Video tampering and deepfake forensics: frame and encoder traces

Video forgery leaves more layers of traces than a photo. There are cuts and splices that remove or join scenes, deepfakes that swap a face or mouth movement, and videos generated by AI from scratch. Each leaves different marks in the frame structure and the encoder data.

Frame structure and encoder data

Footage straight from a phone or camera carries that device's encoder settings, frame timing and container layout. Passing through an editor changes the encoder name and settings, and at a cut the keyframe spacing or timestamps can break. Origma reads this structure at the metadata stage and records where the file departs from an original recording.

Face swaps and AI-generated video

Face-swap deepfakes often show awkwardness at the face boundary, in skin texture and as flicker between frames. Videos generated by AI from scratch have scene-wide statistics that differ from real footage. Origma's video detector samples frames to look for these traits and records its score in the evidence ledger alongside the other signals.

What re-encoding erases

Most videos posted to social networks or messengers are re-encoded. The original encoder data, metadata and provenance signatures disappear, and lower quality weakens subtle traces too. A re-uploaded video should therefore be read as 'less evidence', not 'no edit found', and when we cannot tell, the result is inconclusive.

What we can and cannot tell

Origma judges AI-generation likelihood, provenance signatures and edit or re-encoding traces separately. It cannot prove that the event in the video actually happened, or who filmed it and when. Results are assessments, not certified forensic reports or legal proof, so secure the original and get expert review.

Frequently asked

Can you analyse a video downloaded from YouTube?
Yes, but it is a copy the platform re-encoded, so much of the original evidence is gone. The best source is the original file from the person who filmed it.
Will every deepfake be caught?
No. High-quality recent deepfakes or heavily recompressed videos can be missed, and when the evidence is thin the result is inconclusive.
Do you show where a video was spliced?
When timestamps or keyframe spacing break, we record that signal in the ledger. Not every edit leaves such a trace, though.
Can I submit the result as evidence?
You can use it as material for judgement, but it is not legal proof. Keep the original video, its hash and the report together, and get expert review.

Read next

This is general guidance, not legal advice. A scan result is a probabilistic assessment, not proof.

Try a file