01The question
Is the original recording consistent with a single capture by the device, and does the record say anything about whether the scene happened as shown?
02Background
In a fictional workplace dispute, an employee says a recorded video call was altered by AI before it reached HR. The HR copy came through a messaging app. The Android phone that made the original recording was available, but only the messaging copy was sent for review.
03Constraints
- The recording device was available, but its clock was not checked against a reference at the time of capture.
- No automated synthetic-content tool was applied. Its output would not be a finding unless its error rate for this kind of file had been tested, which this case does not do.
04Evidence received
| Item | Form | Hash | Note |
|---|---|---|---|
| The original recording, copied from the phone's storage | F-02 | sha256: 7a1e…d03c | Hashed after copying. The phone was not used for any other task during the copy. |
| The copy received by the HR team through a messaging app | F-02 | sha256: 3b9f…a870 | Hashed on receipt. The app re-encoded it, so it is a different file from the original. |
05Examination method
Fix which file is the original
The copy on the phone was taken as the candidate original and its hash recorded. Its container, encoder and capture fields were compared with the copy the team received. The messaging copy was treated as a re-encoded derivative, so differences between the two were expected and were not read as edits on their own.
Google Photos app databases (gphotos*.db)Hash calculatorExif and GPS reader
Read the container and encoder fields
The video container was read for its creation fields, encoder strings, frame-rate and edit-list entries. No editing-software string was found. The creation time and the file-system times were compared, and the device clock was recorded as unchecked.
Google Photos app databases (gphotos*.db)Timestamp decoderHex viewer and data inspector
Check picture and sound against each other and the sequence of events
Audio and video track durations, the start offset and the frame timing were checked for internal consistency. Where the chat copy differed, the differences were matched to the app's re-encoding (frame rate and bitrate changed, metadata removed), not to edits.
Write down what the file cannot show
The content was not compared with the meeting itself: the file does not record who was present or what was said outside it. The examination reports the original's consistency with a single capture, not whether the depicted exchange took place.
06Findings
Probable
The original recording is consistent with a single capture by the device, with no editing-software string and no edit list.
BasisThe container, encoder and time fields agree with one another and with the copy's source. The device clock could not be checked, so the time is not confirmed.
Possible
The differences between the original and the messaging copy are consistent with re-encoding by the app and do not, by themselves, show an edit.
BasisThe re-encoding changes are visible in the copy itself. No comparison with the app's own output was made.
Undetermined
Whether the recorded exchange happened as shown cannot be determined from the file.
BasisThe file holds pictures and sound. It carries no independent record of the participants or of the events it appears to show.
07Limits
- A consistent original is not proof that the exchange is genuine. A careful edit can leave the same container and encoder fields.
- The device clock was not checked, so the examination does not establish the time of capture.
- No automated tool result is reported as a finding; none was applied to this file.
08Report excerpt
The original recording is consistent with one capture by the device, and the messaging copy differs in the way re-encoding would make it differ. We find this probable. Whether the exchange took place as shown cannot be determined from the file.
09Lessons
- Compare the original with the copy that was actually sent, and say which of the two each finding is about.
- A tool's synthetic-media label is an input, not a finding. A tested error rate and a stated version are required before it is weighed.
- Consistency with an original and the truth of the depicted event are different questions. From the file, answer only the first.