Practical guide

A recording has conflicting times: how to examine its timing

· 2 min read

The time displayed in camera footage, the file date and the timestamp of a message in a messaging app may refer to different events. Before concluding that a recording is inconsistent, it is useful to establish exactly what each indicator represents and what transformations the file has undergone.

Distinguish the sources of time information

An on-screen timestamp may be generated by the device, the file date may depend on saving or copying, and a messaging app timestamp may describe transmission of a message. They cannot automatically be regarded as three independent confirmations of the same recording time. A possible time-zone difference must also be checked against the known settings.

Preserve the source recording and export information

Available files obtained directly from the system, a description of the device and the export sequence are useful. A joined video or a screen recording of the interface may not retain all the original time information. Specify known instances of resaving, trimming and transfer between storage media.

Check the time reference using the data as a whole

System logs and documented events captured in the recording may be used for comparison. Each such link must have a clear basis. A match in the apparent scene does not permit an exact date to be assigned arbitrarily where independent confirmation is absent.

What to prepare

  • Source files and the available export structure.
  • The recording system model and known time settings.
  • An explanation of copying, forwarding and processing.
  • Device logs and materials concerning events that can be compared.
  • A specific question about the recording's temporal relationship.

What to bear in mind

A discrepancy in dates does not in itself prove editing. At the same time, a matching date in the file name does not confirm that the content is unchanged or establish the time of the event without additional grounds.

Outcome of preliminary preparation

The examination makes it possible to describe the available time information and its degree of consistency, preserving the distinction between a recorded indicator and the presumed time of the event.

Related material

NIST: preservation of digital materials

To discuss your task, provide the relevant materials and a brief description of the circumstances through the website's current enquiry channel.

Discuss the task → · All materials →
Inquiry

Send a recording or describe the task

You may send an audio or video file, a link, an investigative order, a court ruling, draft questions or an existing report for review.

  • voice and spoken speech;
  • the acoustic environment and audio recording traces;
  • video images and video recording traces;
  • editing, continuity, the recording device;
  • report review and questions for court.

Up to 10 files of 10 MB each, up to 15 MB in total. Preserve source recordings and metadata without resaving. Arrange the transfer of large files and storage media separately by email.

How data is processed: Personal Data Processing Policy. Attach only materials relevant to the examination; redact unnecessary data about other people.

For a preliminary assessment, please specify the file format, recording source, start and end times, recording device, and availability of the source file and voice samples.

Attachments: up to 10 files of up to 10 MB each, with a maximum combined size of 15 MB. If a file is rejected, the enquiry is not sent.

Write to usDiscuss your task ↗