{'fraction_non_alphanumeric': 0.017857701818637117, 'fraction_numerical': 0.005963001220771903, 'mean_word_length': 4.87162286344422, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Anti- Forensics: The Tampering of Media

In the context of forensic investigations, the traditional understanding of evidence is changing where nowadays most prosecutors, lawyers and judges heavily rely on multimedia signs. This modern shift has allowed the law enforcement to better reconstruct the crime scenes or reveal the truth of any critical event.In this paper we shed the light on the role of video, audio and photos as forensic evidences presenting the possibility of their tampering by various easy-to-use, available anti-forensics softwares. We proved that along with the forensic analysis, digital processing, enhancement and authentication via forgery detection algorithms to testify the integrity of the content and the respective source of each, differentiating between an original and altered evidence is now feasible. These operations assist the court to attain higher degree of intelligibility of the multimedia data handled and assert the information retrieved from each that support the success of the investigation process.


1-Introduction
In an era of digital technology and multimedia development, there is no wonder that video, audio and photos serve as significant evidences in the forensic investigations.
These types of evidences allow the court to gain valuable information and clues convincing enough to accuse or exonerate the suspect.
But how much is multimedia a creditable forensic evidence to rely on?
In fact nowadays, with the advent of editing software tools, not only cybercriminals but also non-experts can tamper captured photos or alter the content (audio/video) of any scene at ease. "Seeing is no longer believing." This potential danger of false evidence imposes providing the authenticity of video and audio before they are produced as evidence in the court of law. Such operations like thorough video analysis, photo forgery and audio tampering detection lead to fruitful and authentic prosecution results.

-General Background
In a world devoid of forensic science, criminals, thieves, assaulters and drug traffickers would be roaming scot-free. Criminal, and even civil investigations, are incomplete without forensic science which deals with the examination and analysis of various types of evidences in order to establish facts admissible to the court of law.
Of all the disciplines that deal with forensic science, digital forensics has the potential to be one of the most collaborative ones since it touches almost every aspect of our life nowadays (5) . The fact that nearly every area of the current time is supported by electronic devices, like smart phones, tablets and digital cameras..., strongly contributes to the steadily increasing importance of digital evidence in crime investigation. One significant element of this kind of evidence is multimedia content, which just like physical evidence, must be followed to reveal the truth behind every serious event.

International Journal on Recent and Innovation Trends in Computing and
Since modern life is unthinkable without multimedia and electronic data, the legal system widely recognizes the pivotal role of video, audio and pictures in the investigations and conviction of the court. Upon realizing this substantiality, recent studies show that up to 80% of the cases are forensically interpreted with the support of digital evidences including multimedia as investigative tools (8) . Hence instead of restricting the process by conventional tools and relying only on blood spatters and DNA swabs, that undoubtedly play a vital role in the forensic investigation, multimedia evidence contributes to much of the overall incident scene analysis in ways that may not appear obvious at first.
Eventually there is nothing more cogent to the court and the justice system in their forensic deductions than hearing an audio sent by an intimidator or looking at a burglar face in a video surveillance footage for example. However when analysis is commonly associated with multimedia techniques as forensic evidences, the main focus is on the identification of the authenticity of their content and the information elicited from due to the high possibility of tampering which might lead to injustice in the results.

I. Video 1-Video as Forensic Evidence
Since a few years, a smart-phone camera has become a common property and the spread of video surveillance cameras has widely increased due to the recognition of their role in preserving public and private security. Because of the availability of the recording equipment, an exponential progression of the use of videos as investigative tools is seen nowadays.
A video is a visual multimedia source forming a moving picture to which an audio component corresponds after combining a series of images (3) . Starting from this definition, there is nothing more persuasive to the court in making its verdict based on an evidence that allows watching the whole scene under investigation, hearing all the voices and visualizing all the evidences .
In many cases the only witness to a crime could be a video surveillance camera. This will serve as a key in identifying and finding a criminal or assaulter's face or soft biometrics like height, weight..etc.
Corroboration of witness or suspect statement could also be done with the aid of video evidence recorded by a security camera (16) . Instantly, it can reveal the direction of travel of the perpetrator into or away from the crime scene that helps in the process of the traces' collection and examination. Add to this the common trend of capturing every incident or event through our smart phones that play a potent role in verifying the identity of the suspect appearing through. Many of the violence acts, abuse, terrorism, physical threats, crimes committed in public areas are recorded via our electronic devices and digital cameras, spread on social media and act as a robust evidence in the prosecution.
Was the theft alone or in a multi-person-assisted robbery? What was the model of the car through which the burglar flee? Did the perpetrator look sane when he committed the murder or psychologically unstable? Many more questions could be answered depending on a video record which emphasize on the power of video evidence in analyzing an event aiding investigation and initializing the judgment. Despite its significance, nowadays any type of video could be exposed to tampering due to the easy-to-use and available forgery techniques which makes relying upon it unlawful if the authentication of each evidence is not tested previously to its analysis.

Figure 2 CCTV footage (32)
Eventually it is worthy to mention that there are several types of recorders used to create digital video evidences . Some of these are : • CCTV / DVR : closed-cicuit TV digital video recorder • CCTV / NVR : closed-circuit TV network video recorder

2-Video Enhancement and Analysis
According to the circumstance , the type of recordings retrieved is unique in each case as thus its analysis and enhancement is unique as well . Though some recordings appear to be unclear and useless, the collection of every footage is a must for a forensic enhancement technique could clarify unnoticeable details in the video before its processsing (16) . Following the collection of the evidence , the model of the recording device , details about the recording system and the current time/date and that of the recorder's display must be noted by the investigator .

2.1-Basic methods of video enhancement
The technology of today's video recording has evolved from analog , cassete tape recordings , to digital where information is recorded using data blocks of 0s ans 1s (16) . Whether a video evidence is analog or digital , the forensic expert early step after evidence collection must be the creation of a working copy of the video before processing it . This assures the availability of the unaltered form of the original evidence for further comparison with the processed copy.
The handling of a video forensic evidence should be carefully done where the content of the recorded data should never be changed but rather only enhanced. The employment of the video enhancement techniques is important to obtain promising results from the video analysis (16) . Such techniques include : • Video Stabilization : produce smooth video playback by decreasing the amount of the movement in a video • Sharpening : clarify the edges of the pictures in the video making them clearer and more distinct • Masking : protect witness or suspect by covering areas in the video if the record is to be published • Interlacing : combine two television fields for producing a full frame of a video when working in analog system • Demultiplexing : isolate each camera when multiple video signals are combined into a single signal in CCTV

2.2-Amped FIVE Software for Video enhancement
In the context of video enhancement , it is very essential to shed the light on one of the most potent video enhancement softwares Apmed FIVE . Along with other powerful softwares like Blackstone , this latter is on which most law enforcement surveillance and security applications , militiary operations , forensic labs and civil litigations mostly depend on due to its convenience , accuracy , simplicity and its capability of producing complete and rigorous outcomes (25) .
In a fast , precise and simple way , Amped FIVE provides a complete solution to the video processing and analysis . The main key element in Amped FIVE design is to maintain the integrity of the original evidence since any manipulated or doctored evidence will be absolutely excluded by the prosecutors , judges and courts .
The concept of Amped FIVE is based on filtering in which every filter takes the video generated by the previous one and the result will pass to their output filter after processing . By this strategy if any value was modified on a previous filter , this will be reflected as a modification of the  (2) . This filtering concept is very fast and precise to guarantee high effectiveness of this software .
The features and advantages supplied by Amped FIVE are paramount through the video evidence processing and analysis .
Some of these options include : 1-Motion blur correction    Figure 9 Airplane number before and after clarification (39) 5-Average framing

Figure 13
Latent fingerprints before and after enhancement (42) Because Amped FIVE is able to support any video format , reduces time and effort due to its fast processing , generates automatic and accurate reports and has high performance in targeting any type of data from latent fingerprints , crime scene digital videos to CCTV recordings (2) , it has become the world's top revolutionary solution for video enhancement and analysis .

3-Video Tampering
The contents of digital videos and recordings serve as valuable evidences and provide crucial information that form the basis of several consequential decisions in the fields of forensic investigations. Since the initialization of the use of video evidence in the courts, its content had been considered infallible. However, the huge proliferation of the inexpensive and portable video-capture devices like digital cameras and cell phones that most people carry nowadays along with the wide spread of variety of low-cost video editing tools has led to the realization that this is no longer the case. A potential danger is produced by this combination as today anyone has the ability to modify the content of a certain video at ease according to his or her wish. From here the necessity of video authentication was enlarged in order to assure the credibility of the evidence to rely on (8) .
Before going into details concerning video authentication in the next section, let's shed the light on video tampering and its types. What is video tampering?
Video tampering is the process of furtive manipulation of the content of a video (3) .This easy task is done for the purpose of changing the real meaning conveyed by the imagery in the video by concealing or altering an object or event in the video content. In general the several types of video forgeries are categorized into two: Inter-frame forgery and Intra-frame forgery. It is called partial manipulation since only a small part of the frame is modified and the rest of the frame regions remains unaltered (3) .

Figure 15 Deletion of video frame objects (42)
While adding an object to the scene could be simple, removing an object from the video frame does not sound so. How will the region left behind the removed part from the scene be covered so that the frame appears as a complete untouched one? This is solved by Impainting Technique. This technique helps restoring the missing part and tainted region left after object deletion in the most visually plausible manner (9) .
One important type within the copy/paste forgery is the Green Screening or Blue Screen Compositing (3) . This allows changing the background in the targeted video and merging any other view or scene behind the foreground objects. (42) b. Upscale Crop Forgery: cropping specific frames of a video which allow the elimination of evidence present in a crime scene for example. To fill the gap created, enlargement of the affected frames is followed to maintain resolution consistency of the whole video.

Figure 17
Cropping objects from video frames (42) These are all examples of how malicious video tampering is and how the created plausible video forgeries could be inconspicuous to a human eye.

3.3-Video Reenactment: Face2Face System
Tampering a video content by cropping a frame to hide a suspect, changing the background to alter time and location or removing an object to conceal evidence could sound familiar to a lot of people somehow. Many of the video-editing softwares like Adobe Premier, Photoshop, Light works and Cinelerra lead to results that most people expect and find simple (9) . But what about manipulating a video in real time to alter the facial expressions and the saying of a target person?! This idea was not considered believable at first.
The existence of new kinds of face tracking softwares has taken the days when we could trust what we see in a video to an official end .The up growth of video reenactment or face tracking algorithms like that of Face2Face led to astonishing outcomes. This latter tends to animate facial and vocal expressions of the target actor in a video by a source actor synthesizing a photo-realistic manipulated output (29) . (42) Face2face can be applied to any video type or format for example a Youtube video (29) . After selecting the targeted person speaking in a video, one should use a standard webcam to capture video of someone (the source actor) whose facial expressions to be transferred to the targeted individual. An efficient and fast reenactment will be carried out by processing both videos by Face2Face system (28) .

Figure 18 Video Reenactment Input and Output
The reenactment output video is rendered in the most believable manner so that no one could ever think that there might be a possibility of manipulation in the video watched. While some people find it funny, the idea has a scary and illegal side. Imagine that someone can synthesize a whole video of you making you say words you didn't and transferring the source actor's facial expressions such as lips movements and eyebrows raises to your face. You, the video subject, will turn into the actor's puppet via a flawless face masking system (28) . This concept is dangerous and malicious if taken deeply into consideration. When such a perfectly manipulated video act as an evidence, it can mislead many investigations and judgments, convict many innocent ones and proliferate bias and injustice.

4-Video Authentication
A video evidence is expected to provide a truthful depiction of any event under investigation. For this reason interpreting any video evidence and relying on its content in the courts, video authentication is a must. The evaluation of the authenticity and integrity of the video has become attainable since the development of video tampering detection techniques that aim at finding traces left after any forgery creation. These techniques are classified into active and passive (26) .

Figure 22 Types of Video Tampering Detection
Methods (45)

4.1-Active Tampering Detection Technique
Active techniques are based on watermarking and digital signature (9) . Watermarking represents embedding content-based specific codes or digital producer identification labels unique for each multimedia file to verify integrity (25) . Digital signatures represent the digital identity that can also be used to sign a file in which any modification in the content will change this signature as well (26) . These methods provide key information to detect any video manipulation. However some video capturing devices lack the ability of embedding a watermark or digital signature into the video recording. In these cases active techniques will fail to expose tampering traces (25) .Video authentication in such situations leans on passive detection techniques .

4.2-Passive Tampering Detection Technique
Passive techniques or what called blind tampering detection techniques are independent of watermarks and digital signatures (26) . They check the authenticity of the video by detecting the footprints left by the video editing operations in the video content. Such footprints help in predicting noise , frame intensity values , motion residues , abnormalities in optical flow and many other complex calculations that these algorithms rely on to detect tampering (26) . No further details concerning these calculations will be discussed since these contain complicated information only comprehended by IT experts. It is good to mention that if a perpetrator is aware of these fingerprints and uses anti-forensic tools to hide or reduce them, this process itself will create another footprint to be detected. In fact passive techniques are classified into three: 1-Detection of double compression: This type is based on the idea that the compressed video must be decompressed before tampering it. After modifying the content the forged video will be restored in compressed format. Hence the resultant altered has undergone double compression which leaves footprints as artifacts that can be detected by blind tamper detection techniques (26) .

2-Region tampering detection:
This type is applicable in case of copy/ paste and region/frame duplication tampering. It is based on algorithms that identify the exact location of tampering in the video (26) .

3-Video inter-frame forgery detection:
This type is used for detecting inter-frame tampering like deletion, insertion and duplication. It consists of many algorithms that are specific for each kind. One of them is MCEA (Motion Compensated Edge Artifacts) technique that detect frame deletion tampering by producing digital spikes in the locations where frames were deleted (tampered) (25) .

4.3-VideoCleaner for Video Enhancement and
Authentication VideoCleaner is a powerful video enhancement and tampering detection software that uncover the truth in a world of distorted realities (30) . It is one of the most efficient video authentication softwares upon which law enforcement rely on worldwide. VideoCleaner facilitates the analysis and enhancement of the video evidence prior of checking its integrity and authenticity. This is done through its effective features such as increasing details clarity, removing electrical noise, correcting the viewing perspective, repairing recordings, improving the brightness of poorly lit scenes and many others that make every small detail in the video content obvious (30) .

Figure 23 VideoCleaner Outcomes (46)
Beside the potent features of VideoCleaner to enhance the analysis by uncovering any hidden details in the content of the video , its recent version has a new 'Forensic Section' that can detect tampering in the video evidence . For example in the figures below , VideoCleaner processsed the frame captured in a video to detect any presence of tampering . As shown in the last pictures , the forensic tools of VideoCleaner has detected the presence of tampering in the specified locations due to pixels difference with respect to the original untouched regions in the relative frame (30) .

Figure 24 Spotting video tampering traces via
VideoCleaner Algorithm (47) Today VideoCleaner, along with several others tools for video enhancement and authentication, delivers a clear and credible video evidence to rely on during forensic investigations. Many research studies are looking forwards to provide more vigorous and precise tools to optimize and check the authenticity of the video evidences.
Eventually there is a growing prominence of using videos in the forensic investigations for their paramount role in assisting the courts to make their judgments. This importance of the video evidence compels checking its authenticity and makes it an imperative due to the wide range of tampering techniques available nowadays.

III.
CCTV / Video Surveillance One of the most powerful video evidence on which many investigators across the globe use in their investigations of crimes and critical events is the recording of the camera surveillance system . Many countries aoround the world are employing CCTV surveillance camera systems in their public and private spaces for recognizing its importance as a tool to secure their streets , airports , businesses , shopping centers , car parks and houses , capture a crime as it unfolds and prevent crimes from happening by discouraging criminals that they will be spotted .
Video surveillance systems or what is called CCTV ( closed ciruit television ) is a system that relies on a strategic placement of cameras for the aim of monitoring , watching and recording a particular location , event or person for the purpose of security and governing activity (8) .

1-Advantages of CCTV
There a several ways in which CCTV footages act as vauable evidences for court trials , help in police operations through crime investigations and deter crime commission

2-CCTV tampering
The primary objective of employing surveillance cameras to extract information to track and identify individuals and their activities and detect crimes , will be misfired in case the recording is tampered or the camera is hacked and distorted . Concerning this issue, tampering a CCTV recording is the impact of extrinsic or intrinsic factors (25) . Extrinsic camera tamper attacks are categorized to 3 types (27) , including : • Defocused camera event : altering the focal length of the camera that leads to blurring of the content of the captured video • Covered camera event : occluding the camera lens partially or totally by external objects • Moved camera event : changing the camera viewing angle by external forces (27) All of the three types will be help the perpetrator by inhibiting his face identification .
On the otherhand, intrinsic manipulation of the video recording is also applied by permenantly deleting the recorded footage or altering and distorting the video content via antiforensisc techniques. Practical experiments (as shown in the table ) were done using different iOS devides through file signature and timestamp based antiforensic algorithms and showed that the targeted video can be altered and deleted where no data recovery effort is attainable (13) .

3-CCTV Tampering Prevention and Detection
One solution to reduce the possibility of extrinsic physical tampering in a surveillance camera is activating Tamper Detection setting within the IP camera. This setting will allow sending alerts to the corresponding owner when the camera is tampered with (27) . It is available from several leading IP camera manufacturers including Vivotek, Optica and Axis (25) .

Figure 29 Tamper Detection Setting (52)
If anyone is trying to knock the camera down or any other action has been detected to partially or totally block the camera view , Tamper Detection will notify you and the alert will let you know to log into the video management system to see what happened (27) . This option helps detect individuals' malfunctions and peculiar acts and hinders the occurrence of a complete crime by permitting to quickly recall the police officers on the response of the alert sent from the camera distorted in the area.
While this solution, along with many methods for preventing camera hacks like data encryption and firmware updates, seems helpful and simple, it is not always the case. Regarding intrinsic manipulation where the content of video recording is deleted or altered, other more potent techniques are needed. A proposed method for CCTV video content integrity verification is Unified Tamper Detection Algorithm (12) . This algorithm is based on detection of tamper events by measuring the rate of edge pixels disappearance in the current frame compared to the edge pixels in the background frame resulting in a rate termed EDR ( edge disappearance rate ) (12) . Based on complex operations and further calculations depending on this concept, any deletion or alteration of an object or individual in the video frame will be spotted.

Figure 30 Detecting tampered bus video frame using Unified Tamper Detection Algorithm (53)
In this picture the edge characteristics of the foreground object (the bus) differ from those of the occluded region (where the bus was excluded in the tampered frame) (12) . This will be reflected as an abrupt change in the number of pixels in the current frame which is manipulated. Extraction of the foreground objects could be done with the help of complex algorithms like background-subtraction-based video analytics algorithms (12) .

IV. Audio 1-Audio as Forensic Evidence
The important role that video recordings play to assist the forensic investigations does not minify the contribution of audio recordings in the same role. Though an audio lacks the visual part supplied by a video, it can provide the law enforcement and the investigators with significant clues and missing proofs to solve, analyze and judge the case under investigation.
An audio is any sound that can be heard by the human ear within the acoustic range and most commonly exist in the mp3 audio file format (23) .

Figure 31 Audio Recording (54)
The impact of audio recording in facilitating the interpretation of large-scale crimes and events exponentially expanded over the past decades. An example of how audio recording can act as an efficient link to complete the puzzle of forensic investigation is the case of Dr. Richard Kimble in the movie The Fugitive (16) . When he was running from the police, he called Chicago Police Department to proclaim his innocence. Though he ended the call before the police could trace it, Dr. Richard was not aware that the sound of the L-train was so loud and can be obviously heard in the phone call. That little detail in the background of the recording which he did not anticipate helped the police to track him and find his location in Chicago by analyzing the audio of the phone call (16) . That is one of the instances in which audio recording renders a valuable evidence in the prosecution of any tough case. In addition to the previous example, an audio recording when rightly collected, enhanced and analyzed can potentially serve a lot of information in many other ways. One of these include identification of particular weapon types. When an audio is recorded in real-time shooting during a crime, fight or war, it can help through weapon signature analysis methods to detect the type used and then establish the order of firing as well (23) . Likewise, an audio can specify the make and model of vehicle used in a certain crime or event via vehicle signature analysis of an available audio recorded at the time of occurrence. Moreover an audio is very useful throughout the investigation of air accidents whereby the cause of the crash can be established by the analysis of aircraft engine noise (23) .

International Journal on Recent and Innovation Trends in Computing and
Despite all the above paramount roles of audio evidences, foremost its primary advantage is in speech recognition and talker identification (8) . This is done by analyzing phone calls between criminals, voicemails recordings containing threats or planning for a crime, telephone answering machines, police /911 calls and audio files containing immoral content. These audio sources and many others help the investigators to identify the suspects and collect other useful information like their number and location.

Figure 33 Audio Evidence Types (55)
Various types of audio recordings can be analyzed to serve as a potential forensic evidence. These include: • Recordings made on smart phones • Answering machines' recordings • Voice mails • Audio content of videos • Digital handheld recorders • Cassette tapes • 911 police calls • Courtroom recordings Regardless in any format an audio evidence is, its authenticity must be established before submitting it to the court to reveal if any tampering method has been applied.

2-Audio Enhancement and Analysis
For an audio recording to bring out specific aspects of an event and facts concerning a particular incident its content must be enhanced prior to any interpretation. This process is important to clarify the audio recording content in order to be intelligible to the investigator, attorney and judges in the court. The techniques of forensic audio enhancement must be applied aiming at reducing the unwanted noise and increasing the desired sounds in order to improve the overall quality of the audio content (16) . In this way the enhanced audio will provide an accurate representation of the events.
Similar to the case of video, audio enhancement and analysis is specific to each case and varies with the type of recording device and whether an audio is digital or analog. Despite the uniqueness of each audio recording, there are basic steps that must be followed in the process of audio enhancement and analysis.

Strategy of audio enhancement and analysis:
i.
Critical Listening After creating a duplicate to preserve the original copy of the audio, the early step of audio enhancement and analysis is critical listening whereby each section of the audio is identified (16) . The purpose of this step is to detect the depth of enhancement required by each section of the audio content based on the recorded characteristics including signal to noise ratios and frequency ranges (15) .
For example an audio recording might contain three different portions that require different processing. The first one represents an audible conversation between two people with traffic jam noise from a distance. In a second section the speech clarity decreases due to significant amount of background noise. The third section contains no background noise but rather the people were talking quietly with low voices. Each of the three sections requires specific type of processing and enhancement that is identified by an expert in critical listening. ii.
Noise Reduction As the main purpose of audio enhancement is to remove unwanted sounds, this step is substantial. The techniques applied for this process are the most effective in the context  (23) .

Figure 34 Noise Reduction Step (56)
Compression is applied to boost the faint sounds and reduce the background noise in the audio content (8) . This is done by leveling the signal so that the dynamic range of the material is reduced making soft sounds more apparent (16) . On the other hand echo cancelation is applied for decreasing the reflection of noise and reverberance of space that reduce the clarity of audio content (23) . Hence these techniques ameliorate the intelligibility of the recording and hinder the presence of noise that might become an issue in further processing .
Waveform of a recording made at low volume with significantly loud ambient noise that is masking the speech content of the recording (16) .

Figure 35 Audio Recording before and after enhancement step (57)
The same recording after enhancement. The noise is attenuated and the volume of the speech is increased (16) .
iii. Frequency Equalization Now after the audio has become less noisy, frequency equalization is applied for additional help in boosting the desired sounds. Using specific and highly accurate equalizers to cut specific ranges of frequency bands the speech content becomes clearer. Usually the frequency bands containing speech content ranging between 200Hz and 5000Hz are isolated and amplified (15) . Whereas the frequencies corresponding to loud background noises and unwanted overtones will be reduced making them less noticeable. Every specific audio content needs specific number of processors to achieve the desired results (15) . iv.
Forensic Transcript Forensic audio experts demand the formation of forensic transcript in combination with critical listening and frequency analysis in the process of audio enhancement. A forensic transcript is the scientific observation of words under controlled conditions (23) . It is important for verification of spoken dialogue that occur in the recording as the latter is the main wanted sounds to be retrieved. Forensic audio transcription adds certainty to the enhancement and analysis of the audio as it appends a signed scientific document that is sworn by the expert witness as to the words that are spoken ending by: 'Based on the pains and penalties of perjury, I testify that the above forensic transcript is an accurate representation of the dialogue (or events) spoken during the time of this recording so help me' then we sign it.' (8) As the forensic transcript produced by an expert who is able to conclude to a reasonable degree the unintelligible words that were spoken, it becomes an essential part that must accompany other methods of audio enhancement and analysis.

3-Audio Tampering
"Words fade but voices remain". Yet, the widely spread forgery techniques can turn the rigorous evidence that an audio recording supply to an unreliable one. Currently there are hundreds of softwares that are highly qualified in manipulating any audio recording at ease and in a very short time. In spite of the diverse tampering techniques that can alter the recording in various ways, all of them are based on four methods of falsification (8) .

3.1-Basic methods of audio manipulation • Deletion :
stopping the tape to remove wanted words or sounds by over-recording unwanted areas • Synthesis : using artificial means and specific algorithms to add words or voices to the tape • Obscuration : masking certain waveform patterns to mix voices or sounds which will be reflected in the recording as sudden stops and starts in inappropriate places • Transformation : changing the content of the recording by altering the arrangement of words Though the four basic types of tampering have potent capability of manipulating the audio content to nay desired form, they leave detectable magnetic signature in the tape that can be identified through audio inspection by an expert (23) . Some of the electromechanical indications -signatures -left by tampering softwares include gaps, fades, transients and equipment sounds (8) .

International Journal on Recent and Innovation Trends in Computing and
• Gaps : represent segments in the recording containing unexplained content's changes like sudden silence , humming or buzzing • Fades : represent gradual loss of the volume of sounds ( when complete inaudibility occurs fades will become gaps ) • Transients : represent abrupt and short sounds like pops and clicks • Equipment sounds : represent inconsistencies in the audio content caused by the recording equipment itself like whistles or varying pitches

3.2-Voice Morphing and Cloning Softwares Adobe ProjectVoco
Among all the audio editing and content altering softwares, Adobe ProjectVoco is one of the most interesting to shed the light on. As the well-known Photoshop applications tweak digital images, ProjectVoco affects the audio in the same way. The codenamed software ProjectVoco is designed to be one of the most potent audio editing applications. Beyond the familiar features of standard speech editing and noise cancelation that ProjectVoco provides, what makes it a subject of attention is yet so unique. The standout feature of ProjectVoco is the capability to generate new words in the recording using the speaker's recorded voice (14) . This means that it is able to add words to the audio file that were not originally found before. In fact the software targets at least 20 minutes of the desired recorded speech (14) . By understanding the makeup of a person's voice, ProjectVoco is able to replicate it generating sound-alike voice saying words that were not said in the original speech. The insertion of newly spoken words is activated by simply typing the desired words and the algorithms of ProjectVoco does the rest of the process resulting in a modified content of the audio recording via inserting unsaid words into the voiceover .

Figure 36 Adobe ProjectVoco Algorithm (58)
ProjectVoco, Wavenet which is another software for generating realistic human-like voices (15) and other similar softwares appear to be very beneficial for audio engineers when working on clips, TV shows, dialogues and news where people may desire to add or change a word or phrase in their speech. Though there are several ethical sorts of applications facilitated by employing ProjectVoco, its unlawful dark side is really worrisome. Imagine if someone records an audio by your own voice saying words that you have never said. The idea itself is so creepy. What if the audio contains a speech mentioning people names that you have not ever known? What if the audio manipulates the time you said that you were planning to go to a certain event? What if the audio contains indecent and abusive verbalism expressed by your voice? What if any of these and other manipulated forms of speech by ProjectVoco are submitted and considered a genuine evidence in the court! Since ProjectVoco has the potential to falsify entire sentences using a person's voice in a near-perfect replication of the talker's , awareness must be raised to general publicity and law enforcements regarding the doctored audio clips that could be generated by such malicious technique .

Lyrebird
The outcomes generated by audio editing softwares like ProjectVoco are really impressive but nothing compared to these of Lyrebird. Lyrebird is a voice cloning software unveiled by artificial intelligence (14) . It consists of a set of algorithms that are able to create incredibly humanlike synthesized voices by listening to a very short segment of the person's recorded audio. Unlike ProjectVoco that requires at least 20 minutes of the sample audio to alter the voice content, Lyrebird needs a very small segment of the recording cutting this requirement down to just one minute (14) . This means that using only one minute of sample audio, Lyrebird is able to create any voice which is a process that was seen impossible a few years ago (5) . To add more truthfulness to the voice output created, Lyrebird algorithms are able to infuse emotions with the speech it creates as

Figure 37 Lyrebird Software (59)
Similar to ProjectVoco, Lyrebird also has an advantageous role when employed in the right places. With the help of this advanced software, it is now feasible to read audio books with famous voices and synthesize speeches for people with disabilities or for animation movies (14) . These and many other uses are identified for this powerful tool that can create thousands of sentences in less than seconds after the voiceprint is already detected. Besides, there are other troubling uses of Lyrebird as well. Since the results generated are indistinguishable from human speech, it is possible now to produce a whole audio content, not just a word, by someone's voice who has not spoken what is said in the recording. Through this synthetic voice generator one can steal the identity of anyone and record an audio by his/her voice stating incidents that did not happen, confessing fake truths or replying to questions that he/she has not even answered. These dangerous consequences are very misleading especially when such recordings are used as forensic evidences in the courts. The veracity of audio recordings is brought to question due to the perfectly voice synthesizing software Lyrebird with hardly detectable tampered outcomes. This problem is solved by releasing this technology publicly so that it becomes available to anyone and everyone is aware of its results as they are aware now of the manipulated photos by Photoshop. By this way the forensic investigations should go deeper when analyzing an audio recording subjoining it with other evidences to testify its reliability and originality (5) .

4-Audio Authentication
The verification of audio recording originality and integrity is a necessity to neglect the possibility of tampering and make its content reliable in the legal field. Because manipulation of the recording has become an easy task, evaluating the authenticity of the audio is done before it is considered a valuable evidence furnishing credible facts. Several methods are developed to check if any malicious or accidental tampering has been applied to the audio under investigation.

4.1-Basic methods of audio authentication: i. Electronic Measurement
The main concept of electronic measurement is to check the frequency ranges of the voices in the audio (16) . If any sudden shift in the available frequency to a smaller or larger one occurs, this will be a sign that certain alteration was done. In a similar way any sudden unexplained changes in the background noise or the sudden appearance of a new source of noise are also signs of manipulation (23) . The tools used for measuring this parameter are spectrograms, level meters and frequency analysis panels that are helpful is observing minute changes.
Visual Inspection Visual inspection goes hand in hand with electronic measurement whereby analysis of frequency information and physical wave property are done. The interpretation of the waveform is a critical step in audio authentication. Since waveforms are smooth and continuous, any sudden break in the recording waveforms indicate that a certain edit has been done (23) . Another example of how waveforms' characteristics sign for an alteration is the case when a waveform is inverted. Waveforms sudden breaks , inversions and other similar signs of edits are visualized in a full frequency spectrum shown by the spectrogram (15) . iii.
Analyzing Metadata in Digital Audio Evidence This method is exclusively applied on digital audio recordings but not for analog ones like standard audio cassette (16) . When an audio is digitally recorded, an extra information can be interpreted while performing audio authentication. Information about how the recording is made and the type of equipment used to create the audio are  (23) . Any alteration in the audio content leaves specific footprints in the recording hexadecimal information indicating that the audio was loaded into a software program for audio editing (15) .When analyzing metadata of a certain audio an exemplar -a recording made in the same kind of recorder and in close environment of the original -must be established to check any inconsistencies in the data signing for tampering (8) .

4.2-ACUSTEK for Audio Authenticity
Acu-expert has released its powerful software, ACUSTEK, for audio tampering detection and authenticity analysis. It is made of a set of instruments that are developed to expose the traces left by audio manipulating techniques (1) . What make it really beneficial are its various useful characteristics such as producing repeatable results, being fast and easy to use, supporting all audio formats, and having scientific fullness since all signals authenticity approaches are covered. ACUSTEK has solved the issue of authenticity analysis and so that it becomes accredited by many forensic audio labs and investigation centers on the world (1) . Some of the diverse features of ACUSTEK include: Further specifications are valid in ACUSTEK to help reveal any basic audio forgery. Though ACUSTEK does not provide a definitive answer when dealing with cases of tampering like audio cloning as previously discussed, it helps in the following processing once the audio recording is considered doubtful. Regarding other common tampering methods, ACUSTEK is the fundamental solution for unmasking any audio manipulation. Forensic audio experts and researchers are looking forward to develop more advanced technological procedures to depend on for testing the authenticity and reliability of any audio recording. Photo as Forensic Evidence "Which we drink in at our ears does not piercingly enter as that which the mind does conceive by sight." Even for a well-trained brain, it is not easy to get a precise conception of any object, location or event via verbal description only. Here comes the role of digital images that offer great assistance for the forensic investigations and the presentation of the cases. There is no doubt that some cases do not rely on photographic support in the first place to be solved, whereas in other cases a photo might be the sole primary evidence (11) . It can now be said that photography has established an important branch in the law evidence. Since a photo is nothing but a frame taken from a video footage , it plays the same vital roles as those of a video evidence like corroboration of a witness or suspect statement and verifying criminals' identities . This essential function of the digital images when served as a forensic evidence admissible to the court does not abolish the importance of proving its authenticity (6) .

Figure 43 Photo Evidence (63)
As easy as the video is doctored and forged like previously shown in the first section, a photo can be manipulated and modified in various forms where no clue of tampering can ever be detected by a human eye (4) .Hence a potent evidence like a digital image to be reliable and play its role when submitted to the court, it must be first properly identified. Its integrity must be tested and its accuracy and credibility must be shown by diverse techniques specialized for photo authentication (10) . Because all the processes that are applied to a video are similar to these used for a digital image starting from enhancement and analysis to tampering methods and authentication softwares , in this section no further details will be elaborated and repeated concerning each of them .

II. Photo Tampering Image Steganography
It is notable in the present time how easily an image can be manipulated by cropping, cloning, concealing objects and many other options provided by the wide range of the advanced tampering techniques that were previously depicted in details (4) . However none of these can be compared to how powerful it is to hide whatever data you want under the veil of a single digital image. This is the potency that image steganography offers.
Steganography is the art of hiding the fact that communication is taking place by hiding the information in other information (17) . It has all started from the Greek Histories where a Greek nobleman named Histaeus needed to secretly communicate with his son-in-law living in Greece (24) . For this aim he shaved the head of one of his most trusted slaves and tattooed the text message onto the slave's scalp so that when the slave's hair grew back, he was dispatched with the hidden message (24) . For that reason steganography is a word of Greek origin where "stegano" means "cover" and "graphia" means "writing" (17) .

Figure 44 Image Steganography (64)
The hidden information can be texts, images, audio or video files carried in many different file formats where the digital images are the most commonly used. Then among the four types of steganography: Text, Image, Audio and Video Steganography, that which is done via an image is the most popular (24) .
The basic principle of steganography is significant for the privacy of users, national secretive data transmission and even encrypted communication between criminals whereby an invisible secret message is embedded in another file and only proper decryption methods can detect the presence of this hidden data (17) . Such process of exposing steganography is known as steganalysis that is applied via several tools such as Amped Authenticate which was mentioned in previous sections (24) .

Figure 45 Image Steganography Process (65)
In the context of forensic investigations and lawful prosecutions, steganography is considered a controversial subject whereby it facilitates the movements and connection between criminals enabling them to secretly communicate  Figure 46 Types of Image Steganography (66) Image domain techniques also known as spatial domain techniques employ bit-wise methods that embed the secret messages in the intensity of pixels directly which make them referred as simple systems (24) . This type of techniques is only applicable for specific image formats hence they are typically image format dependent.

International Journal on Recent and Innovation Trends in Computing and
Transform domain techniques also known as frequency domain techniques whereby images are first transformed before embedding the message into its content (17) . This is done with the help of manipulation algorithms and image transforms involved in the process of such techniques. The transformation step that precede hiding the message in the image makes these techniques more robust than spatial domain ones for the message will be hidden in more significant areas of the cover image. In contrast to image domain techniques, transform domain ones are image format independent (17) . One of the most commonly used steganographic methods is the Least Significant Bit LBS substitution. It is one of the spatial domain techniques with pretty impressing outcomes. The principle of this method is based on the idea that each image can be split into individual bit-planes each consisting of different levels of information where secret messages can be simply embedded (24) . The below applications done via this method clearly illustrates its strategy. LBS is one of many others of the steganographic methods employed for hiding information (24) . These methods vary with respect to their function depending on various factors that play a role in evaluating each technique's performance. Some of these factors include invisibility by human eye, robustness against statistical attacks, supporting different image formats (17) ... etc.

International Journal on Recent and Innovation Trends in Computing and
No steganographic technique encompasses all the strength points together to form an ideal method but no matter how many weaknesses, it has no steganalysis is possible without proper complex software for detecting and retrieving the hidden message specifically for each case (10) .

VI.
Experimental Part In this part several experiments were done to demonstrate how the advanced softwares and tools like the ones previously described aid in the forensic investigations through enhancement, analysis and authentication. The following cases consist of photos/video frames that were figuratively submitted as evidences and processed by various softwares like Amped 5, Amped Authenticate, Griffeye Analyze and Camera Ballistics to uncover the truth and assist the prosecution.

1-Experiment 1: Experiment using Amped 5 and Amped Authenticate
Consider that the law enforcement agency was informed about a bank robbery incident by a gang of four thieves. After they broke into the bank and collected an amount of money from the bank officers under stress and fear, they prepared to escape after hearing the police alarms from a distance. Three of them succeeded to reach their car and fled while the last one was a bit late and was left behind. Although the four of them were wearing face masks during the crime, the fourth thief uncovered his face when he reached the street outside the bank. He hid in a very dim light location for a few minutes waiting the police cars following his partners' car to get far away. Then he decided to leave his place and ride a public bus anticipating that no one has figured him as one of the burglars. The police cars were distracted and failed at catching the criminals. As a result the four of them succeeded to flee.
This case could not be solved without the following digital evidences that were analyzed and submitted to convince the court and expose the identity of each of them.
One of the evidences was a video frame taken from a CCTV footage of one of the street cameras near the bank. Despite that CCTV cameras of the bank failed to identify the thieves due to their face masks and that the fourth burglar thought that his face cannot be recognized or captured in poor light conditions, the result achieved after analyzing the frame was astonishing. Via Amped 5 video enhancement software previously described in details, the dark unclear frame captured by the outside CCTV cameras was enhanced and detected the facial identity of the hidden burglar. The digital forensic expert utilized this tool due to its powerful options and promising outcomes.

part I
Steps done using Amped 5 Software 1. Load the evidence picture Using the features box: 2. Click on Adjust then modify the Exposure value 3. Click on Presentation then choose Compare Original in order to compare the photo before and after the enhancement Figure 49 Evidence picture before and after correcting the light exposure The second piece of evidence was an image of the vehicle number of the bus that the criminal rode, taken by a camera of the agent's mobile phone. The police was aware that the criminal was hiding and asked one of their secret agents to stay and track him in order to gather more information about the other gang members. Unfortunately he could not follow the bus till the end but he was able to

Figure 50 Evidence picture before and after deblurring
A third digital image as well served as a significant evidence. The vehicle number of the car through which the three criminals firstly fled was captured by a witness who was in a car beside the passing car. The photo was taken from an angle in which the vehicle number at first was impossible to be identified and the image looked useless. That was before processing the image by Amped 5 to change the perspective and show the number of the car clearly.
part III Steps done using Amped 5 Software  Figure 51 Evidence picture before and after correcting the perspective When the fourth burglar was heading to the bus his mobile phone fell down and was left behind. The investigators precisely examined all the messages, calls and media files in his phone but could not find an evidence that help in solving the case. One of the pictures examined as unfruitful was an image containing food content sent to the criminal's phone via WhatsApp from an unknown number in a suspicious time. It was first seen as a useless photo but since the digital forensic expert was aware of steganography he decided to analyze it more deeply. After processing the photo, it was revealed that a text message was hidden through it which was planned by the gang as a way of secret communication in case they faced any issue during or after the crime. The text message detected after uncovering its content helped the forensic investigators, along with the other evidences, to track the criminal as it was an escape plan sent by one of the criminals that was still free.

2-Experiment 2: Experiment using Griffeye Analyze
Griffeye Analyze is an innovative software used by law enforcement agencies and national security in order to analyze multimedia evidences. This versatile tool helps in detecting critical clues, identifies relationships between suspects and crimes and connects criminals to old crimes via referring to a huge database. The four core components of Griffeye Analyze Software include: i.
Analyze DI : represents a revolutionary approach to a large amount of multimedia data ii.
Analyze CS Operations : works collaboratively on cases while connected to a shared database which allow the results to be achieved more quickly iii.
Analyze CS Enterprise : collects and manages data across organizational borders allowing access to all relevant materials ever collected iv.
Analyze Forensic Market : provides modules through digital markets allowing users to access tools and means for addons The platform of Griffeye Analyze works with any partner application like facial recognition ones to review individuals' history and analyze relations with other suspects and crimes which exponentially reduced the time consumed during the investigations. With the help of this advanced software, more cases are now being solved since critical clues are no longer missed but rather correctly identified and connected.
After the suspect was detained by the police they wanted to examine if he was linked to other previous crimes.
They also needed to look if he was connected to other people that could or could not be suspects but either ways still help in solving the case .For this purpose the digital forensic expert aimed at processing the criminal's face image via Griffeye Analyze Software.
Steps done using Griffeye Analyze Software 1. Load the criminal's image to be analyzed along with the database 2. Right click on the criminal's image 3. Click on the Search button then choose Similar Faces

3-Experiment 3: Experiment Using Camera Ballistics
Camera Ballistics is an advanced software that utilize unique advanced algorithms in order to detect the camera source through which a certain picture was captured. This helps to identify if an image is taken by a suspect's device or not. The principle of this technological tool is based on metadata, the information that describe any digital item's content. It also uses mathematical processes in order to analyze the physics of each camera sensor. Since metadata is specific for each multimedia file, this software generates a sensor fingerprint unique for each device by using this type of information. Camera Ballistics is an essential software for the forensic investigators for it can differentiate between devices even from the same make and model to tell if there is a match between the evidence picture and the sensor fingerprint.

Figure 57 Camera Ballistics Interface
After gathering the proper information that led the police to identify the location in which the gang used to plan for the crimes, they break into the place for collecting more evidences. Among these was a USB device that contains a picture of a bank that was attacked one year ago but the case was closed for lacking enough evidences to solve it. The investigator aimed at analyzing the source through which the photo was captured. For this purpose he used the phone that was dropped by one of the criminals to detect if it matches with the photo source.

Figure 58 Photo of the bank attacked one year ago
Steps done using Camera Ballistics Software 1. Click on Learn then load 30 images captured from the suspect's device ( it its preferred to load photos of the sky or walls for quick processing ) 2. Click on Next then save the generated sensor fingerprint of the device 3. Click on Home then choose Analyze 4. Load the evidence pictures 5. Click on Next then Report Automatically 6. Save the report 7. Access the report and read the results to detect if there is a matching probability as the case testified below Report: results of analysis After analyzing the report it appeared that the camera model Nikon P900 through which the photo was taken is the same as that of the criminal's camera. Along with the suspect confession later on, it was confirmed that the same gang is also accused for the bank robbery that happened last year. Hence the two cases were solved and closed.

4-Experiment 4: Experiment Using Amped Authenticate for Deletion Detection
In addition to the other evidences that were examined in the location in which they used to plan their crimes, one of the investigators found a firearm under the bed. They dragged the firearm on a white background to preserve all the traces, took the appropriate photos and transferred it to the laboratory for further analysis.
However one day later the firearm disappeared from the laboratory and the pictures were altered in a way that no firearm appears in them. The investigator was shocked, questioned the second investigator that was with him and decided to detect the manipulation in the captured photos.

International Journal on Recent and Innovation Trends in Computing and
Steps done using Amped Authenticate 1. Load the evidence picture Using the features box: 2. Choose *histogram equalization* then *intensity-false-x: 0, y: 0, w: 0, h: 0 3. Click on View Box then choose Unprocessed Vs Processed to compare the picture before and after tampering detection Figure 61 Evidence picture before and after erasing the evidence In the first part the figure shows the photo of the weapon before being tampered while the second one shows the traces of deletion after processing the white forged photo. Hence he detected that the captured photos were tampered and someone intended to erase the evidence from the pictures. After several questioning and investigation, the second investigator appeared to be an inside man that aimed at reducing the severity of their judgment and was accused along with the criminals as well.
Consequently the suspects were tracked, their location was identified, their identities were unveiled and the case was closed. The experiments of processing each of the images showed how potent these softwares are for enhancing and analyzing the photos that were seen nonsense and unavailing. It was also indicated how a correctly enhanced and analyzed digital evidence such as videos and photos support the common traditional evidences and play a vital role in the forensic investigations .

VII. Conclusion
The past decade has previously seen unimagined advances in the field of digital forensics due to the wide proliferation of multimedia and its trending tools. By the time being investigators' work limits are no longer restricted by the traditional physical evidences they used to only rely on. The potent role that multimedia tools like video, audio and photos play as forensic evidences drove the court for approving their admissibility and emphasizing on their significance in convincing them to make their decisions and judgments.
Although video, audio and photos are paramount evidences that assist the investigators, any unnoticeable incident of tampering will definitely mislead the whole investigation. The possibility of manipulating any multimedia file has increased with the evolution of technological softwares and algorithms specialized for tampering and alteration .The latest advances of tampering is the creation of a whole video sequence of a human face making speech from a handful of photographs by the researchers of Samsung AI Center . On the other hand various advanced softwares are developed to check the authenticity of any multimedia evidence and ensure its integrity and originality. As shown in the previous experiments, different techniques nowadays assist the job of a digital forensic expert in doing so. The technology that delivered such enhancement and authentication tools and made the multimedia evidences credible enough to rely on has made a big favor for the forensic investigators for interpreting any critical event or crime incident .