When a recording or photograph is central to your case and someone says it was faked, you need more than a gut call or a score from an online detector. Right Forensics examines the file itself (how it was made, how it has been handled, and what it does and does not show) and explains the results in terms a court can follow.
We examine video, audio and still images whose authenticity is in question, including content alleged to be generated or altered with AI. A typical examination looks at:
We start with what you have. Many matters begin with exported or re-shared copies rather than originals. We tell you early what those copies can and cannot support, so expectations are set before money is spent.
We preserve before we examine. Every file is hashed on receipt and re-verified after analysis, so it is clear the evidence was not changed by our work.
We use methods we can explain and repeat. Our conclusions rest on observations another qualified examiner could reproduce: file structure, encoding data, measurable signal properties and documented visual review. We do not rest opinions on AI-detection classifiers whose error rates have not been validated for the material at hand. A detector score without a known error rate is hard to defend under Rule 702, and a weak foundation helps no one.
We cross-check ourselves. Key findings are tested by a second, independent pass. Where the two readings differ, we report the more conservative one.
We separate the file from the event. Showing that a file was not digitally altered is not the same as showing that what it depicts actually happened. A scene can be staged with no editing at all. We say clearly which question our findings answer, and point to other sources that could answer the rest.
Details are generalized to protect the matters and the people involved. Both engagements were preliminary screening examinations.
The question. In a litigated matter, short smartphone videos with audio were questioned as possibly AI-generated or altered. Only exported copies were available: no recording device, no originals and no custody records.
What we did. We verified and hashed each file, then mapped its internal structure and encoding parameters to identify the software that produced it. We reconstructed frame ordering and timing, checked for appended or orphaned data, and measured frame-to-frame changes and the audio spectrum for signs of cuts or splices. We tested for statistical traces associated with generative upscaling, reviewed frames for the content errors generators tend to make, and checked for Content Credentials. A second independent pass confirmed the results. Consistent with our approach to Rule 702, we deliberately did not rely on an unvalidated AI-detection classifier.
What it showed.
Why it mattered. The screening set aside two arguments that often appear in authenticity disputes: that missing camera metadata means a video is fake, and that embedded timestamps show when something happened. It also gave counsel a ranked list of what would move the analysis further, led by obtaining the originals and the recording device so that sensor-level attribution becomes possible.
The question. In civil litigation where the parties disputed whether a depicted event took place, five photographs were produced only as images embedded in a PDF. No native image files were available.
What we did. We extracted the images and analyzed both the PDF and the image data inside it, including compression settings and embedded profiles. We mapped compression error levels and noise across each image to look for regions that did not match their surroundings, assessed whether each image was a direct digital capture or a scan of a printed photo, reviewed the images for generative-AI artifacts, and checked tonal range and sharpening for signs of retouching. We also used the page layout to test whether the images had been cropped when the PDF was assembled.
What it showed.
Why it mattered. The report drew a firm line between "these files show no sign of digital manipulation" and "the event happened as shown," and identified non-photographic sources, such as records requests and a site inspection, that could address the second question.
Sometimes the evidence is strong in one direction. Often it is more nuanced. We report what the file supports, what it does not, and how much weight each finding deserves. We will not overstate a conclusion.
Many detectors produce a score without a validated error rate for the kind of material in a given case, and their results can change with compression or re-sharing. We may note such tools for context, but our conclusions rest on observations that can be explained and reproduced.
Copies limit what can be concluded, but they often still answer important questions, such as whether files share a common origin or show signs of editing. We will tell you up front what your copies can support and what originals would add.
No. Messaging apps, social platforms, editing software and scanners routinely strip or rewrite metadata. Missing metadata is a fact to be explained, not proof of fabrication.
Yes, both as part of video and on its own, including checks for splices and discontinuities in the soundtrack.
Facing a recording or image whose authenticity is in doubt? Tell us what you have and what is at stake, and we'll explain what a forensic examination can and cannot establish.
START A CONVERSATION