CoFFEE: A Codec-based Forensic Feature Extraction and Evaluation Software for H. 264 Videos
Abstract
The forensic analysis of digital videos is becoming increasingly relevant to deal with forensic cases, propaganda, and fake news. The research community has developed numerous forensic tools to address various challenges, such as integrity verification, manipulation detection, and source characterization. Each tool exploits characteristic traces to reconstruct the video life-cycle. Among these traces, a significant source of information is provided by the specific way in which the video has been encoded. While several tools are available to analyze codec-related information for images, a similar approach has been overlooked for videos, since video codecs are extremely complex and involve the analysis of a huge amount of data. In this paper, we present a new tool designed for extracting and parsing a plethora of video compression information from H.264 encoded files, including macroblocks structure, prediction residuals, and motion vectors. We demonstrate how the extracted features can be effectively exploited to address various forensic tasks, such as social network identification, source characterization, and double compression detection. We provide a detailed description of the developed software, which is released free of charge to enable its use by the research community to create new tools for forensic analysis of video files.
BibTeX
@article{bertazzini2024coffee,
title={CoFFEE: a codec-based forensic feature extraction and evaluation software for H. 264 videos},
author={Bertazzini, Giulia and Baracchi, Daniele and Shullani, Dasara and Iuliani, Massimo and Piva, Alessandro},
journal={EURASIP Journal on Information Security},
volume={2024},
number={1},
pages={34},
year={2024},
publisher={Springer}
}
Acknowledgments
This work was supported by the Defense Advanced Research Projects Agency (DARPA) under Agreement No. HR00112090136. The U.S. Government is authorized to reproduce and distribute reprints for Governmental purposes notwithstanding any copyright notation thereon. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the Defense Advanced Research Projects Agency or the U.S. Government.