GB/T 45432-2025Forensic sciences - Forged video and image of a person - Source identification (English PDF)

1 Scope

This document specifies the examination equipment for the source identification of forged video and images of a person in the field of forensic science, describes the examination procedure, and specifies the types of expert opinion, the basis of judgement and the wording.

This document applies to the source identification of forged video and images of a person in the field of forensic science.

2 Normative references

The contents of the following documents constitute indispensable provisions of this document through normative reference in the text. For dated references, only the version corresponding to that date applies to this document; for undated references, the latest version (including all amendments) applies to this document.

GB/T 29360 Forensic sciences - Specifications for the forensic examination of electronic data recovery; GB/T 29362 Forensic sciences - Specifications for the forensic examination of electronic data search; GB/T 45429 Forensic sciences - Forged video and image of a person - General rules for examination; GA/T 1018 Technical specification for the examination of images of objects in video; GA/T 1019 Technical specification for the examination of images of vehicles in video; GA/T 1023 Technical specification for the examination of images of persons in video.

3 Terms and definitions

The terms and definitions given in GB/T 45429 and the following apply to this document.

Source characteristic: an indication contained in a video or image that relates to the process by which it was formed, that is to its capture, its production or its forgery.

Source information: information in a video or image concerning the person in the picture, the time-and-place environment, the image file, the capture device and the forgery tool.

Source identification: the process of extracting and analysing the source characteristics of a questioned item in order to determine its source information.

4 Examination equipment

Routine examination equipment. The routine examination equipment includes computers, image scanners, video players, image viewers, hash calculation tools, metadata viewers, audio and video editing software, and compilers for programming languages.

Source examination equipment. Hardware and software that assist in examining the source characteristics of a video or image in respect of the person in the picture, the time-and-place environment, the image file, the capture device and the forgery tool, including but not limited to equipment for examining forgery-model noise, equipment for examining sensor pattern noise, equipment for authenticity examination, equipment for comparing images of persons, vehicles and objects, equipment for image processing, equipment for image searching and equipment for image restoration.

5 Examination procedure

Securing and preserving the questioned item. Where the questioned item is a paper image, it is scanned with an image scanner at a resolution of not less than 1200 dpi and converted into a digital image. Where the questioned item is digital media, the appearance of the carrier holding it is recorded photographically and the storage location of the item within the carrier is recorded. The questioned item is given a unique number and its file attributes and hash value are recorded. Enquiry is made as to whether the questioned item has a suspected source in terms of the person in the picture, the time-and-place environment, the image file, the capture device or the forgery tool.

Collection of samples. According to the requirements of the examination and the state of the questioned item, sample video or images are collected as follows: in the examination of the source of the person in the picture, other images of the person suspected of appearing in the picture should be collected as samples; in the examination of the source of the time-and-place environment, video or images of the suspected same time-and-place environment should be collected as samples; in the examination of the source of the image file, the suspected source image file should be collected as a sample; in the examination of the source of the capture device, other video or images captured by the suspected source device should be collected as samples; and in the examination of the source of the forgery tool, other video or images produced by the suspected source forgery tool should be collected as samples. The appearance of the carrier holding the sample is recorded photographically and the storage location of the sample within the carrier is recorded. The sample is given a unique number and its file attributes and hash value are recorded. Where necessary, in accordance with the relevant provisions of GB/T 29362 and GB/T 29360, a data search or data recovery is carried out on the carrier of the questioned item in order to obtain, as samples, other video or images that may share its source.

Examination of metadata. The metadata of the questioned item and of the samples are inspected, including format, duration, resolution, frame rate, recording time, encoding time, marking time, software and copyright. Source characteristics are then extracted from those metadata, including but not limited to: characteristics related to the source of the person in the picture in fields such as the file name and the record of operations; characteristics related to the source of the time-and-place environment in fields such as the file name, the latitude and longitude and the timestamp; characteristics related to the source of the capture device in fields such as the device type, the lens, the image size and the encoding method; and characteristics related to the source of the forgery tool in fields such as the software, the copyright and the record of operations.

Analysis of source characteristics - person in the picture. The source characteristics of the person in the picture are analysed, including but not limited to: characteristics of the splicing of the person; the shape and proportions of the hair, facial features, neck, trunk and limbs; behavioural characteristics such as expression and movement; characteristics of the consistency of face and body; characteristics of the plausibility of clothing and accessories; and characteristics of subtitles, watermarks and sound related to the source of the person in the picture.

Analysis of source characteristics - time-and-place environment. The source characteristics of the time-and-place environment are analysed, including but not limited to: characteristics of the consistency of illumination between the person and the background; the time-and-place characteristics reflected by roads, buildings, vehicles, furniture and decoration in the picture; the date, time and spatial position reflected by clocks, signs and plaques in the picture; the splicing and perspective characteristics of persons, vehicles, objects and scenes in the background; the consistency of weather phenomena such as rain, snow and fog with the date and time of capture; and characteristics of subtitles, watermarks and sound related to the source of the time-and-place environment.

Analysis of source characteristics - image file. The source characteristics of the image file are analysed, including but not limited to: the course of the events shown; the positional relationships of persons, vehicles and objects in the picture and how they change; the characteristics of the scene, the lighting arrangement and the composition; phenomena closely bound to a single act of imaging, such as noise, blur and occlusion; editing characteristics such as the video cover, subtitles, transitions, end titles, sound effects and filters; and watermarks, marks, blockchain traceability codes and similar characteristics related to the source of the image file.

Analysis of source characteristics - capture device. The source characteristics of the capture device are analysed, including but not limited to: the encoding characteristics of the video or image; trace characteristics such as lens artefacts, chromatic aberration, dead pixels and dirt shown in the picture; noise characteristics such as the photo-response non-uniformity and the fixed pattern noise of the device; characteristics of local pixel correlation produced by the arrangement of the colour filter array and the interpolation algorithm of the device; and traceability characteristics such as metadata and watermarks related to the source of the capture device.

Analysis of source characteristics - forgery tool. The source characteristics of the forgery tool are analysed, including but not limited to: forgery characteristics reflected in the person, for example defects at the hair or the teeth; trace characteristics closely bound to the forgery tool, such as ghosting and blur in the region of the person and in the background; noise characteristics introduced by forgery models such as generative adversarial networks; and traceability characteristics such as metadata and watermarks related to the source of the forgery tool.

Comparison of source characteristics. The source characteristics of the person in the picture in the questioned item and in the samples are compared: the questioned item and the samples are cropped, rotated and rescaled; the similarity of the images of the person in the questioned item and in the samples is calculated; and, in accordance with the relevant provisions of GA/T 1023, the characteristics of the images of the person are compared by measurement, splicing, superimposition and similar methods. The source characteristics of the time-and-place environment are compared: the questioned item and the samples are cropped, rotated and rescaled; characteristics related to a particular time of capture and to the background environment are compared, for example traces of light and shadow on buildings, particular arrangements of signs and symbols, and the relative positions of persons, vehicles and objects; and, in accordance with the relevant provisions of GA/T 1018 and GA/T 1019, the image characteristics of vehicles and objects are compared. The source characteristics of the image file are compared: the file attributes and hash values are compared; the changes of persons, vehicles, objects and scenes in the picture are compared, for example continuous movements of a person or fortuitous events; and the local arrangement of pixels and the way it changes with time are compared by measurement, splicing, superimposition and similar methods. The source characteristics of the capture device are compared: the metadata, the watermarks and the encoding characteristics are compared; defect characteristics with a particular pattern, such as artefacts, chromatic aberration, dead pixels and dirt, are compared; and the noise characteristics reflecting the capture device are compared. The source characteristics of the forgery tool are compared: the metadata, the watermarks and the encoding characteristics are compared; the defect characteristics produced by forgery with compositing or generative tools are compared; and the forgery-model noise characteristics reflected in the questioned item and in the samples are compared.

Evaluation of source characteristics - person in the picture. In evaluating points of agreement, attention shall be paid to the degree of confusion of identity; to the higher value of source characteristics from high-resolution images of a person; to the higher value of local, dynamic and distinctive characteristics of low probability of occurrence; and to the higher value of characteristics such as tumours, moles, patches, pockmarks, squint, crooked mouth, cleft lip, missing teeth and scars of particular form; differences in local facial characteristics do not affect the evaluation of the points of agreement. In evaluating points of difference, the following shall be excluded: changes of characteristics caused by the forgery operation; by beautification, colourisation or change of style; by different angles and conditions of capture; by image compression, deformation, degradation and noise; by changes of expression and state; by natural growth and development; by injury or disease; by make-up or cosmetic surgery; by disguise; by death; by later rephotographing and processing of the image; and by changes of time and place.

Evaluation of source characteristics - time-and-place environment. In evaluating points of agreement, attention shall be paid to selecting individually discriminating features when analysing roads, buildings, vehicles, furniture and decoration; to the fact that agreement in the overall characteristics of the environment shown carries more value than agreement in a single object; to the higher value of points of agreement in changeable features such as temporary decoration of buildings, particular arrangements of objects, and damage or stains on walls; and to evaluating points of agreement in the relative positions, illumination relationships and occlusion relationships of persons, vehicles and objects in the background against the specific time and weather. Where the questioned item is a video, cases in which the same time-and-place environment appears in successive frames are analysed as a whole. In evaluating points of difference, the following shall be excluded: changes in date and time characteristics caused by an unsynchronised clock; changes in environmental characteristics caused by the passage of time; changes caused by different angles and conditions of capture; changes caused by the state of the sky and by the weather; changes of spatial position caused by disturbance in satellite or base-station positioning; changes caused by image compression, deformation, degradation and noise; and changes caused by human alteration.

Evaluation of source characteristics - image file. In evaluating points of agreement, attention shall be paid to the higher value of points of agreement in fortuitous events in the picture and in continuous movement and change of persons, vehicles and objects; to the fact that agreement in dynamic characteristics carries more value than in static ones, that agreement in a complex picture carries more value than in a simple one, and that agreement across several frames carries more value than in a single frame; to the fact that agreement in the arrangement of pixels may be evaluated subjectively or with objective indicators such as the peak signal-to-noise ratio; and to the fact that the stronger the consistency in the shape, colour and variation of the local areas where the pixel arrangement agrees, the greater the value of the agreement. In evaluating points of difference, the following shall be excluded: changes caused by the forgery operation; by format conversion; by image compression, deformation, degradation and noise; by adjustment of the visual appearance; by digitisation, rephotographing and similar operations; and by editing of the video or image.

Evaluation of source characteristics - capture device. In evaluating points of agreement, attention shall be paid to the fact that metadata may have been altered, so that agreement in metadata characteristics cannot on its own serve as a basis for judgement; to the higher value of agreement in photo-response non-uniformity noise for images of simple content and ample light; to the fact that points of agreement in key frames carry more value than in ordinary frames, and that points of agreement in a simple daytime picture carry more value than in a complex night-time picture; and to the greater reliability of agreement when the samples are numerous and of high quality. In evaluating points of difference, the following shall be excluded: changes caused by the forgery operation; image characteristic changes produced by physical changes in the capture device; changes in device noise characteristics caused by differences in picture content and capture environment; changes caused by format conversion; changes caused by image compression, deformation, degradation and noise; and changes caused by adjustment of the visual appearance and by image editing.

Evaluation of source characteristics - forgery tool. In evaluating points of agreement, attention shall be paid to the fact that metadata may have been altered, so that agreement in metadata characteristics cannot on its own serve as a basis for judgement; to the fact that agreement in dynamic characteristics carries more value than in static ones and that agreement across several frames carries more value than in a single frame; to judging the value of points of agreement in traceability characteristics together with the authenticity and completeness of the questioned item and the ease with which the mark can be tampered with; and to evaluating as a whole the points of agreement in file type, naming convention, picture size, duration, compression parameters, borders and filters. In evaluating points of difference, the following shall be excluded: changes caused by different versions of the forgery tool; by the choice of algorithm, mode and parameters; by differences in the pre-trained model; by format conversion during uploading, downloading and transmission; by image compression, deformation, degradation and noise; and by adjustment of the visual appearance and image editing.

Integrated analysis. The degree of agreement between the questioned item and the samples in respect of the source of the person in the picture, the time-and-place environment, the image file, the capture device and the forgery tool is evaluated as a whole. An integrated analysis is then made of whether the questioned item and the samples share a source, including but not limited to: the value of the points of agreement and of difference in source characteristics; whether the questioned item points sufficiently to a particular identity for the person in the picture; whether the source of the time-and-place environment is exclusive; whether the source of the image file is original; whether the source of the capture device can be distinguished from other devices of the same model; whether other forgery tools could produce the same or similar characteristics; and whether other reasonable doubt can be excluded.

6 Expert opinion

Types of expert opinion. The expert opinion of a source examination falls into the following five types: source affirmed; source denied; source inclined to be affirmed; source inclined to be denied; and no source found. The type of opinion is determined and worded in accordance with 6.2, and more detailed source information may be given in accordance with Annex A.

Source affirmed. The questioned item has been examined in full and reliable source characteristics have been extracted. The points of agreement in the source characteristics of the questioned item and of the samples are numerous and of high quality, and their overall value fully reflects a common source. The opinion should be worded: the source of the person in the picture, the time-and-place environment, the image file, the capture device or the forgery tool of the questioned item, or of the questioned item at a stated time or place, is such and such.

Source denied. The questioned item has been examined in full and reliable source characteristics have been extracted. The points of difference in the source characteristics of the questioned item and of the samples are numerous and of high quality, and their overall value fully reflects different sources. The opinion should be worded: the source of the person in the picture, the time-and-place environment, the image file, the capture device or the forgery tool of the questioned item, or of the questioned item at a stated time or place, is not such and such.

Source inclined to be affirmed. The questioned item has been examined in full and fairly reliable source characteristics have been extracted. The points of agreement in the source characteristics of the questioned item and of the samples are of fairly high quality, and their overall value broadly reflects a common source. The opinion should be worded: the source of the person in the picture, the time-and-place environment, the image file, the capture device or the forgery tool of the questioned item, or of the questioned item at a stated time or place, is considered likely to be such and such.

Source inclined to be denied. The questioned item has been examined in full and fairly reliable source characteristics have been extracted. The points of difference in the source characteristics of the questioned item and of the samples are of fairly high quality, and their overall value broadly reflects different sources. The opinion should be worded: the source of the person in the picture, the time-and-place environment, the image file, the capture device or the forgery tool of the questioned item, or of the questioned item at a stated time or place, is considered unlikely to be such and such.

No source found. The questioned item has been examined in full, but the source information is insufficient. The opinion should be worded: no source has been found for the person in the picture, the time-and-place environment, the image file, the capture device or the forgery tool of the questioned item, or of the questioned item at a stated time or place.

Annex A Examples of the description of source information (informative)

Table A.1 provides more detailed source information in support of the forming of an expert opinion.

For the person in the picture, the categories are the image of a natural person, with the example "image of Zhang San", and the image of a virtual person, with the example "image of the virtual person Emily". For the time-and-place environment, the categories are the outdoor environment, with the example "west gate of No. 17 Muxidi Nanli", and the indoor environment, with the example "the bedroom in Zhang San's home". For the image file, the categories are the digital image, with the example of a file named IMG_20240709_07443.jpg, and the video material, with the example of a file named VID20230514131837.mp4. For the capture device, the categories are the fixed device, with the example "the camera on the east side of the first floor of the Dingxiang Restaurant", and the mobile device, with the example "Zhang San's mobile phone of a stated brand and model". For the forgery tool, the categories are the compositing tool, with the example "the Swapface tool", and the generative tool, with the example "the Vimi large model".