ReCAP’s approach to detecting and logging video time-stamp tampering

Video time stamps are operational metadata and evidentiary fingerprints. They place every frame on a timeline, reveal gaps or substitutions, and help production teams answer basic questions: was the clip recorded when the log says, did the master arrive intact, and can a disputed sequence be reconstructed? Altered values can spread a false chronology through editing, subtitling, archiving and distribution.

ReCAP’s EU-funded framework for real-time, broadcast-quality content analysis suits this problem because it can combine timestamp validation with media-quality monitoring, metadata extraction, face and logo recognition, and duplicate-content detection. The method does not treat one altered field as proof. It builds an account from several signals, compares that account with the source workflow, and preserves automated findings alongside human decisions for later review.

For Australian media teams, the need is immediate. Live sport, news and public-service programming move between production centres in Sydney and Melbourne, while teams also coordinate with Brisbane and other states. Daylight saving shifts Sydney and Melbourne from UTC+10 to UTC+11, while Brisbane remains on UTC+10, and Australian operations often record dates as DD/MM/YYYY. A trustworthy workflow must preserve local conventions while normalising internally to UTC.

Why time-stamp integrity matters

Time-stamp manipulation can be subtle. An editor may rewind a creation date, reset an internal counter, shift presentation timestamps, replace a short sequence, or retain original packets while altering the manifest that claims they came from the source. The visible programme may look normal because the change targets provenance rather than picture quality. Detecting it requires comparison across frames, timing fields and records that were created independently of the suspect file.

The consequences extend beyond editorial curiosity. A false clock can misattribute a clip, conceal unauthorised substitutions, break the order of live inserts, or make two versions appear simultaneous. Australia’s mix of commercial operators under ACMA oversight, the ABC, SBS and fast-moving streaming operations makes dependable auditability valuable across the local market. Evidence should therefore show not only what changed, but also where the change occurred and whether the affected material reached air or a media library.

Building a trustworthy video timeline

ReCAP begins by establishing a trusted reference for each asset. Analysis can distinguish the source capture time, container creation metadata, MPEG transport timestamps, decode timestamps, embedded timecode and any visible burn-in. A frame identifier and a monotonic internal counter provide continuity even when the source wall clock is imperfect. UTC becomes the common reference, while the original offsets are retained for audit.

In a live stream, expected packet cadence and bounded jitter create a baseline. A sudden backwards jump, a repeated timestamp, an implausible jump or a reset that does not coincide with a master switch is worth investigating. For files, the same checks compare timestamp progression with actual frame order and cadence. Corrupt packets, legal frame-rate conversions and broadcaster repair workflows can produce anomalies, so a timing fault is a trigger for review rather than an automatic accusation.

Clock discipline is equally important. Live facilities should relate device clocks to a managed time source, and file workflows should record when each processing stage ran. Precision and drift must be handled separately: a small, steady offset may indicate unsynchronised equipment, while an abrupt alteration suggests editing. During Australia’s daylight-saving transitions, dual UTC and local-zone records prevent the repeated hour from being mistaken for duplicated or removed footage.

Signals that reveal manipulation

Direct indicators include non-monotonic timestamps, impossible gaps, counter resets, mismatches between embedded and container timecode, and manifest entries whose creation times cannot be reconciled with the underlying media. ReCAP can align suspicious frames with the nearest trusted boundary and quantify the displacement in frames and milliseconds. That makes an alert actionable: it identifies the affected range instead of marking an entire programme as suspect.

Content-level checks add a different layer. A cryptographic hash proves whether a file or frame block is byte-for-byte unchanged. A perceptual fingerprint tolerates compression and transcoding while exposing a replacement, replay or duplicate sequence. Matching the same news package across feeds can reveal that two supposedly separate edits share source material; an altered clock cannot conceal that relationship.

Face and logo recognition can help locate overlays, station bugs, sponsor marks or replacement shots that coincide with disputed timing changes. The result is contextual evidence, not proof by itself, because branding may persist across edits and compression may distort recognition. ReCAP’s strongest finding comes from convergence: a time discontinuity, a frame-content change and a provenance inconsistency that point to the same interval.

Cross-checking media and metadata

Source records provide the independent check. Camera slates, transmitter logs, cue sheets, edit decision lists, transfer receipts and media-asset-management metadata can each confirm or contradict a claimed chronology. Their value depends on custody: an entry signed or checksum-verified when material entered the workflow is stronger than a timestamp written later without a trusted source. Correlation should therefore preserve the origin and creation time of every reference.

Narration can add another timing reference. A reliable audio transcription workflow can align spoken words with frames, revealing a mismatch when visible events and spoken chronology disagree. It can also expose a sequence inserted from another source, although transcript accuracy and language coverage limit the inference. Reviewers should treat the alignment as corroboration and compare it with waveform, silence and scene-change evidence where available.

Human review remains important where evidence is ambiguous. An analyst can determine whether a discontinuity reflects a permitted correction, a damaged ingest or deliberate manipulation. Reviewers should receive the affected interval, the expected timeline, the signals that fired and the provenance records, with the system’s confidence shown separately from the reviewer’s conclusion. This avoids an automated score being mistaken for a final finding.

Logging evidence for production teams

Each finding needs a log entry rich enough to reconstruct the event. Records can include the asset and stream identifiers, source and output timecodes, UTC time, frame range, clock offset, signal type, confidence, affected file hashes, processing version and analyst action. Original evidence should be retained with the alert. A compact “tampered” label is much less useful than a traceable record of the exact mismatch and the evidence available at detection.

Audit trails should be append-only, access-controlled and time-stamped from a trusted service. Local time can be displayed for operators in Sydney or Melbourne, but UTC should anchor the sequence, with the zone and daylight-saving offset recorded separately. Retention rules should align with the broadcaster’s contracts and legal obligations without storing biometric data merely because face recognition was available. Hashes, short event descriptors and selected frame evidence often provide the practical balance.

The logging model must fit both live and library workflows. During production, an ingest alert can stop an asset from being accepted or escalate it to a duty editor before transmission. In media-asset management, the same event can flag a catalogue record for reconciliation against the original acquisition receipt. Consistent identifiers let teams trace the item through editing, playout, cloud storage and retrieval, which is especially useful when versions originate in different cities.

From live operations to Australian archives

Real-time operation and forensic review serve different purposes but can share one evidence model. The live pipeline can test timing and content signals as packets arrive, limiting the analysis window and prioritising alerts by operational impact. A later review can then examine the full asset, compare it with source copies and test whether an interval was duplicated elsewhere. Results should be reproducible, so saved configuration, software versions and source hashes matter as much as the final alert.

ReCAP also depends on collaboration across computer vision, media processing, broadcast engineering and quality assurance. The ReCAP project consortium brings these perspectives together around common technical goals and shared demonstrations. That breadth supports deployment across production, live broadcasting and media-asset management, while interoperability with Australian-local systems determines whether alerts can be acted on quickly or remain trapped in an analysis report.

A practical integrity workflow

A practical review should separate what each evidence source can prove from what it merely suggests. Packet timing can expose a broken chronology; hashes identify unchanged or changed bytes; perceptual matching finds reused imagery; spoken alignment adds semantic context; and provenance records connect an asset to an event. The comparison below keeps these distinctions explicit and reminds reviewers that several independent signals are more persuasive than a single anomaly.

Evidence source	What it establishes	Typical warning sign	Necessary caution
MPEG timestamps	Packet and frame order	Backwards jump, repeat or reset	Legal corrections can resemble faults
Embedded timecode	Displayed capture position	Mismatch with packet clock	Overlay may be added later
Cryptographic hash	Exact byte integrity	Changed or replaced block	Compression changes the hash
Perceptual fingerprint	Visual similarity across encodes	Replayed or substituted sequence	Similar scenes may produce false matches
Audio alignment	Relationship between speech and frames	Visible action conflicts with narration	Transcript errors affect accuracy
Provenance record	Claimed origin and custody	Missing receipt or conflicting log	Trust depends on record creation

The practical takeaway is to treat time-stamp verification as an evidence chain, not a single field check. Normalise to UTC, preserve local context, compare packet order with frame content, test provenance independently, and attach every alert to immutable evidence and a named review outcome. For Australian live and archive workflows, that sequence makes manipulated timelines detectable, explainable and usable across cities without erasing the local conventions operators rely on.