Deepfake Detection, Media Authentication and Expert Testimony
Deepfake Detection for Disputed Recordings, Photos and Video
A recording that could end a career, a video offered against a defendant who swears it never happened, a voice that authorized a wire: the question is no longer what the media shows but whether it is real. Our examiners test disputed audio, video and images with independent methods, trace each file to its source and state the confidence plainly in a report built for court. Preserve the original and call us before anyone converts or forwards it.
What We Examine When a Recording Is Challenged
We start with the file as it was produced and work back to where it came from: the original container and its encoding settings, the embedded metadata, the phone, camera or recorder that captured it, and the account, platform or messaging service that carried it. A file that claims to be an iPhone voice memo but carries the encoding fingerprint of a desktop editor tells us something before any detector runs.
Where a file carries C2PA content credentials, we validate the signatures and the trust chain, then compare each signed assertion with what the container and the content actually show. Most genuine recordings carry no credential at all, so provenance then comes from the device, the account records and the file history we reconstruct.
Our handling of signed provenance follows the C2PA content credentials explainer, and every step is documented so a qualified examiner on the other side can repeat it.
If a recording is about to be offered or challenged in your matter, get a free consultation and tell us how the file reached you. We will say which questions it can answer and what to preserve today.
The engagement
Independent Methods Behind Every Authenticity Opinion
A detector score is a measurement, and we read it against the tool's calibration, its known failure modes and the competing explanations before it carries any weight. Global Digital Forensics has operated since 1992, and its examiners have been accepted by courts, deposed and cross examined. The report shows the evidence behind each conclusion so any qualified examiner, including one on the other side, can test it.
The examination fits federal criminal defense, disputed communications in civil litigation, multidistrict litigation, employment recordings and enterprise fraud involving synthetic media. Disclosed generation and alleged generation are different questions, and we answer each from the credentials and platform metadata actually present.
Methods are chosen for the media question. Container and codec evidence tests the possible source pipelines, generator indicators are measured against documented failure modes, and in audio and video we compare speech sounds with visible mouth movement where quality permits. Each finding names the method behind it, so the opinion can be tested piece by piece.
Bring the produced file, the claimed source and any reference recordings, and we will say which methods apply. Call (800) 868-8189.
Scope
C2PA content credential verification
We verify available C2PA manifests and trust records, read the actions they assert and compare them with what the container and codec show, so a signed claim is tested before anyone relies on it.
Synthetic media indicators
Edge patterns, high frequency inconsistencies, temporal instability in video and frequency domain anomalies, each read against the ordinary processing the file went through.
Audio and video synchronization
Where quality permits, speech sounds are compared with visible mouth movement and timing, as one indicator weighed with the compression and editing history.
File structure and platform history
The container, codec settings and platform processing fingerprints are compared with the claimed device or source, which often settles whether the file could have come from where the other side says it did.
Reference recording comparison
The questioned file is compared with known recordings of the person or the setting, and the report identifies the reference set and the features compared.
Defense and rebuttal analysis
Independent analysis of a recording offered against the accused, and a technical review of the opposing expert's deepfake opinion.
Enterprise deepfake incidents
Cloned executive voices, video impersonation and fraudulent wire instructions examined, with documentation that supports an insurance claim and a law enforcement referral where requested.
Methodology
How We Examine a Suspected Deepfake
Confirm the file, comparison material and scope
We confirm the produced file and its container, any reference set and any conflicts, so the work starts from a documented source and not from a forwarded screenshot.
Apply complementary authentication methods
C2PA verification, container and codec analysis, generator indicators, audio and video comparison and reference examination are each recorded separately, so one weak indicator never contaminates the rest.
Explain the methods and authenticity findings
The report states the method behind each finding and the alternative explanations in language a jury can follow, and it says consistent, altered or indeterminate in plain words instead of hiding behind a percentage.
Deposition and testimony
Preparation, deposition and hearing or trial testimony on the report's conclusions, given by the examiner who did the work.
Forwarded screenshots and recompressed copies weaken an authenticity opinion more than anything else, and our guide Authenticating Questioned Photographs, Audio and Video shows how to keep the originals intact.
Evidence commonly examined
Media and Provenance Evidence We Examine
We examine the produced file and its original container, any C2PA manifests and trust records, the platform exports and DVR extraction records that show how the media was acquired, and reference recordings of the person or the setting. Opposing detector reports and workpapers are reviewed independently, detector output is preserved with its tool and model versions, and court orders and protective orders set the handling rules we follow.
What you can expect
Your Authenticity Opinion and Supporting Record
You receive a written report of the authenticity and synthetic media findings with their supporting evidence, a method appendix recording every technique and its separate output, and a comparison appendix where reference material exists. When the other side has its own expert, we deliver a rebuttal declaration on the technical basis of that opinion, and demonstratives drawn from the file make the record visible to the court.
Send the question and the sources you know about, and we will map the examination with you.
Frequently asked
Detecting a Deepfake: Method, Limits and Testimony
Are deepfake detectors reliable enough for court use?
A detector is one instrument among several. We weigh its results against its calibration, its known failures and its reproduction record, and the report explains that basis alongside the container, provenance and comparison evidence.
How does a C2PA credential factor into the opinion?
A C2PA manifest carries signed claims about the signer, the actions and the timing. We verify the trust chain and compare those assertions with the container and content evidence, and the opinion explains what the combined record supports. A valid credential speaks to the file's history, and a missing one is common in genuine material.
Can you handle a matter where the file is offered against the defendant and the defendant claims it is a deepfake?
Yes. We examine the authenticity of a recording offered against the accused and review the opposing expert's opinion. The report separates what the file shows from what the surrounding records show, which is what gives it weight when the other side's expert takes the stand.
How is deepfake analysis reproduced by another examiner?
Workpapers preserve the original inputs, the method and model versions, the settings, the outputs and the interpretation assumptions, so another qualified examiner can test the reasoning. Where a model behaves differently between runs or a provider has changed versions, the report records it so the comparison stays fair.
Do you handle enterprise deepfake fraud incidents?
Yes. We examine suspected cloned voices, executive impersonation and fraudulent payment instructions and prepare the technical documentation an insurer or a law enforcement referral requires. Call the hotline first and preserve the recording, the call records and the payment instructions before anyone replies to the sender.
Free consultation
Examine the Recording Behind Your Dispute
On the first call a senior examiner reviews how the recording reached you, which originals and reference material exist and when the court needs an answer, then lays out the methods, the timeline and the deliverables.
A 24/7 hotline and a senior examiner on every first call.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .