Multimedia stream hashing: A forensic method for content verification

Forensic examination of digital audio, video, and images frequently requires transforming multimedia data from one format to another. The transformative activity may cause changes to the administrative elements of the file but leave the multimedia streams unchanged and intact. However, the forensic science community has a method knowledge gap in accurately determining if the multimedia streams changed or remained the same in the transformative processes. This paper illustrates the practical use of multimedia stream hashing as a forensic method for verifying multimedia content. A universal stream hashing tool decodes the multimedia stream data at rest in a file container. Subsequently, it calculates the data stream hash using reference video, audio, and image codecs. This paper illustrates that the multimedia stream hashing method can accurately confirm the integrity of digital images, videos, and audio following transmission, transcoding, or re-containerization. Our findings confirmed that stream hashing could accurately detect changes in multimedia streams during transcoding. Furthermore, the stream hashing method can also accurately detect matching multimedia streams. In addition, this paper verified the forensic use of the multimedia stream hash method while establishing the error rate for its use. The hash algorithms used in stream hashing have zero false negative rates by design. However, the false positive (error rate) is extremely low and depends on hashing algorithm. Finally, we recommend the forensic science community adopt the multimedia stream hashing method as an initial testing method. The method can verify a multimedia stream's conversion (transcoding) from one codec to another using FFmpeg.