Chapter 26 — Key Takeaways

A scannable one-page card. For the full argument and the worked examples, see index.md.

The core claims

• Cameras are everywhere; probative value is not. A camera being present establishes little by itself. Footage can show that an event happened, when (with verified timing), where, and what was done — and can sometimes exclude a suspect — but identifying an unknown person from imagery is contested and error-prone. Ubiquity ≠ proof.
• Secure the original. The evidence is the native file from the DVR/device, full resolution, metadata intact, hashed (Chapter 25). A phone-video-of-a-monitor, a screen recording, or a re-compressed emailed clip is a copy of a copy — degraded and stripped. Surveillance systems overwrite on a loop, often within days.
• Photogrammetry is real geometry — strongest as an exclusion. Reverse projection (image a known reference at the same stand point with the same camera) cancels lens and angle and yields an honest height range. A clear height mismatch cleanly excludes; an overlap only fails to exclude (most adult men share a band). Posture, footwear, stand point, camera changes, and image quality all widen the range.
• "Enhancement" is mostly a TV lie. The one rule: enhancement reveals information already present; it can never add detail the sensor did not record. Real operations (brightness, contrast, sharpening, noise reduction, frame averaging on static scenes, geometric correction) clarify what was captured. "Zoom-and- enhance" and machine-learning "super-resolution" that renders a crisp face/plate from a blur produce hallucinated detail — the model's guess, not the scene — and are not evidence.
• Authentication is the real frontier. Is this image what it claims to be? Built from converging indicators — metadata/container analysis, compression/format forensics, error level analysis (ELA), physics-and-content consistency (shadows, reflections, perspective, noise), and source-device fingerprints — no single one a verdict alone.
• ELA is a screening hint, not a verdict. Edited regions may compress differently — but edges, high-contrast boundaries, text, and texture "light up" innocently, and ELA fails on multiply-saved images, non-JPEG, and screenshots. A glow is a prompt to look closer with other methods, never proof.
• Deepfakes are an unsettled, fast-moving frontier. Synthetic/manipulated media (and cruder cheapfakes) threaten both fabricated evidence and the "liar's dividend" (genuine evidence dismissed as "probably fake"). Detection (artifacts, ML classifiers) is real but ages quickly and is not yet validated to Daubert's standard; clean detection ≠ proof of authenticity.
• Provenance is the durable answer. A file's documented lineage — fragilely via metadata (EXIF; easily stripped/forged), durably via cryptographic content-authentication standards (sign at capture, track edits). Metadata inconsistency undercuts cleanly; consistency only fails to exclude tampering.

The method-validity verdict (NAS 2009 / PCAST 2016)

Where they sit: documented photogrammetric measurement and well-understood enhancement rest on solid ground; ELA and facial comparison are hints/opinions, not proofs; deepfake detection is a frontier in motion, real but not yet validated to courtroom-conclusion standard. None of it should be presented as "the camera proves it."

What you can honestly say on the stand

• Photogrammetry: "Based on reverse-projection reconstruction with the original camera, the figure's height is estimated at approximately X–Y cm. The defendant's height falls outside that range [exclusion] / within it, alongside a large fraction of adult men [consistent with, not identification]. I accounted for posture and footwear by widening the range."
• Enhancement: "I adjusted brightness, contrast, and noise to make the captured detail perceptible; my steps are documented and reproducible from the original. Two characters are legible; the remainder is not. I did not, and could not, recover detail the camera did not record."
• Authentication / deepfakes: "My examination found [no detected synthetic signatures / anomalies consistent with manipulation]. A clean result does not prove the media is genuine; detection methods are new and not well characterized on novel fakes. Provenance and corroboration are needed."
• What you must NOT say: that enhancement "recovered" detail finer than the original resolution; that a height overlap "identifies" the defendant; that an ELA glow "proves" editing; that a detector "guarantees" a video is/ isn't a deepfake; or that "it's on video" settles a question the footage does not settle.

The cold-case line

The gas-station CCTV shows a person consistent with Keller buying gas cans; a doorbell camera adds a consistent sighting; the alibi video's metadata is internally inconsistent, which undercuts the alibi. Honest status: purchase + presence corroborated — corroboration, not identification, and certainly not proof of the killing. "Consistent with," not "identified." Undercutting the alibi subtracts a defense; it adds no proof. (One more brick in the wall — Chapter 39.)

The themes this chapter advanced

• The CSI effect cuts both ways (PRIMARY) — "enhance" is the chapter's emblem of the TV lie: jurors expect impossible clarification and over-trust "I saw it on the video." §26.3 dismantles the first; §26.1 and §26.5 (the "liar's dividend") complicate the second.
• The validity spectrum (PRIMARY) — explicit placement: photogrammetry/enhancement (solid) vs. ELA/facial comparison (hints/contested) vs. deepfake detection (unsettled), all measured by NAS/PCAST and Daubert.
• (Also: exclusion over proof — photogrammetry and authentication are strongest as exclusions/ "consistent with"; cognitive bias — confirmation bias in crowdsourced "identification," Case Study 26.1, and in an analyst told the suspect's identity before comparing.)