Example Digital Forensic Work
One of our clients, Accident Consultants, approached us for assistance with some of the technical aspects of a criminal case where they were acting as an expert witness for the defence.
The case involved an Asda van that was travelling on a motorway. It passed through a pair of average speed cameras, that were monitoring the speeds of vehicles passing through roadworks. The speed limit was 50 mph.
As each vehicle passes by an average speed camera, the numberplate is captured by two cameras, and ANPR technology reads the vehicle's number plate. The precise time that this occurs is also recorded. The time is provided both by a GPS signal and also verified against an internal clock which is manually set. This hence gives two independent data points from two sources.
Once the vehicle passes by the second average speed camera, the difference between the two timestamps can be calculated, giving the precise time that the vehicle took to travel the known distance between the two average speed cameras. The average speed can the be calculated from the distance and the time.
In this case, according to the RedFusion Speed Violation Report, the vehicle's average speed was recorded at over 65 mph. Well in excess of the 50 mph speed limit.
Our client, a leading UK forensic expert, had already established:
- The van being driven had a speed limiter that prevented the vehicle from travelling faster than 55.9 mph.
- The vehicle was travelling uphill through the roadworks, so it was unlikely that the vehicle had been able to exceed maximum speed set by the speed limiter.
- The speed limiter was in working order and had not been tampered with.
- The van was fitted with an Isotrak system that logs the speed and location via GPS periodically. Two of these records were located between the two average speed cameras, and give a speed of under 50mph, consistent with a vehicle been driven close to the speed limit.
- Given the vehicle was being driven around lunchtime on a weekday, it was likely that van would have been prevented from speeding by the vehicles in front of it.
Cogent Digital was able to ascertain that:
- The numberplate recorded by both pairs of cameras on both speed cameras was indeed the same numberplate. (See below)
- The vehicle recorded by both pairs of cameras on both speed cameras was indeed the same vehicle. (See below)
- The Isotrak data also contained hidden CAN bus / OBD-II data, that was recording the vehicle's speed, according to the speedometer, every few seconds.
- CAN bus / OBD-II data can also contain useful information, such as engine speed, that can help support the road speed reading.
- One of the Isotrak's GPS records was recorded within one second of time that the second speed camera recorded the van passing.
- Given that both the speed camera and the Isotrak system are using the same time source (the ultra precise time signals from the GPS satellites), this effectively marked the location of the second average speed camera.
- The location recorded by the Isotrak was considerably closer to the first camera than what the "official" position of the second camera claimed.
- Calculating the average speed, assuming this new location of the second speed camera, gives an average speed just below 50 mph, consistent with the Isotrak GPS reconds, CAN bus / OBD-II data, likely traffic conditions, and restrictions imposed by the speed limiter.
- By comparing feature of the images from the first average speed camera to images of the location from other sources, the first camera was indeed at the location it was supposed to be.
- By comparing feature of the images from the second average speed camera to images of the area from other sources, the second camera was unlikely to be at the location it was supposed to be.
- By comparing feature of the images from various sources of the location where the Isotrak record indicated the second camera was likely to be located, a suitable service platform with an appropriate power and communications cabinet, required for use by an average speed camera, was located there. Although these were found frequently along the motorway.
- Recent video footage of the section of motorway in question shows that the average speed cameras were indeed temporary (i.e. moveable) installations, as they've since been removed, despite the roadworks still being present.
- Older images from Google Streetview shows both average speed cameras at their "official" locations.
- This supports the theory that the second speed camera was once at its "official" location, but had simply been moved to another location (as they often are) that was closer to the first camera. However, the distance between any two cameras is set manually. It is therefore possible that distance between the two cameras was never adjusted when the second camera was moved.
- The only scenario that fits with all the available forensic evidence, is that the second speed camera was moved, but the distance between the two cameras was not changed to the new distance.
- After the prosecution received the report from our client, the case was dropped.
Example Forensic Image Analysis
Below we can see the images provided in the RedFusion speed violation report. Note that identifying features have been redacted for use on this website:
As commercial vehicle fleets often have very similar number plates, it was important to ensure that the two numberplates were the indeed the same. Specifically, optical character recognition software, and people, often have difficulty determining similar letters on numberplates, such as E and F; N and M; C, D, O, and U; and so on, especially when there is dirt on the numberplate, and reflections and shadows come into play. To do this, the number plate is extracted from each image:
The images are then contrast enhanced, to separate the letters from the background. If done correctly, this also helps to remove the effects of shadows and reflections.
The first image is slightly smaller, and taken at a different angle than the second image. So the size and perspective of the image is adjusted to match the second image.
Finally, a difference map of the two images is calculated. There are a number of types of difference maps that can be used, but in this one (actually an addition map) where the images are identical it shows as grey. Any differences will be tend towards white or black, depending on how the images differ. In this case, we can see that the only differences are the outline of the characters of the numberplate. This just means that the size of the characters in each image was slightly different. As we're not seeing any complete sections of characters that are different, then this proves that the numberplates are indeed the same.
Furthermore, we can enhance the images so that we can better look at the vehicle and driver. Here we can take a number of measurements. The height of the driver is the same. His arm is in a similar position. The distance from his seatbelt to the name tag on his jacket is the same. His head is the same shape. The distances from his eyes to his ears and nose are the same. Also there are a number of stickers and other marks on the vehicle which are identical. There are no changes to the vehicle (nothing disappears or appears between the two photographs).