Authenticated — or Just Submitted?
Photographs, video, and audio are offered as evidence in nearly every matter now, and challenged just as often — as edited, staged, mis-dated, or machine-generated. Authentication is the work of establishing what a file actually is, where it came from, and whether it is what the offering party says it is.
What We Examine
Provenance & Metadata
- EXIF, container, and codec analysis
- Recording-device identification and attribution
- Timestamp verification against device, cloud, and network artifacts
- Detection of stripped, rewritten, or internally inconsistent metadata
- Distinguishing an original capture from a re-encoded or forwarded copy
Manipulation Detection
- Compression, quantization, and error-level analysis
- Splice, insertion, and edit-point detection in video and audio
- Analysis of re-encoding chains and generational loss
- Continuity analysis across frames and audio channels
Synthetic & AI-Generated Media
- Deepfake and face-replacement indicators
- AI-generated image and audio detection
- Voice-cloning indicators in disputed recordings
- Rebutting — or substantiating — a “that is a deepfake” objection
Abuse, DV & Protective Order Matters
- Authentication of photographic and video evidence of injury or conduct
- Establishing when an image was created, and on which device
- Discreet handling and secure custody of sensitive material
- Reporting written for the court without unnecessary republication of the content
“It looks real” is not authentication.
A file that renders correctly proves only that it renders. Authentication asks a different set of questions: does the embedded metadata agree with the file structure, does the file structure agree with the device it supposedly came from, and does any of that agree with the timeline the parties have alleged? Those answers are recoverable — but usually only from the original file and the device or account that produced it, which is why the preservation request matters more than the exhibit.
When we're typically engaged.
An Allegation Resting on a Photograph
When was the image captured, on what device, and has it been altered since? The metadata timeline often either corroborates the account or contradicts it outright.
A Recording Neither Side Agrees On
Continuity and edit-point analysis of an audio recording offered as an admission — including whether it is a continuous capture or an assembled one.
A Deepfake Objection
Technical analysis that either substantiates the objection or defeats it, so an exhibit is not excluded on an unsupported assertion.
Further reading on this practice.
- Social Media Forensics: Preservation, Collection, and Authentication Challenges
- Deepfakes and the Authentication Burden in Civil Litigation
- Pocket Evidence: How to Collect and Review Mobile Device Data