along with its associated data. Previously the highest quality sound came from Linear PCM coding. As this format does not require mastering or playback to be entirely lossless, the MLP system was developed as a true lossless system. The original data is delivered bit-for-bit at playback. The sound data is therefore transmitted in exactly the same format as the producer intended. No elaborate listening tests are required to qualify this coding system, which guarantees delivery of the original recording over a number of different carriers and computing platforms.

[ILLUSTRATION OMITTED]

Displaying DVD Video

Video clips are normally displayed in two different methods: interlaced scan or progressive scan. Progressive scan is normally seen in computer monitors and digital TVs. They display all horizontal lines of the picture at one time. Interlaced scan normally uses standard television formats and displays only half of the horizontal lines at a time. It relies on earlier TV technology to blend the two different video fields together to create what appears to be a single picture. DVDs are designed to be interlace-scan displays, but if the original video format consists of a movie, it is highly recommended that a progressive scan DVD player be purchased that will play back the movie at the appropriate frame rate and resolution.

[ILLUSTRATION OMITTED]

DVD Production Basics

Essentially all DVD production involves three steps: Content Creation, Menu Creation, and Linking Menus to the appropriate content data.

After previewing the audio, video, and other content materials to ensure they are being played back as planned, it is necessary to compress the video files to MPEG-2 format in rendering the final DVD.

Computers do have the potential to produce better video than desktop video players by using progressive display and higher scan rates, but many PC systems fail to reproduce the picture quality as a home player connected to a quality TV, where the PC decoder cards or the VGA cards must have a TV output. The quality of the video provided by a PC depends in large part on the decoder's capabilities, the graphics card, the TV encoder chip, and other factors. In most cases a PC-based DVD burner connected to a progressive-scan monitor or video projector instead of a standard TV will usually produce better quality video.

There can be serious compatibility problems with recordable DVD formats. For example, many of the writable formats are fully compatible with each other or even with existing drives and players. Some later DVD versions that have a multi-logo are guaranteed to read additional DVD formats while a DVD multi-recorder can record using all three formats. Those individuals experiencing problems playing DVDs on their computer should get updated software. Incompatible drivers are the biggest cause of playback problems ranging from freeze-up to error messages to region code problems. It is recommended that you obtain tech support from the Web site of your equipment manufacturer and obtain the latest drivers for your graphics adaptor, audio card, and DVD decoder.

Technical Aspects of DVD Production

Digital video is comprised of a series of dots called pixels--each holding a different color value. For DVD, each grid of 720 squares by 578 squares represents a still image called a frame. It takes 30 frames to convey motion. For DVD audio, the resulting sound is comprised of both intensity and frequency information. For DVD, these numbers are "sampled" over 48,000 times a second, which is far superior than its analog counterpart. With digital signal processing, about 13% of the digital information before modulation is extra information, which is used for error correction. As the data is read from the disk, the error correction data is separated and checked against the remaining information. If it doesn't match, the error correction codecs are used to correct the situation.

A codec is an abbreviation for compressor/de-compressor, or encode/decode, depending upon its purpose. Essentially all video compression technology involves the encoding of the initial compressed file and then subsequent decoding for remote viewing. Familiar codecs include MPEG-1, MPEG-2, MP-3, MPEG4, Real audio, Real video, Sorenson, and Microsoft Windows Media video and audio. Most codecs involve two different types of compression to achieve their target data rates including intra-frame compression and inter-frame compression, which are techniques used to remove redundancies between frames.

Digital Audio Coding

DVD uses three different types of audio coding including MPEG-1, which has three compression techniques. MPEG-2 digital audio compression adds multiple channels and is backward compatible with MPEG-1 decoders. The primary audio coding for DVD manufacturer is Dolby digital, which provides up to 5.1 channels of discrete audio data. Dolby digital uses a frequency transform and groups the resulting values into frequency bands of varying widths to match the critical bands of human hearing. More than 50 million Dolby digital decoders are now situated throughout the United States compared to almost no MPEG-2 audio decoders.

DVD Internet Resource Sites

Top DVD info sites include:

1. Robert's D VD (www.robertsdvd.com)

2. DVD PHD (www.dvdphd.com)

3. The Digital Bits (www.thedigitalbits. com)

4. DVD File (www.dvdfile.com)

5. DVD Review (www.dvdreview.com)

6. Chad Fogg's DVD Technical Notes (www. tapeexpert.com/pdf/corrupteddvd.pdf)

7. DVD White papers from Sonic Solutions (www. tapeexpert.com/pdf/corrupteddvd.pdf)

8. Tristan's MPEG Pointers and Resources. (www.mpeg.org)

DVD Testing/Verification Services

Testing/Verification Services include:

1. CD Associates (714-733-8580)

2. Intellikey Labs in Burbank, CA (818-953-9116)

3. Sonic Solutions (www.sonic.com), which provides diagnostic tools for Windows

4. Testronic Labs in Burbank, CA (818-845-3223)

5. WAMO, URL of www.ivyhill-wms. com.

EnCase Forensic gives you additional software to conduct thorough and conclusive computer examinations. This system provides information on the investigation and documentation of many in-house crimes, including child pornography, domestic violence, harassment, narcotics, etc. without omitting valuable computer evidence or waiting on back-logged labs. This system was developed by criminal forensic experts and is accepted by courts throughout the world. EnCase allows investigators to manage large volumes of computer evidence by viewing all relevant files, and including "deleted files," file slack, and unallocated space. Once in, the files are created and the examiner can search and analyze multiple drives or other media simultaneously, using keyword searches, hash analysis, file specific filters, and multiple filters. (EnCase Forensics, 2006)

Suggested Forensic Examination Techniques

A duplicate either on hard drive or on a suitable DVD should be made as soon as the original evidence DVD has arrived. If playback or compatibility problems arise during the playback, it may be necessary to obtain, if not the original DVD burner, then at least a similar make and model instrument for playback of the questioned DVD recording. As many of the corrupt or edited DVD playback anomalies are readily discernible during a visual and aural review of the DVD, suspicious record events may be identifiable through appropriate CD-DVD diagnostic software. For example, CD-DVD Diagnostic is a useful program that recovers data from unreadable, scratched, corrupt, or defective CDs and DVDs. This particular program provides sector examinations, checks disk memory, and checks point issues. It also locates files that have been dropped from the directory structure, and the examination process is done automatically when errors are detected in the directory structure.

A device manufactured by Data Duplication Ltd. called FDA-100 is an automatic forensic disk reader/analyzer, which provides hardware solutions to corrupted DVDs. This device also analyzes disk and data information and allows for multiple examinations without rescanning. It also displays sectors and searches the disk surface for corrupted data. It is able to recover the original time stamp information when the disk was mastered.

An additional software program is provided by InfinaDyne in the Chicago area and includes a thorough examination of the DVD, which may take anywhere from a few seconds to hours depending on how the disk was recorded or if there were any errors returned while reading it. As errors are detected, a dialog is made to identify each suspicious sector. Analysis results are presented in three of the more common formats for writing a DVD, ISO-9660, Joliet, and UDF disks. InfinaDyne also provides periodic classes and is tailored for professionals in data recovery, forensics, and law enforcement.

The need for more effective DVD data recovery and forensic analysis will continue and may affect the admissibility and reliability of DVD evidence disks (Cain, 2005).

[ILLUSTRATION OMITTED]

References

Cain, S. (2004). CD copies of taped audio recording: A poor forensic alternative for attorneys. The Forensic Examiner, 13(2), 38-42.

Cain, S. (2005). Forensic examination of CCTV digital VTR surveillance recording equipment. The Forensic Examiner, 14(4), 47-49.

EnCase Forensic, (2006). EnCase Forensic. Retrieved October t4, 2008, from Guidance Software Web site: http://www.guidancesoftware.com/products/ef_index. asp

Ozer, J. (2004). Guide to digital video. Indianapolis, IN: Wiley Publishing Inc.

Puhovski, N. (2000). Standing committee for new technology. Retrieved from http://www.161.58.124.223/ archives/DV-Report

Taylor, J. (2004). Everything you ever wanted to know about DVDs. Columbus, OH: Magraw-Hill-Tab Electronics.

Taylor, J., Johnson, M., & Crawford, C. (2006). DVD demystified Columbus, OH: Magraw-Hill.

Earn CE Credit

To earn CE credit, complete the exam for this article on page 77 or complete the exam online at www.acfei.com (select "Online CE").

CE ARTICLE 4: Corrupted DVDs: An Emerging Forensics Problem ...

ATTENTION ACFEI MEMBERS: Journal-Learning CEs are now FREE when taken online. Visit www.acfei.com

TO RECEIVE CE CREDIT FOR THIS ARTICLE

In order to receive one CE credit, each participant is required to

1. Read the continuing education article.

2. Complete the exam by circling the chosen answer for each question. Complete the evaluation form.

3. Mail or fax the completed form, along with the $15 payment for each CE exam taken to: ACFEI, 2750 East Sunshine, Springfield, MO 65804. Or Fax to: 417-881-4702. Or go online to www.acfei.com and take the test for FREE.

For each exam passed with a grade of 70% or above, a certificate of completion for 1.0 continuing education credit will be mailed. Please allow at least 2 weeks to receive your certificate. The participants who do not pass the exam are notified and will have a second opportunity to complete the exam. Any questions, grievances or comments can be directed to the CE Department at (800) 592-1399, fax (417) 881-4702, or e-mail: cedept@acfei.com. Continuing education credits for participation in this activity may not apply toward license renewal in all states. It is the responsibility of each participant to verify the requirements of his/her state licensing board(s). Continuing education activities printed in the journals will not be issued any refund.

LEARNING OBJECTIVES

After studying this article, participants should be better able to do the following:

1. Identify the formats of DVDs and list their differences.

2. Name the characteristics o f a detective DVD.

3. Explain how corrupted DVDs may be excluded as reliable digital evidence.

CE ACCREDITATIONS FOR THIS ARTICLE

This article is approved by the following for continuing education credit:

(ACFEI) The American College of Forensic Examiners International provides this continuing education credit for Diplomates.

ABSTRACT

With technology increasing, so is the number of formats of a DVD, which when produced on a home computer results in defective DVDs. DVDs are normally derived from some form of digital tape media and the tape media are sometimes not totally devoid of any defects. One problem in particular is the lag of audio and video synchronization, which could be corrupted on DV tape and may be contaminated during playback. Forensically, DVDs and their different formats must be analyzed with more effective data recovery software to remain admissible as reliable tape evidence.

KEY WORDS: defective, DVD, CD, editing, format

TARGET AUDIENCE: forensic consultants, law officers, attorney, computer forensics consultants, court officials

PROGRAM LEVEL: update

DISCLOSURE: The author operates a polygraph business.

PREREQUISITES: none

POST CE TEST QUESTIONS (Answer the following questions after reading the article)

1. What is the most popular format of DVD today?

a. DVD-RW

b. DVD-R

c. DVD-RAM

d. DVD+R

2. What are characteristics of a bad DVD?

a. Lip sync problems

b. Missing frames

c. Continuous video

d. Correct timing and sync

3. What are the contributing factors of poor audio/video sync problems?

a. Damaged or defective DVD disks

b. Use of internal capture card

c. Use of external capture card

d. Optimized hard drive

4. What is the primary audio coding for DVDs?

a. WAV

b. CDA

c. MP3

d. QuickTime

5. What are the primary codecs employed in DVD production?

a. Real Audio

b. Real Video

c. Sorenson

d. MPEG-2

6. The best cable to use when transferring audio and video data to o DVD:

a. Composite

b. Component

c. IEEE 1394-Firewire

d. S-Video

EVALUATION: Circle one (1 = Poor 2 = Below Average 3 = Average 4 = Above Average 5 = Excellent)

If you require special accommodations to participate in accordance with the Americans with Disabilities Act, please contact the CE Department at (800)-592-1399.

By Steve Cain, MFS,

FACFEI, DABRE,

DABLEE

Steve Cain, MFS, MFSQD, DABFE, FACFEI, DABLEE, DABRE, served 22 years as both a Special Agent and forensic specialist with U.S. Secret Service and IRS National Crime Laboratories before founding Forensic Tape Analysis (FTA) in Burlington, Wisconsin. A majority of his business concerns the identification of questioned voice recording or issues relating to audio or videotape recording authenticity or corrupted CDs and DVDs. He is a Fellow of the ACFEI.
1 Information was relevant and applicable.                   1 2 3 4 5
2. Learning objective 1 was met.                             1 2 3 4 5
3. Learning objective 2 was met.                             1 2 3 4 5
4. Learning objective 3 was met.                             1 2 3 4 5
5. You were satisfied with the article.                      1 2 3 4 5
6. ADA instructions were adequate.                           1 2 3 4 5
7. The author's knowledge, expertise, and clarity were
   appropriate.                                              1 2 3 4 5
8. Article was fair, balanced, and free of
   commercial bias.                                          1 2 3 4 5
9. The article was appropriate to your education,
   experience, and licensure level.                          1 2 3 4 5
10. Instructional materials were useful.                     1 2 3 4 5
Gale Copyright: Copyright 2008 Gale, Cengage Learning. All rights reserved.