Data Points

🎬 Video

🔗 Analyst pivots

🔍 Lookup

📜 Playbook — Video exploitation

1. Direction — frame the requirement for Video: what decision does this support, by when?
2. Collection — pull the 0 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Video

A video artifact (file or hosted stream) treated as an investigative object, including its container, codec, embedded metadata, keyframes and audio track. It matters because video is a primary source for verifying events, geolocating incidents, extracting faces/objects/text, and detecting deepfakes or manipulation.

Format: Containers MP4/MOV/MKV/WebM/AVI/TS; codecs H.264/H.265/AV1/VP9; validate via container magic bytes (ftyp box for MP4), moov atom presence, and hash (sha256) of the byte stream; duration/fps/resolution from stream headers.

📡 How it is collected

• Downloaded from social platforms (yt-dlp) or hosted CDN URLs
• Uploaded evidence from devices or messaging apps
• Screen-recorded livestreams and broadcast captures
• Extracted from a larger container or a page's embedded player
• CCTV/dashcam exports (proprietary NVR containers transcoded to MP4)
• Pulled from cloud storage or archive snapshots

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• Keyframe extraction and reverse image search
• Chronolocation via shadows, weather, and celestial position
• Geolocation from signage, terrain, and landmarks
• Error-Level Analysis and noise/PRNU forensics for tampering
• Deepfake detection (face-warp, blink, lip-sync artifacts)
• Audio spectrogram and voice-print analysis
• Container/metadata carving for source device fingerprinting
• OCR on burned-in text and timestamps

🔧 Tools

• yt-dlp
• ffmpeg/ffprobe
• InVID-WeVerify
• ExifTool
• MediaInfo
• Amped Authenticate
• OpenCV
• Whisper (transcription)

⚡ Workbench actions

• Extract keyframes and run reverse image search
• Probe container/codec/metadata (ffprobe+ExifTool)
• Compute perceptual + sha256 hashes
• Run deepfake/manipulation analysis
• Geolocate and chronolocate frames
• Transcribe audio and OCR overlays
• Cluster near-duplicate uploads by pHash
• Export chain-of-custody evidence bundle

📊 Dashboard KPIs

📂 Open