OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

1

OSAC 2022-S-0031

Standard Guide for 

Forensic Digital Video 

Examination Workflow

Video/Imaging Technology and Analysis Subcommittee

Digital/Multimedia Scientific Area Committee

Organization of Scientific Area Committees (OSAC) for Forensic Science
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

2

Draft OSAC Proposed Standard

OSAC 2022-S-0031

Standard Guide for Forensic 

Digital Video Examination Workflow

Prepared by 

Video/Imaging Technology and Analysis Subcommittee

Version: 1.0

August 2022

Disclaimer:

This OSAC Proposed Standard was written by the Organization of Scientific Area Committees 

(OSAC) for Forensic Science following a process that includes an open comment period. This 

Proposed Standard will be submitted to a standards developing organization and is subject to 

change.

There may be references in an OSAC Proposed Standard to other publications under 

development by OSAC. The information in the Proposed Standard, and underlying concepts and 

methodologies, may be used by the forensic-science community before the completion of such 

companion publications.

Any identification of commercial equipment, instruments, or materials in the Proposed Standard 

is not a recommendation or endorsement by the U.S. Government and does not imply that the 

equipment, instruments, or materials are necessarily the best available for the purpose.

To be placed on the OSAC Registry, certain types of standards first must be reviewed by a 

Scientific and Technical Review Panel (STRP). The STRP process is vital to OSAC’s mission of 

generating and recognizing scientifically sound standards for producing and interpreting forensic 

science results. The STRP shall provide critical and knowledgeable reviews of draft standards or 

of proposed revisions of standards previously published by standards developing organizations 

(SDOs) to ensure that the published methods that practitioners employ are scientifically valid, 

and the resulting claims are trustworthy.

The STRP panel will consist of an independent and diverse panel, including subject matter 

experts, human factors scientists, quality assurance personnel, and legal experts, which will be 

tasked with evaluating the proposed standard based on a comprehensive list of science-based 

criteria.

For more information about this important process, please visit our website 

at: https://www.nist.gov/topics/organization-scientific-area-committees-forensicscience/scientific-technical-review-panels. 
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

1

1 Standard Guide for Forensic Digital Video Examination

2 Workflow

3 1. Scope

4 1.1. This guide provides a generalized workflow suitable for all digital video examinations 

performed to address forensic questions1 5 .

6 1.2. This workflow includes the assessment, processing, and analysis of video. Prior steps 

7 such as the retrieval and proper handling of the evidence are assumed. Refer to ASTM 

8 WK61709, Standard Practice for Data Retrieval Digital Video Recording Systems and 

9 SWGDE Best Practices for Digital Forensic Video Analysis for additional information.

10 1.3. This standard is intended for use by competent forensic science practitioners with the 

11 requisite formal education, discipline-specific training (see Practice E2917), and 

12 demonstrated proficiency to perform forensic casework.

13 1.4. This guide does not purport to address safety concerns. It is the responsibility of the user 

14 of this standard to establish appropriate safety and health practices and determine the 

15 applicability of regulatory limitations prior to use.

16 1.5. No system units are required for this standard guide.

17 2. Referenced Documents

18 2.1. ASTM Standards:

19 2.1.1. E860, Standard Practice for Examining And Preparing Items That Are Or May 

20 Become Involved In Criminal or Civil Litigation, ASTM International, West 

21 Conshohocken, PA, 2013, www.astm.org

22 2.1.2. E2825, Standard Guide for Forensic Digital Image Processing, ASTM 

23 International, West Conshohocken, PA, 2019, www.astm.org

24 2.1.3. E2916, Standard Terminology for Digital and Multimedia Evidence Examination, 

25 ASTM International, West Conshohocken, PA, 2019, www.astm.org

1 OSAC Technical Series 0002R1 A Framework for Harmonizing Forensic Science Practices and Digital/Multimedia 

Evidence details these questions are addressed using a specific and finite number of core forensic processes 

labeled as 1) authentication, 2) identification, 3) classification, 4) reconstruction, and 5) evaluation. 
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

2

26 2.1.4. E2917, Standard Practice for Forensic Science Practitioner Training, Continuing 

27 Education, and Professional Development Programs, ASTM International, West 

28 Conshohocken, PA 2019, www.astm.org

29 2.1.5. ASTM WK61709, Standard Practice for Data Retrieval Digital Video Recording 

30 Systems, www.astm.org

31 2.1.6. ASTM WK66417, Standard Guide for Training Guidelines for Video Analysis, 

32 Image Analysis and Photography, 

33 https://www.astm.org/DATABASE.CART/WORKITEMS/WK66417.htm

34 2.2. SWGDE Material:

35 2.2.1. SWGDE Best Practices for Digital Forensic Video Analysis Version: 1.0 

36 (November 20, 2018, v1.0)

37 2.2.2. SWGDE Technical Overview of Digital Video Files Version 1.0 (July 18, 2017) 

38 2.2.3. SWGDE Best Practices for Forensic Audio

39 2.2.4. SWGDE Best Practices for Image Content Analysis

40 2.2.5. SWGDE Fundamentals of H.264 Coded Video for Examiners

41 2.2.6. SWGDE Best Practice for Photographic Comparison for All Disciplines

42 2.4 OSAC Material:

43 2.4.2 OSAC 2021-S-0037, Standard Guide for Photogrammetry

44 2.4.3 OSAC 2021-S-0036, Standard Guide for Image Authentication

45 OSAC 2022-S-0001 Standard Guide for Image Comparison Conclusions/Opinions

46 2.4.4 OSAC Lexicon [https://lexicon.forensicosac.org/] 

47 2.4.5 Preferred Terms 

48 3. Terminology

49 3.1. Definitions:

50 3.1.1. For definitions of terms used in this guide, refer to Terminology E2916, OSAC 

51 Preferred Terms or the OSAC Lexicon.

52 4. Summary 

53 4.1. The digital video examination workflow includes the following three domains: 

54 assessment, processing, and analysis. The general workflow and procedures used in each 

55 domain may be the same regardless of the evidence submitted by the requestor.
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

3

56 4.2. Assessment tasks involve the review of the submitted items for suitability for 

57 examination, determination of the region(s) of interest, and the preparation of a working 

58 copy to be used during examination.

59 4.3. Processing tasks involve the production of deliverable output products or intermediate 

60 products to be used for examination.

61 4.4. Analysis tasks involve the interpretation of information extracted from the submitted 

62 items to answer the questions posed in the requested examination.

63 5. Significance and Use

64 5.1. The workflow and task domains presented in this document create a consistent 

65 framework upon which forensic video service providers can structure their services, 

66 division of duties, and operating procedures.

67 5.2. A given examination may not require the performance of tasks from all of the domains 

68 described.

69 5.3. Depending on one's training, an individual forensic science practitioner could be 

70 authorized to perform tasks from one or more of these domains.

71 6. Assessment Domain of Forensic Digital Video Examination Workflow

72 6.1. Actions performed during the assessment of video evidence are the foundational steps 

73 necessary before implementing the Processing or Analysis workflows, or both, which are 

74 listed later in this guide. The assessment workflow is as follows: 

75 6.1.1. Review the request to determine that it is technically feasible, that it can be 

76 accomplished by the forensic service provider, and that the required resources are 

77 available.

78 6.1.2. A working copy of the evidence shall be created and verified through a hashing 

79 function. 

80 6.1.3. An initial technical review of the video file should be performed and any issues 

81 should be documented (e.g., aspect ratio problems, inconsistent playback speed, 

82 required proprietary player).

83 6.1.3.1. Interrogation of the video file(s) should be performed to determine display 

84 attributes relevant to processing and analysis such as display resolution, pixel 

85 aspect ratio, frame rate, and codec. 
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

4

86 6.1.3.2. A comparison of file interrogation results from multiple tools or manual 

87 parsing and decoding of a file’s binary data is recommended. Technical 

88 observations about the video and any discrepancies in the reported results 

89 should be documented and evaluated. 

90 6.1.4. If the video is not viewable, obtain the proprietary video player, codec, or 

91 additional required equipment.

92 6.1.5. If it becomes apparent during the assessment that an earlier generation of the 

93 recording may exist (e.g., through file metadata, indication of a conversion process), 

94 contact the requestor.

95 6.1.5.1. If the original or best quality recording is not provided, document that fact 

96 and inform the requestor of any limitations imposed on the examination.

97 6.1.6. Discrepancies between the observations of the submitted video and the details 

98 provided should be documented by the forensic science practitioner and, if possible, 

99 reviewed with the requestor.

100 6.1.7. Additional details and documentation that may assist in the assessment of the 

101 video should be requested. For example, documentation on the initial recovery of 

102 digital video evidence may provide additional information such as the recording 

103 device’s time offset and device settings. 

104 6.1.8. Assessing areas or regions of interest can be based on both temporal and spatial 

105 information. When confirming the area of interest for processing and analysis, the 

106 following should be considered:

107 6.1.8.1. There may be relevant information contained within the video outside the 

108 requested area of interest (e.g., clocks, signs, potential witnesses, bystanders). 

109 The relevance of such information can be determined by the requestor and the 

110 forensic science practitioner.

111 6.1.8.2. Document relevant information observed during the assessment and, if 

112 possible, review observations with the requestor that may have an impact on 

113 the examinations.

114 6.1.9. Any audio present in the video should be reviewed to obtain relevant additional 

115 details.
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

5

116 6.1.9.1. Audio may require an additional examination by a trained audio examiner. 

117 See SWGDE Best Practices for Forensic Audio for recommendations on a 

118 forensic audio workflow.

119 7. Processing Domain of Forensic Digital Video Examination Workflow

120 7.1. Actions performed while processing video include procedures to transform input media 

121 to output media. For example, processing includes tasks to transcode, enhance, restore,

122 carve video data, and perform timeline sequence reconstruction. These actions could 

123 lead to tasks performed in the Analysis Domain of this workflow.

124 7.1.1. Software vendors may not share the same names for processes or filters within 

125 their applications.

126 7.2. If the submitted video cannot be processed in its original format, it may be necessary to 

127 produce a converted file via transcoding or screen capturing video. Steps to preserve the 

128 original video should be taken regardless of the technique used. 

129 7.2.1. See SWGDE’s Technical Overview of Digital Video Files for additional 

130 information on the foundation of knowledge of file formats, encoding standards, and 

131 compression algorithms used in digital video. 

132 7.3. Transcoding is the conversion of multimedia from one format or encoding method to 

133 another. This includes decoding, demultiplexing, exporting still images and video, and 

134 screen capturing of still images and video.

135 7.3.1. Transcoding is intended to change only the encoding form, not the content of the 

136 data. However, the results of certain processes, such as compression, can affect the 

137 content. Video resulting from transcoding should fairly and accurately represent the 

138 visual contents of the original video.

139 7.3.1.1. The output of different transcoding types and the use of different playback

140 systems may need to be compared to determine which will provide the best 

141 representation of the original video.

142 7.3.2. Discrepancies between the input video and output video shall be documented. 

143 7.3.3. The preferred techniques for transcoding are:

144 7.3.3.1. Transferring original bitstream data into a new container. This technique, 

145 commonly known as re-wrapping, preserves the video bitstream but might 

146 remove or alter some metadata contained in the original video container. For 
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

6

147 example, creation times or frame timing information may be changed as a 

148 result of the transcoding process. Containers might interact differently with 

149 various video data and not all containers will support all media codecs.

150 7.3.3.2. Carving video bitstream data. Video data carving is the extraction of a 

151 video bitstream from a larger data structure. For additional details, See 

152 SWGDE Fundamentals of H.264 Coded Video for Examiners.

153 7.3.3.3. Converting the video file. This technique would change the video stream 

154 into an uncompressed or lossless video format. 

155 7.3.4. Transcoding to lossy formats:

156 7.3.4.1. If the video is to be used for further analysis, transcoding to a lossy format 

157 is only acceptable if a preferred transcoding technique is not available and the 

158 result provides an accurate representation of the original content.

159 7.3.4.2. Distribution products used for review and not for analysis may use a lossy 

160 format if it provides accurate representation of the original content.

161 7.3.4.3. The reason for the use of a lossy format should be documented. For 

162 example, a lossy format would be acceptable if a proprietary player is the only 

163 option and will only export in a lossy format. 

164 7.3.5. Some proprietary video players may provide an option to save in a different 

165 format than the original video. If none of the preferred transcoding techniques are 

166 available, choose the transcoding option that best preserves the quality of the 

167 original video. For example, sequential still images in a lossless format may be 

168 exported and used to produce a video. 

169 7.3.5.1. Verify and document any visible differences or degradation from what 

170 was displayed in the proprietary video player.

171 7.3.6. Screen capturing may be used if it provides the best quality output. 

172 7.3.6.1. When screen capturing video, settings should be chosen to prevent 

173 dropped frames. 

174 7.4. Additional processing techniques such as Enhancement and Restoration, are used to 

175 maximize the visibility of details in digital video or still images.

176 7.4.1. Guide E2825 outlines some image enhancement techniques that can be used for 

177 video, such as brightness adjustments, color processing, contrast adjustment, and 
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

7

178 cropping. Guide E2825 also includes linear filtering techniques such as sharpening, 

179 blur removal, edge enhancement, and deconvolution. 

180 7.5. Guide E2825 outlines image restoration techniques that can also be used for video, such 

181 as blur removal, color balancing, grayscale linearization, and geometric restoration. 

182 7.6. Additional techniques commonly used in video processing which are not included in 

183 Guide E2825 include:

184 7.6.1. Adjusting the orientation of video content.

185 7.6.2. Adjusting the frame rate of video so as to affect the playback speed.

186 7.6.3. Stabilizing techniques to position individual frames to a specific area of interest 

187 that will remain in a set location as the video is played. 

188 7.6.4. Techniques to deinterlace frames of video that are interlaced such as aligning 

189 fields or adjusting ratios. 

190 7.6.5. Deblocking techniques to reduce the artifacts caused by block-based compression 

191 algorithms.

192 7.6.6. Signal adjustments such as applying a spatial frequency-based to reduce pattern 

193 noise. 

194 7.6.7. Techniques for adjusting video display attributes such as scale and aspect ratio 

195 using interpolation. 

196 7.7. Avoid the introduction of artifacts that can add misleading information to the file or the 

197 loss of detail such as clipped pixels or ringing artifacts. 

198 7.8. Timeline Sequence Reconstruction involves relating still images and video to each other 

199 and other relevant data to develop a chronological sequence of events relevant to the 

200 examination.

201 7.8.1. Analysis as described in Section 8 may be required to determine the relevant 

202 information.

203 7.9. Enhancement and restoration techniques shall be documented in a manner to permit a 

204 comparably trained forensic science practitioner to understand the steps taken, the 

205 techniques used, and to extract comparable information from the processed file. 

206 8. Analysis Domain of Forensic Digital Video Examination Workflow
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

8

207 8.1. The analysis domain includes the application of specific subject matter expertise to 

interpret data from video evidence and draw opinions2 208 regarding the question of interest. 

209 8.1.1. Refer to the OSAC 2022-S-0001 Standard Guide for Image Comparison 

210 Conclusions/Opinions for additional details regarding opinion categories that may 

211 be reached by a forensic practitioner performing comparisons of people, objectives, 

212 or scenes captured in images (e.g., face, vehicle clothing, skin detail), regardless of 

213 the process by which opinions are reached. 

214 8.2. Categories of video analysis: Authentication, Photogrammetric Analysis, Content 

215 Analysis, and Comparative Analysis.

216 8.2.1. Authentication, the process of substantiating that the data is an accurate 

217 representation of what it is purported to be. Refer to OSAC 2021-S-0036, Standard 

218 Guide for Image Authentication. 

219 8.2.2. Photogrammetric analysis, the process of obtaining dimensional information 

220 regarding objects and people depicted in video. Refer "SWGDE Best Practices for 

221 the Forensic Use of Photogrammetry" for specific methodologies.

222 8.2.3. Content Analysis, forming results and interpretations about a video. Targets for 

223 content analysis include, but are not limited to, the subjects/objects within a video; 

224 the conditions under which, or the process by which, the video was captured or 

225 created; the physical aspects of the scene, such as lighting or composition, or the 

226 provenance of the video. Refer to SWGDE Best Practices for Image Content 

227 Analysis. 

228 8.2.4. Comparative Analysis, the assessment of the correspondence between features in 

229 still images and known objects or images for the purpose of rendering an opinion 

230 regarding identification, elimination, or a qualified conclusion. Refer to OSAC 

231 2022-S-0001 Standard Guide for Image Comparison Conclusions/Opinion and 

232 SWGDE Best Practice for Photographic Comparison for All Disciplines. 

2 There is a movement in the forensic community to eliminate the word “conclusion” from the 

formal set of words that describe forensic processes. For example, ISO does not use the word 

“conclusion”. This is reflected by the Organization of Scientific Area Committees for Forensic 

Science (OSAC) preference to use the term “opinion” (defined as View, judgment, belief – takes 

into consideration other information in addition to observations, data, calculations, and 

interpretations).
OSAC 2022-S-0031 Standard Guide for Forensic 

Digital Video Examination Workflow

9

233

234 9. Keywords

235 9.1. Video Analysis

236 9.2. Video Examination

237 9.3. Video Assessment

238 9.4. Video Processing

239 9.5. Video Transcoding

240 9.6. Image Restoration

241 9.7. Video Restoration

242 9.8. Image Enhancement

243 9.9. Video Enhancement

244 9.10. Multimedia Evidence

245 9.11. Forensic Video 

246 9.12. Forensic Science

247 9.13. Timeline Sequence Reconstruction