Free Surveillance Video Tamper Check

Start with what the export can prove

Every surveillance manufacturer protects footage somewhere, and almost none of them protect the convenience export. Axis signs each frame inside the video stream itself and publishes the method, ONVIF defines a signed export format and a signed stream, Ring now embeds content credentials in cloud downloads and Avigilon Alta ships a signed hash set beside its clips. Those the check can find and report. Hikvision, Dahua, Hanwha, Bosch, Milestone, Genetec, Avigilon ACC and Exacq protect footage only in their native containers and verify it only in their own players, and in every documented case the MP4 or AVI they export for convenience carries none of it.

When your clip is one of those, the export protection card says so plainly and names the native format and player to request from the custodian, which is also the position of the Scientific Working Group on Digital Evidence: the proprietary export is most likely the best evidence and the open format a secondary copy. A missing signature is not an edit. It is a reason to ask for the original before anyone argues about the copy. When the answer to that question matters to a deadline, a senior examiner can tell you on a free first call exactly what to demand and how to preserve it.

Read the stream before the pictures

An encoder writes a rhythm into a recording. Keyframes arrive on a schedule, the frames between them are smaller and roughly alike in size, and presentation timestamps step forward at the recorder's cadence. The check reads that rhythm across every packet in the file without decoding a single frame: keyframe spacing and where the group of pictures length changes, the packet size profile and where it steps, presentation intervals and gaps, repeated and missing timestamps, and parameter sets that change mid stream.

A keyframe that lands exactly on a cadence break is reported as a coincidence worth examining, in those words, because that is where a cut joined to a re encode tends to leave its seam. Surveillance recorders often run at a variable frame rate and interrupt recording on motion, so an irregular interval is a question for the custodian first and an indicator second. The timeline chart shows the whole clip so you can see whether the irregularity is everywhere, which points to the recorder, or in one place, which points to the place to look next.

Test the frames where the timeline points

Lossy compression leaves a fingerprint in every block of every frame, and an edit disturbs it. Choose a window on the timeline and the check decodes the frames in it and runs the tests examiners run by hand. The discrete cosine transform map shows the compression energy in every 8 by 8 block, so a region that was blurred, painted over or pasted in shows as quiet against a busy scene. Video error level analysis recompresses the decoded frame at a fixed quality and amplifies the difference, so content that has been compressed a different number of times stands apart.

Noise extraction, the pseudo color palette and the clipping map support those two, and for a fixed camera the temporal tests show every pixel that never changes across the window and every pixel that departs from its own average, which is how a static patch laid over moving footage gives itself away. Each view carries its exact parameters into the report. These are the tests Doug Carner built into VideoCleaner and the research behind them is cited below; the implementation here is GDF's own. Compression and a careful editor can both defeat them, so a quiet view is not a finding that nothing was edited. When a region matters to a matter, media authentication by an examiner is the next step.

Treat the on screen clock as evidence

The burned in timestamp is the one record on the frame that the recorder wrote at the moment of capture. Mark it once and the check crops it from every window frame into a strip, measures how much the region changes from frame to frame and compares that against the presentation timestamps. A clock that repeats, skips, runs at the wrong rate against the stream clock or holds still while the scene moves is reported with the frames where it happens. Some recorders write the clock only on keyframes, so the strip is read beside the structure table rather than alone.

Compare against the native export when you have it

When the custodian provided the native export or an earlier copy, the check aligns the two on reduced frame descriptors and reports the relative playback rate, the matched runs and the regions in either file that find no match. Unmatched content can be an addition, a removal, a crop, a re encode or a different camera view, and the report says which of those it cannot distinguish. The comparison does not make the reference authentic; it tells you where the two recordings disagree so the examination can start there.

Your files and reports remain local

The selected clips, file names, hashes, decoded frames, the clock region, notes and report data never reach a server. Optional usage measurement stays off unless you allow Analytics. With permission it sends GDF only the tool name and fixed action labels, such as analysis completed or report prepared, never an input, result, filename or visitor identifier. Google and advertising scripts do not load on this page. Use Cookie settings below to change your choice. Program files, the parser and fonts download from this website; nothing about your footage travels with them.

Clear cancels active work and removes the displayed records without deleting your original or any report you saved. Saved reports can contain private file names, hashes and notes; review them before sharing.

Try it with AI, offered in beta under the results, runs a small language model on your own graphics processor after you confirm a one time download from this website of about half a gigabyte. The model receives only the numbered observations and the methods text of your check, is instructed to restate them in plain English without adding a fact, and answers questions about them. Every sentence it writes is shown in a labelled box as generated text, is excluded from the findings table, the triage and the PDF, HTML and CSV reports, and is never a finding that footage is authentic or edited. Current Chrome or Edge on a desktop with WebGPU is required, and the check and its reports stand without it.

Save the report

Download the PDF or HTML report in the Global Digital Forensics four section layout: the executive triage and file identity with the full SHA 256, the plain English interpretation guide, the structured findings inventory with every observation located by timestamp and layer and your notes, and the evidentiary scope advisory with the beta notice. The Excel ready CSV gives one column per field and the JSON is the lossless record of hashes, container and track observations, the packet scan, the export protection result, frame test parameters, the clock region and its readings, reference alignment and coverage. The PDF and HTML reports carry reduced copies of the frames, the applied view and the clock strip as figures; no report contains the video itself.

Formats and resource requirements

Each clip is limited to 64 MiB and four million coded and displayed pixels. The packet scan covers the whole clip up to 200,000 packets, and NAL unit scanning for signed video markers covers the first 20,000 packets of an H.264 or H.265 track. Each examined window is at most 60 seconds and 120 frames, the clock strip follows the window frames, and the operation time limit is 120 seconds per stage. Limits stop work with an explanation rather than a shortened result. When the page opens it tests for hardware graphics acceleration and, once a clip is read, for a hardware decoder for its codec; when either is missing the workbench says so, because the check still runs in software but frame tests and views take longer and a long window can reach the time limit.

Coverage is recorded, not assumed

Every result states what it examined. The packet scan records how many packets it read and whether it reached the end of the file, the frame window records its decoded frames and where it stopped, the export protection card records which markers it searched for and that none is validated in this version, and the clock strip records the region and the frames it was read from. Detection accuracy on real world surveillance footage has not been measured by GDF, so an unavailable, cancelled or quiet result is unknown rather than a finding that nothing was edited.

Metadata and structure are never relied on in isolation. Keep the original and its collection context, work on copies, and bring the observations that matter to a case to an examiner who can test them against the recorder itself. Tell us about a problem with the tool; the link attaches no selected file or report.

Related tools and methods

Video Forensics gives the manual frame workbench with fifteen inspection views and Video Analyzer the guided workflow with optional local models; reselect your clip there, because inputs are never placed in links. Photo Forensics applies error level and noise analysis to still images, and Metadata Analyzer reads the properties of a wider range of files. When a matter turns on the footage, expert witness services begin with a full examination.

Versions and methods

Local container parsing uses Mediabunny and browser decoding is described in WebCodecs. The export checks follow the ONVIF export file format, the ONVIF media signing specification, the Axis signed video framework and the C2PA specification. The frame tests implement the analysis described in the VideoCleaner user guide and the research it cites, with the SWGDE video authentication practice as the frame for every result. These references describe the methods; they do not certify this tool. Version 1.0.0 beta. All free tools.