  Most video forensic techniques look for traces within the data stream that
are, however, mostly ineffective when dealing with strongly compressed or low
resolution videos. Recent research highlighted that useful forensic traces are
also left in the video container structure, thus offering the opportunity to
understand the life-cycle of a video file without looking at the media stream
itself.
  In this paper we introduce a container-based method to identify the software
used to perform a video manipulation and, in most cases, the operating system
of the source device. As opposed to the state of the art, the proposed method
is both efficient and effective and can also provide a simple explanation for
its decisions. This is achieved by using a decision-tree-based classifier
applied to a vectorial representation of the video container structure. We
conducted an extensive validation on a dataset of 7000 video files including
both software manipulated contents (ffmpeg, Exiftool, Adobe Premiere, Avidemux,
and Kdenlive), and videos exchanged through social media platforms (Facebook,
TikTok, Weibo and YouTube). This dataset has been made available to the
research community. The proposed method achieves an accuracy of 97.6% in
distinguishing pristine from tampered videos and classifying the editing
software, even when the video is cut without re-encoding or when it is
downscaled to the size of a thumbnail. Furthermore, it is capable of correctly
identifying the operating system of the source device for most of the tampered
videos.
