Validation of image stream hashing: A forensic method for content verification

How do forensic examiners know if they have altered an image stream when converting a digital image from one codec or file container to another for analysis? Forensic standards and best practices recommend avoiding alteration or degradation of multimedia data during transcoding. An image stream hashing method was recently introduced to the forensic science community to answer the question above. This paper offers an initial validation study of image stream hashing method that may answer the question above. The first half of the study's experiments tested the image stream hashing method to measure fitness for use in forensic science while identifying errors and limitations. The study's second phase analyzed the systematic errors detected in initial tests to discover error causation. Causation analysis identified four method limitations subsequently used to develop proposed standard controls of method operations. The final study phase repeated the initial experiments used in the first phase while implementing the proposed standard controls of method operations. Initial test results indicated the method had significant error rates, limiting the effectiveness of the method to only three of the five file types used in the study. The final testing phase revealed that implementing proposed standard controls of method operations reduced the potential systematic errors to a negligible level when using the image stream hashing method for content verification. The validation study concluded that examiners could use the image stream hashing method for forensic science only by implementing error mitigation techniques that utilize the proposed standard controls of method operations.