Free DME & DFIR Resources

There is more Digital & Multimedia Evidence (DME) than any other type of evidence today.
Working together we've expedited tens of thousands of criminal investigations.  Learn more

Forensic Multimedia Analysis: Hardware Matters

I just returned from another great week of DME training at our office out on the east coast last week. One of the themes I've come to recognize through my travels teaching the fundamentals of DME Processing, is that even some of the most seasoned technicians and analysts don’t really understand the significance of hardware to accurate and proper processing of DME. It’s completely understandable why, given the marketing messages of some DME vendors, the fact that we're all constantly asked to do more with less, and the rate of related technological advancements.

Advancements in hardware capabilities have come so hard and fast over the last 10 years, that many don't even recall the days when MJPEG reigned supreme as the compression format of choice for most video editors. In fact, I bet most in the field working DME cases today don’t even recall struggling with SCSI and PCI (no, not PCIe) based capture cards and peripherals back in 90’s. And that’s okay, except that without understanding the history, it's easy to misunderstand a vital concept: Multimedia is TIME and RESOURCE dependent.

CPU, bus speeds, RAM, GPU, VRAM, storage r/w speeds, drivers, filters, codecs, editors, players and more can all impact accurate presentation and interpretation of DME.

“Yeah, but our multimedia software can run on ANY PC, even that POS government laptop you were assigned back in 2003. We use FFmpeg.”   Great. Good luck with that. Hope I don’t see you in court, because chances are that if I do, I’m going to expose mistakes made by the resources used in your workflow.

It’s not rocket science, and I've talked about this in nearly every presentation and class I’ve given since 1998. Multimedia is a different animal. There is no other type of digital evidence that relies so significantly on hardware for accuracy during presentation. We all understand the importance of validating our software, and those in accredited labs know full well that hardware needs to be tested, validated, and maintained too. However, with multimedia we have more links in the chain that need to be validated than most other types of DME, including things like drivers, frameworks, codecs, filters, editors, players and more. Hardware, and the drivers that direct them, are critical.

This is exactly why the world’s leading professional non-linear editing company, Avid Technology, goes to great lengths to test and validate various hardware and drivers. It's also why they and others develop software tools to help assess your system, make recommendations to free up resources, and often even provide one-click convenience for doing so.

Every link in the chain must be tested. Every resource must be validated. Your system should be designed and optimized for the task at hand. Period.

Don’t get me wrong, convenience is great; simply pressing the Play button is as easy as it gets. Advancements in computing technology have provided conveniences that, for better or worse, often come at the cost of accuracy. But hey, what the hell do I know. I've only been doing this sh** (graphics processing) since the Commodore VIC-20. Go ahead, do a multi-track forensic video alignment in your favorite NLE and trust that it’s doing all the right things. I mean come on, it was made by *insert big brand name here*; they totally get Forensic Multimedia processing and analysis. Don’t they?

Smart Search

DME Resources Newsletter

Sign-up for the DME Resources"I may occasionally send an email" newsletter. Maybe quarterly? Semi-annually?

Well, what I can tell you is that your information will not be shared. See my Privacy Policy.

NOTE: Members of my site are NOT auto-subscribed or un-subscribed from this newsletter; they must manually Opt-In/Out.

Subscribe Today!

Who Doesn't Love Cookies?
DME Resources may place one or more Cookies on your computer. Cookies do not contain any personally identifying information, they allow me to customize my site based on your preferences. If you Decline cookies from my site, you may not be able to use all of the site's features.