MEDIA AUTHENTICATOR

A Forensic Analysis Guide for Paranormal & Anomalous Media

Understanding ELA · FFT · Optical Flow

The Physics of Recorded Reality · Getting Started with Python

Built for researchers, critical thinkers, and community investigators who want to go beyond belief and
dismissal — and into evidence.

Media Authenticator — Forensic Analysis & Physics Guide Page 1

Contents

Part I Getting Started: Terminal & Python for Absolute Beginners

1.1 What Is Terminal?
1.2 Your First Terminal Commands
1.3 Installing Python on Mac
1.4 Installing Python on Windows
1.5 Setting Up a Virtual Environment
1.6 Installing ExifTool (Mac & Windows)
1.7 Installing Your Python Libraries

Part II How Digital Video Actually Works

2.1 From Light to File: The Four-Step Process
2.2 What a Pixel Really Is
2.3 Compression and the Discrete Cosine Transform

Part III The Three Forensic Analysis Methods

3.1 Error Level Analysis (ELA)
3.2 Fast Fourier Transform (FFT) Frequency Analysis
3.3 Optical Flow Analysis

Part IV Physics, Mathematics & The Consistency of Reality

4.1 Why Real Recordings Have a Signature
4.2 Statistical Self-Consistency as Truth
4.3 Camera Hardware and Its Forensic Fingerprint

Part V Interpreting Your Results

5.1 Reading the Output: A Plain-Language Key
5.2 The Three-Layer Verdict Framework
5.3 What These Tools Cannot Tell You
5.4 Evaluation Considerations Checklist
5.5 What Missing Camera Metadata Actually Means

Part VI Prompting AI With Your Results

6.1 General Analysis Prompt — No Camera Model Present
6.2 Camera Model Present — Hardware Alignment Prompt
6.3 Tips For Getting The Most From AI Analysis

Part VII Real World Case Studies

7.1 Case Study 1 — The Portal Over Switzerland
7.2 Case Study 2 — Ocean UFO Sighting 2019
7.3 Case Study 3 — Mage, Brazil 2020

Media Authenticator — Forensic Analysis & Physics Guide Page 2

7.4 All Three Cases — Side By Side Comparison

Media Authenticator — Forensic Analysis & Physics Guide Page 3

Part I — Getting Started
Terminal & Python for Absolute Beginners

If you have never opened Terminal before, this section is written specifically for you. No assumed knowledge.
No skipped steps. We will walk through every command you need to type, explain what it does before you type
it, and tell you exactly what a successful result looks like.

1.1 What Is Terminal?

Your computer has two ways of accepting instructions. The first is the graphical interface you use every day —
clicking icons, dragging files, opening menus. The second is Terminal (on Mac) or Command Prompt /
PowerShell (on Windows) — a text-based window where you type instructions directly to the operating system.

Think of it this way: the graphical interface is like ordering food from a menu. Terminal is like walking directly
into the kitchen and telling the chef exactly what to do. It feels unfamiliar at first but it gives you direct, precise
control — and most professional tools for data analysis, AI, and forensics are designed to be used this way.

Important: You Cannot Break Your Computer by Typing

The commands in this guide are read-only or create new files. You will not delete anything, modify system
files, or cause damage by following these instructions. The worst that can happen is an error message —
and error messages are just the computer telling you what to fix.

1.2 Your First Terminal Commands

Before installing anything, let's get comfortable. Open Terminal (Mac: Spotlight search → type 'Terminal' →
Enter) or Command Prompt (Windows: Start Menu → type 'cmd' → Enter).

Command What It Does

pwd Print Working Directory — shows you which folder you are currently in

ls List — shows all files and folders in your current location (Mac/Linux)

dir Directory — same as ls but for Windows Command Prompt

cd Downloads Change Directory — moves you into your Downloads folder

cd .. Two dots — moves you one folder level up

clear Clears the screen so you can start fresh (Mac/Linux)

cls Same as clear but for Windows

Media Authenticator — Forensic Analysis & Physics Guide Page 4

Try typing pwd right now and pressing Enter. Terminal will respond with something like /Users/YourName or
C:\Users\YourName — that is your home directory, where you currently are.

1.3 Installing Python on Mac

Mac computers come with Python pre-installed but it is often an older version. We will use Homebrew — a free
package manager for Mac — to install a clean current version. Follow these steps exactly, one at a time.

Step 1 — Check if Homebrew is already installed

Type this in Terminal:

brew --version

If you see a version number like 4.x.x you already have it. ' If you see 'command not found' continue to
Step 2.

Step 2 — Install Homebrew (skip if already installed)

Type this in Terminal:

/bin/bash -c "$(curl -fsSL

[Link]

This will download and install Homebrew. It may ask for your Mac password — type it and press Enter
(the cursor will not move while you type, that is normal).

Step 3 — Install Python via Homebrew

Type this in Terminal:

brew install python

Homebrew will download and install the latest Python. This takes 2-5 minutes. You will see a lot of text —
that is normal.

Step 4 — Verify Python installed correctly

Type this in Terminal:

python3 --version

You should see Python 3.x.x printed back. If you do, Python is successfully installed.

1.4 Installing Python on Windows

Windows does not come with Python pre-installed. The process is straightforward but has one critical checkbox
you must not miss.

Media Authenticator — Forensic Analysis & Physics Guide Page 5

Step 1 — Download Python
Open your web browser and go to: [Link]/downloads

Click the large yellow Download Python button. It will automatically suggest the right version for your
system.

Step 2 — Run the Installer (CRITICAL STEP)

Open the downloaded file

BEFORE clicking Install Now — look at the bottom of the installer window. There is a checkbox that says
'Add Python to PATH'. You MUST check this box. If you miss this step Python will install but Terminal will
not be able to find it.

Step 3 — Verify Installation

python --version

Open Command Prompt (Start → type cmd → Enter) and type this. You should see Python 3.x.x. If you
see an error, re-run the installer and make sure the PATH checkbox is ticked.

1.5 Setting Up a Virtual Environment

A virtual environment is like a clean, isolated workspace for your project. Think of it as a separate toolbox —
tools you install inside it stay contained there and do not affect the rest of your computer. This is best practice
for any Python project.

Terminal Commands — Virtual Environment Setup

# Navigate to where you want your project to live

cd ~/Desktop

# Create a new folder for the project

mkdir media_authenticator
cd media_authenticator

# Create the virtual environment (Mac/Linux)

python3 -m venv venv

# Create the virtual environment (Windows)

python -m venv venv

# Activate it (Mac/Linux)
source venv/bin/activate

# Activate it (Windows)
venv\Scripts\activate

# You will now see (venv) at the start of your terminal line
# This confirms your environment is active

Media Authenticator — Forensic Analysis & Physics Guide Page 6

When your virtual environment is active you will see (venv) at the beginning of your terminal prompt. Every time
you open a new terminal session and want to work on this project, navigate to your project folder and run the
activate command again.

1.6 Installing ExifTool

ExifTool is a standalone program — separate from Python — that reads all the hidden metadata baked into
image and video files. Think of it as reading the birth certificate of a file: camera model, timestamps, GPS
coordinates, encoding software, and much more. It must be installed before the Python libraries because
pyexiftool (a Python library) relies on ExifTool being present on your system to function.

Installing ExifTool on Mac

ExifTool installs via Homebrew — the same package manager we used for Python. With your terminal open,
follow these steps:

Step 1 — Check if Homebrew is installed

Type this in Terminal:

brew --version

If you see a version number, skip to Step 3. If you see 'command not found', you need to install Homebrew
first.

Step 2 — Install Homebrew (skip if already installed)

Type this in Terminal:

/bin/bash -c "$(curl -fsSL

[Link]

Follow the on-screen prompts. It may ask for your Mac password — type it and press Enter. The cursor
will not move while you type, that is normal and expected.

Step 3 — Install ExifTool

Type this in Terminal:

brew install exiftool

Homebrew will download and install ExifTool. You will see a progress bar followed by a success message.

Step 4 — Verify ExifTool installed correctly

Type this in Terminal:

exiftool -ver

IMPORTANT: ExifTool uses a single dash, not double dash. You should see a version number like 12.89
printed back immediately. If you see a long help document scroll past, you accidentally used --version (two
dashes). Press q to exit and try again with -ver.

Media Authenticator — Forensic Analysis & Physics Guide Page 7

ExifTool Flag Quirk — Important
ExifTool follows older Unix conventions where a single dash is used instead of double dash for flags. So
the version check is exiftool -ver not exiftool --version. Running --version opens the full help manual
instead of printing the version number. If you land in that manual view, simply press the q key to quit back
to your terminal prompt. Every other tool in this project uses the modern double-dash convention —
ExifTool is the only exception.

Installing ExifTool on Windows

Windows does not have Homebrew, so ExifTool is installed directly from its official website. Follow these steps
carefully:

Step 1 — Download ExifTool

Open browser and go to: [Link]

Under the Windows Executable section, click the link to download exiftool(-k).exe — this is the standalone
executable file.

Step 2 — Rename the file

Rename exiftool(-k).exe to [Link]

Find the downloaded file (usually in your Downloads folder). Right-click it and choose Rename. Remove
the (-k) part so it reads simply [Link] — this is required for it to work from Terminal.

Step 3 — Move it to a system folder

Move [Link] to C:\Windows

Open File Explorer, navigate to C:\Windows, and drag [Link] into that folder. You may be asked for
administrator permission — click Yes. This places it somewhere Windows can find it from any folder.

Step 4 — Verify installation

exiftool -ver

Open a new Command Prompt window (important: new window, not an existing one) and type this. You
should see a version number. If you see 'not recognized as a command', the file was not moved to
C:\Windows correctly — repeat Step 3.

Why ExifTool Is The Right Tool For This Job

There are many metadata readers available — so why ExifTool specifically? Several reasons make it uniquely
suited to forensic authenticity work:

Media Authenticator — Forensic Analysis & Physics Guide Page 8

Depth of Coverage
Most metadata viewers show you the surface layer — filename, dimensions, maybe a date. ExifTool reads
over 20,000 unique metadata tags across hundreds of file formats. It surfaces the encoder string, codec
version, muxer settings, GPS altitude alongside coordinates, camera serial number, lens focal length,
sensor crop factor, and dozens of fields that consumer tools never expose. In forensic work, the difference
between a finding and a missed finding often lives in those deeper fields.

The Encoder Field Is Your First Filter

ExifTool reliably surfaces the Encoder or Software metadata field — which tells you what program last
processed the video file. A genuine field capture from a smartphone shows the manufacturer's own
encoder (Apple QuickTime, Samsung's encoder string, etc.). A file that has been run through video editing
software shows FFmpeg, HandBrake, Adobe Premiere, DaVinci Resolve, or similar. This single field is
often your fastest and most decisive first-pass filter before running any of the visual analysis layers.

Timestamp Forensics
ExifTool reads multiple independent timestamp fields — CreateDate, ModifyDate, TrackCreateDate,
TrackModifyDate, MediaCreateDate, and more. A genuine unmodified capture has all of these agreeing
with each other and with the claimed event date. Zeroed timestamps (0000:00:00 00:00:00), mismatched
timestamps across fields, or timestamps in the future are all forensic signals. ExifTool is the only
commonly available tool that reads all of these fields simultaneously and outputs them in a comparable
format.

GPS and Location Cross-Referencing

When GPS metadata is present ExifTool extracts latitude, longitude, altitude, GPS timestamp, and GPS
processing method. You can drop those coordinates directly into Google Maps or Google Earth to verify
whether the claimed location matches the visible environment in the footage. Mismatches between
embedded GPS and visible landmarks are a powerful authenticity signal. Absence of GPS from a device
that typically embeds it is equally telling.

File Format Agnostic

ExifTool handles MP4, MOV, WEBM, AVI, MKV, JPG, PNG, TIFF, HEIC, RAW formats, and dozens more
— all with the same command syntax. You do not need a different tool for each file type, which matters
when you are processing batches of content from different sources and devices.

Media Authenticator — Forensic Analysis & Physics Guide Page 9

No Internet Required
ExifTool runs entirely locally. No file is uploaded to any server. For sensitive investigative work —
especially footage that may be evidence of something significant — keeping analysis entirely offline is
both a security and privacy consideration that ExifTool satisfies by design.

1.7 Installing Your Python Libraries

Libraries are pre-built collections of code that give Python new abilities. The pip command is Python's built-in
library installer — think of it as an app store for Python tools. With your virtual environment active, run this
single command to install everything you need:

Install All Required Libraries (run this once)

pip install pillow numpy opencv-python transformers torch torchvision matplotlib

pyexiftool

This will take several minutes. A progress bar will appear. When it finishes and your (venv) prompt returns, all
tools are installed and you are ready to run the Media Authenticator script.

Library What It Does

pillow Opens and processes image files

numpy Handles mathematical operations on pixel data

opencv-python Processes video, extracts frames, runs optical flow

transformers Connects to local AI detection models

torch / torchvision Runs AI models — optimised for Apple M-series chips

matplotlib Draws FFT frequency visualisation graphs

pyexiftool Reads hidden metadata from image and video files

Media Authenticator — Forensic Analysis & Physics Guide Page 10

Part II — How Digital Video Actually Works
To understand what the forensic tools are measuring you first need to understand what a digital video file
actually is at a fundamental level. It is not a direct recording of reality — it is a layered mathematical
approximation of reality, shaped at every stage by physical and computational processes that each leave a
measurable signature.

2.1 From Light to File: The Four-Step Process

Capture
Light enters the camera lens and hits a silicon sensor made of millions of light-sensitive cells called
photosites. Each photosite records how much light struck it during the exposure window. The lens itself —
its glass elements, aperture geometry, and focal length — physically shapes which frequencies of light
reach the sensor and how they are distributed across it. This optical shaping is called the Optical Transfer
Function and it is unique to every lens design.

Quantisation
The continuous light values from the sensor are converted into discrete numbers. A 12-bit sensor can
represent 4096 distinct brightness levels per colour channel. This conversion — analogue to digital —
introduces a specific pattern of numerical rounding called quantisation noise that is characteristic of the
sensor hardware.

Compression
Raw sensor data is enormous — a single uncompressed 4K frame would be over 30 megabytes.
Compression algorithms mathematically discard information the human eye is least sensitive to, reducing
file size by factors of 10 to 100. This process leaves a precise, measurable mathematical fingerprint in the
data.

Encoding
The compressed data is packed into a container format — MP4, MOV, WEBM — along with metadata
about the camera, timestamp, GPS, and encoding software. This metadata layer is a separate forensic
record of the file's origin and history.

Every single one of these four stages leaves a mathematical fingerprint that is specific, consistent, and
measurable. Real unedited footage has a fingerprint that flows coherently through all four stages from

Media Authenticator — Forensic Analysis & Physics Guide Page 11

 the same original source. Fabricated or manipulated footage has fingerprints from multiple sources that
do not perfectly align — and that is precisely what the forensic tools detect.

2.2 What a Pixel Really Is

A pixel is not a point of colour. It is a triplet of numbers — one for red intensity, one for green, one for blue —
each typically ranging from 0 to 255. A 1920x1080 video frame contains 2,073,600 pixels, which means it is a
matrix of over six million numbers. Every forensic operation we perform is a mathematical operation on this
matrix — looking for inconsistencies in the patterns those numbers form.

2.3 Compression and the Discrete Cosine Transform

JPEG and video compression both use the Discrete Cosine Transform (DCT). Rather than storing individual
pixel values, the DCT divides the image into 8x8 pixel blocks and asks: what combination of wave patterns at
different spatial frequencies would reconstruct these pixels? Think of it like describing a piece of music not by
listing every note but by saying 'this much bass, this much midrange, this much treble.'

DCT Formula for an 8x8 block:

F(u,v) = C(u)C(v)/4 × SUM[f(x,y) × cos((2x+1)u*pi/16) × cos((2y+1)v*pi/16)]

Where F(u,v) is the frequency coefficient at position u,v and f(x,y) is the original pixel value. The compression
algorithm then discards the highest frequency coefficients — the amount discarded is controlled by the quality
setting. Each compression pass introduces a specific, mathematically predictable pattern of loss.

Media Authenticator — Forensic Analysis & Physics Guide Page 12

Part III — The Three Forensic Analysis
Methods

3.1 Error Level Analysis (ELA)

ELA is a forensic technique that reveals the compression history of an image or video frame. It exposes regions
that have been edited, composited, or generated separately by detecting inconsistencies in how different parts
of the image respond to recompression.

How It Works
The core mathematical operation is a difference map between an original image and a deliberately
recompressed version of it:

ELA(x,y) = |Original(x,y) - Recompressed(x,y)| × Amplification_Factor

If an image has been compressed once at quality level Q, recompressing it again at Q produces almost zero
change — the image is already in compression equilibrium. The ELA map is nearly black everywhere.

But if a region was compressed at a different quality level, compressed multiple times, or generated by a
completely different process like CGI rendering, it is not in equilibrium with the surrounding content.
Recompressing it shifts it differently. The ELA map lights up in that region — revealing the manipulation
boundary.

Reading ELA Output

ELA Appearance What It Means

Nearly black everywhere Uniform ELA — no manipulation detected

Classic composite seam — element inserted from different

Bright isolated outline around an object
source

Brighter in object than background Object has different compression history from scene

Individual point sources with small responses Genuine bright objects — each responding independently

Uniform bright noise across scene Natural high-detail scene (street lights, complex texture)

Camera Hardware and ELA

Different camera manufacturers use different DCT quantisation tables — essentially different versions of which
frequency components to preserve. An iPhone has a different quantisation signature than a Samsung Galaxy or
a Canon DSLR. Advanced forensic analysis can identify the likely camera model from ELA patterns alone. The
FBI and NIST maintain databases of camera quantisation fingerprints for exactly this purpose in legal
investigations.

Media Authenticator — Forensic Analysis & Physics Guide Page 13

3.2 Fast Fourier Transform (FFT) Frequency Analysis
The FFT analyzes the spatial frequency content of an image — how rapidly pixel values change across the
frame. Every real camera lens imprints a characteristic frequency signature onto every image it captures,
determined by the physics of optics. The FFT detects when that signature is absent or inconsistent, indicating
non-photographic origin.

The Mathematics
The 2D Discrete Fourier Transform decomposes an image into its constituent spatial frequencies. Fourier's
insight — that any signal can be expressed as a sum of sine waves at different frequencies — applies as
powerfully to images as to sound:

F(u,v) = SUM_x SUM_y [ f(x,y) × e^(-i2*pi*(ux/M + vy/N)) ]

Where f(x,y) is the pixel value at position x,y — F(u,v) is the complex frequency coefficient at spatial frequency
u,v — M and N are the image dimensions — and e^(-i2pi...) is the complex exponential decomposing the image
into sine and cosine components at each frequency.

What Real Optics Do to the FFT

Real camera lenses have a physical property called the Point Spread Function (PSF) — when a perfect point of
light enters the lens it spreads into a small blur pattern on the sensor, determined by diffraction, lens aberration,
and focus. This physical spreading acts as a low-pass filter in the frequency domain — the lens physically
attenuates high spatial frequencies.

This produces the characteristic smooth radial dropoff seen in authentic footage FFT maps: bright at the centre,
gradually dimming toward the edges. The specific shape of that dropoff is a fingerprint of the lens system. No
two lens designs produce identical PSF curves.

What CGI and AI Generation Do to the FFT

CGI rendering does not pass through a physical lens — it is computed mathematically. Even when artists add
simulated blur it is applied as a post-process convolution rather than physical optics. The frequency signature is
subtly but measurably different.

AI-generated images have an even more distinctive signature. Generative models are trained on compressed
internet images and learn to reproduce the statistical patterns of those images — including their compression
artifacts. This produces characteristic periodic patterns in the FFT that real photographs do not have, appearing
as structured repetitive grid-like patterns rather than the smooth radial distribution of genuine optical capture.

Reading FFT Output

FFT Appearance What It Means

Single bright centre point, smooth radial

Normal optical capture — genuine camera footage
dropoff

Strong straight edges in frame — normal for cityscapes,

Cross pattern (lines horizontal and vertical)
horizons

Media Authenticator — Forensic Analysis & Physics Guide Page 14

 Circular soft Gaussian blob Dark field with small bright point sources — physically correct

Repeating grid pattern extending outward AI generation artifact — periodic training data signature

Dramatic change between scene sections FFT driven honestly by scene content — positive sign

3.3 Optical Flow Analysis

Optical flow measures the apparent velocity of every point in a video frame between consecutive frames. Real
objects moving through real space obey Newtonian physics — they have mass, inertia, and interact with their
environment. Composited or CGI elements do not. Optical flow detects where those physical laws break down.

The Mathematics
The optical flow constraint equation is the mathematical foundation. It states that if the image is changing over
time, that change must be explainable by pixels moving in some direction at some speed:

(dI/dx)Vx + (dI/dy)Vy + dI/dt = 0

Where dI/dx and dI/dy are the spatial brightness gradients — dI/dt is the temporal brightness gradient — and
Vx, Vy are the velocity components the algorithm solves for. The Farneback algorithm models the local
neighbourhood of each pixel as a polynomial expansion and tracks how that polynomial transforms between
frames, producing a dense vector field — one velocity arrow per pixel.

Why Composited Objects Fail Optical Flow

Momentum Continuity
A physical object cannot instantaneously change velocity. Its motion between frames must be consistent
with a physically plausible trajectory. CGI elements are placed frame-by-frame by animators and can
violate this.

Environmental Coupling
A real object moving through atmosphere is subject to the same air currents as the surrounding scene —
its motion should correlate with cloud movement, dust, atmospheric shimmer. Composited elements are
independent of the environmental motion field.

Media Authenticator — Forensic Analysis & Physics Guide Page 15

Boundary Coherence
At the edge of a real object, flow vectors should transition smoothly between the object's motion and the
background's motion. Compositing software blends two independently rendered motion fields that were
never physically coupled — producing a discontinuous jump at the boundary that physics does not
produce.

Illumination Consistency
As a real object moves through a scene the way light falls on it changes predictably based on light source
positions. AI and CGI both struggle with correctly modeling how a novel object would interact with the real
scene's lighting as it moves.

Reading Optical Flow Ratios

The anomaly detection measures the ratio of the maximum motion in any isolated region versus the average
motion of the entire scene. A ratio of 10x means one region is moving ten times faster than the scene average
in an isolated patch:

Ratio Interpretation

Below 10x Normal scene motion — no anomaly

10-20x Elevated — possible fast-moving object or camera pan artifact

20-50x Significant — isolated region moving independently of scene physics

Strong manipulation indicator — region motion physically disconnected from

50x+
environment

Consistent 30-90x across

Composite element signature — same artificial motion throughout
ALL frame pairs

Spike at specific pairs only More consistent with real object making sudden directional change

Media Authenticator — Forensic Analysis & Physics Guide Page 16

Part IV — Physics, Mathematics & The
Consistency of Reality

4.1 Why Real Recordings Have a Signature

Every real recording is the end product of a single unbroken physical process: photons travel from a source,
interact with objects in the scene, pass through a specific lens with its specific optical characteristics, strike a
specific sensor with its specific noise profile, and are compressed by a specific codec. Every single link in that
chain leaves a measurable mark.

The critical insight is that all of these marks must be internally consistent — they all came from the same
physical event, at the same time, through the same instrument. This internal consistency is not something that
can be manufactured after the fact. It is a property that emerges from the recording being a continuous causal
chain from real physical reality to stored data.

A fabricated element — whether CGI, AI-generated, or composited from another source — breaks that causal
chain. It has its own origin, its own compression history, its own frequency signature, its own motion physics.
The seam where it joins the genuine footage is mathematically detectable even when it is visually invisible.

4.2 Statistical Self-Consistency as a Definition of Truth

All three tools are ultimately measuring the same underlying property from different mathematical angles:
statistical self-consistency.

Real unmanipulated footage has a property called stationarity in its statistical structure — the noise
characteristics, frequency content, and motion fields are internally consistent across the entire recording
because they all came from the same physical process operating under the same laws of physics across space
and time.

Manipulated footage breaks stationarity at the manipulation boundary. ELA measures stationarity of
compression statistics. FFT measures stationarity of spatial frequency statistics. Optical flow measures
stationarity of motion statistics. Each is asking the same question from a different direction:

"Does the information content of this recording require a single physical

generating process to explain — or does it require two?"

This connects to information theory at the deepest level. Shannon entropy quantifies the minimum number of
bits required to describe a signal. A genuine recording of a single physical event has lower combined entropy
across all three measurement dimensions than a fabricated recording — because fabrications require more
information to describe (two sources rather than one) even when they appear simpler visually.

4.3 Camera Hardware and Its Forensic Fingerprint

Media Authenticator — Forensic Analysis & Physics Guide Page 17

The physics of camera hardware creates several distinct forensic fingerprints beyond the three analysis tools:

Sensor Noise Pattern (PRNU)

Every digital sensor has a unique fixed-pattern noise profile caused by microscopic manufacturing
variations in the photosites. This Photo Response Non-Uniformity (PRNU) is like a fingerprint — it is the
same across every image taken by that specific sensor and is used in legal forensics to attribute images to
specific camera units.

Rolling Shutter Signature

Consumer smartphone cameras use CMOS sensors that read the image row by row rather than all at
once. Fast-moving objects produce a characteristic lean or wobble called rolling shutter distortion. The
pattern of this distortion is specific to the sensor's readout speed — a forensic identifier of sensor
generation and manufacturer.

Lens Distortion Profile

Every lens introduces characteristic geometric distortion — barrel distortion (edges bow outward),
pincushion distortion (edges bow inward), or chromatic aberration (colour fringing at edges). These are
unique to the optical design and measurable in the frequency domain.

Demosaicing Algorithm
Colour camera sensors capture only one colour per photosite and interpolate the other two. Different
manufacturers use different interpolation algorithms that leave different mathematical patterns in the pixel
structure — visible under magnification and in frequency analysis.

Media Authenticator — Forensic Analysis & Physics Guide Page 18

Part V — Interpreting Your Results

5.1 Reading the Output: A Plain-Language Key

Output Reading Plain-Language Meaning

Encoder: Lavf... FFmpeg encoder — video was re-processed after original capture

CreateDate: 0000:00:00 Timestamps zeroed — metadata was stripped or never written

No camera make/model No hardware identifier — unusual for direct phone capture

Unix timestamp filename Organic messaging app origin — positive authenticity signal

ELA nearly black Uniform compression history — no obvious manipulation

ELA bright ring/outline Composite seam — element inserted from external source

FFT smooth radial Natural optical capture — genuine lens physics present

FFT periodic grid AI generation artifact — not optical in origin

Flow ratio below 10x Normal scene motion — no anomaly detected

Flow ratio 50x+ all frames Strong composite indicator — artificial independent motion

Flow spikes at specific pairs Consistent with real object sudden directional change

5.2 The Three-Layer Verdict Framework

No single layer is conclusive alone. The power of this toolchain is in the convergence of multiple independent
measurements. Use this framework to build your overall assessment:

Layers Verdict Level Interpretation

Flagged

0 of 3 Inconclusive — No obvious Footage passes all three tests. Cannot confirm

manipulation authenticity but rules out obvious fabrication.

1 of 3 Weak Signal — Single anomaly One layer flagged. Could be technical artifact,
re-encoding, or mild manipulation. Insufficient alone.

2 of 3 Moderate Concern — Multiple Two independent measurements point the same

signals direction. Worth treating with significant scepticism.

3 of 3 Strong Indicator — Convergent All three layers flag consistently. Convergent evidence
evidence strongly suggests manipulation or fabrication.

Media Authenticator — Forensic Analysis & Physics Guide Page 19

5.3 What These Tools Cannot Tell You
This is the most important section in the guide. These tools are falsification instruments — they can rule out
categories of fabrication. They are not verification instruments — they cannot confirm what something is.

■ A clean result does not mean the footage is genuine — it means it passes these specific tests.

■ These tools cannot identify what an unidentified object actually is.

■ A forensically genuine video can still contain a misidentified natural phenomenon.

■ These tools cannot detect sophisticated practical fabrication — staged physical objects in real
environments.

■ Passing all three tests rules out AI generation and obvious CGI compositing — it does not rule out
everything.

■ The absence of manipulation evidence is not evidence of the absence of a mundane explanation.

The most rigorous approach combines this forensic toolchain with independent witness corroboration,
physical trace evidence where available, and provenance chain analysis — tracking a piece of content
back toward its original unedited source. Visual forensics is one layer of a complete investigation, not a
complete investigation itself.

5.4 Evaluation Considerations Checklist

Before drawing any conclusion from your analysis, work through this checklist. Each question is designed to
slow down pattern-matching and keep your assessment epistemically grounded.

Provenance
■ Where did this file come from — direct witness, social media share, re-upload?

■ Can you trace it back toward an original unedited source file?

■ How many hands has it passed through before reaching you?

■ Does the filename follow organic capture naming (timestamps, default camera names) or performative
naming (ALL CAPS, excessive punctuation, embedded conclusion)?

■ Is the claimed date and location verifiable from any independent source?

Metadata Integrity
■ Are CreateDate and ModifyDate present, coherent, and consistent with each other?

■ Does the encoder field match what you would expect from the claimed capture device?

■ If GPS is present — do the coordinates match the claimed location?

■ If GPS is absent — is that unusual for the device type claimed?

Media Authenticator — Forensic Analysis & Physics Guide Page 20

 ■ Are there multiple timestamp fields (TrackCreateDate, MediaCreateDate) and do they agree?

Visual Forensics
■ Do ELA, FFT, and optical flow results point in the same direction or different directions?

■ Is any single flagged result sufficient to explain all anomalies — or do you need multiple explanations?

■ Do the flow anomaly ratios appear consistently across all frame pairs (composite signature) or only at
specific moments (real object behaviour)?

■ Does the FFT pattern change coherently as scene content changes — or is it suspiciously static?

■ Are ELA anomalies confined to the claimed anomalous object — or distributed naturally across the scene?

Contextual Sanity
■ Does the object's behaviour obey recognisable physics — or does it violate conservation of momentum,
inertia, or expected atmospheric interaction?

■ Are there independent witnesses, physical trace evidence, or corroborating recordings from different
angles?

■ Could the object be explained by a known phenomenon — drone, lantern, atmospheric optic, sensor
artifact, bioluminescence?

■ Does the emotional framing of the content (title, description, narration) attempt to pre-conclude for you
before you have evaluated the evidence?

5.5 What Missing Camera Metadata Actually Means

The absence of camera make and model in metadata is one of the most commonly misread signals in this kind
of analysis. Here is what it actually indicates — and what it does not.

What It Can Mean

Deliberate Stripping
Video editing software, social media platforms, and messaging apps all routinely strip camera metadata
when re-encoding or compressing content for distribution. A video shared through WhatsApp, Instagram,
TikTok, or Telegram will typically lose camera make and model regardless of whether the original footage
was genuine. This is the most common reason for absent camera metadata and does not by itself indicate
fabrication.

Media Authenticator — Forensic Analysis & Physics Guide Page 21

Screen Recording
If someone recorded a video playing on a screen — phone filming a TV, screen capture software — there
is no camera because the source was a display, not a lens. The absence of camera metadata combined
with a low resolution, visible scan lines, or moire patterns supports this.

AI or CGI Generation
Purely AI-generated or CGI-rendered content was never captured by a camera and therefore has no
camera metadata by definition. However this alone is not sufficient evidence — the previous two
explanations are far more statistically common.

Professional Post-Production
Professional video production pipelines deliberately strip or replace original camera metadata as a
standard step. A sophisticated fabrication created with professional tools would also lack camera
metadata — but so would a professionally shot documentary.

How to Weight It In Context

Missing camera metadata becomes forensically significant when it appears alongside other signals pointing the
same direction. Use this weighting framework:

Situation Forensic Weight

Missing camera only, all other layers clean Low — consistent with social media distribution of
genuine footage

Missing camera + zeroed timestamps + FFmpeg encoder Moderate — consistent with deliberate
re-processing pipeline

Missing camera + zeroed timestamps + ELA composite High — multiple signals converging on fabrication
seams

Missing camera + zeroed timestamps + FFmpeg + flow Very High — full convergence across all metadata
anomalies 50x+ and visual layers

Camera present + all visual layers clean Most authentic profile — single capture source,
coherent physics

Media Authenticator — Forensic Analysis & Physics Guide Page 22

Part VI — Prompting AI With Your Results
Once you have run your analysis and have the report text plus visual outputs in hand, an AI assistant can help
you interpret the combined weight of evidence, cross-reference camera specifications, and identify patterns
across multiple layers simultaneously. The quality of that analysis depends heavily on how you structure the
prompt. This section gives you tested prompt templates for each scenario.

6.1 General Analysis Prompt — No Camera Model Present

Use this when your ExifTool output shows no camera make or model. Attach your analysis_report.txt and as
many of the ELA, FFT, and optical flow images as your AI interface allows. Then use this prompt:

General AI Analysis Prompt (No Camera Model)

I have run a multi-layer forensic analysis on a video/image

claiming to show [describe subject briefly].
I am attaching:
- The full analysis report (metadata, optical flow anomaly ratios,
AI classification results)
- ELA (Error Level Analysis) images showing compression history
- FFT (Fast Fourier Transform) frequency maps
- Optical flow visualisation maps

Please evaluate the following:

1. METADATA ASSESSMENT
Read the metadata section carefully. Flag anything unusual about
the encoder field, timestamps, or absence of hardware identifiers.
What does the combination of metadata signals suggest about the
file's history before it reached me?

2. ELA INTERPRETATION
Examine the ELA images. Describe what you see in terms of:
- Uniformity vs isolated bright patches
- Whether any bright regions correspond to the claimed anomalous
object vs the background
- Whether the ELA pattern is consistent with a single-source
capture or suggests elements from different compression histories

3. FFT INTERPRETATION
Examine the FFT frequency maps. Describe:
- Whether the pattern is consistent with genuine optical capture
(smooth radial dropoff) or shows AI/CGI artifacts (periodic grid)

Media Authenticator — Forensic Analysis & Physics Guide Page 23

 - Whether the FFT changes coherently between frames as scene
content changes

4. OPTICAL FLOW INTERPRETATION

Using both the numerical ratios in the report and the visual
flow maps, assess:
- Whether the flagged ratios appear consistently (composite
signature) or at specific moments only (real object behaviour)
- Whether the shape visible in the flow maps is geometrically
isolated and clean (artificial) or diffuse and organic (real)

5. CONVERGENCE ASSESSMENT
Do all three visual layers point in the same direction?
What is the most parsimonious explanation for the combined
evidence — single-source genuine capture, composited fabrication,
AI generation, or ambiguous/insufficient evidence?

6. CONFIDENCE AND CAVEATS

State your confidence level and clearly list what these tools
cannot determine — specifically what alternative explanations
remain open even if manipulation is not detected.

Please structure your response as a layered forensic assessment,

not a simple verdict. I want to understand the reasoning at each
layer, not just the conclusion.

6.2 Camera Model Present — Hardware Alignment Prompt

When ExifTool does return a camera make and model, you have an additional powerful verification layer
available. Every camera model has known, documented technical characteristics — sensor size, noise profile,
lens distortion, rolling shutter behaviour, default encoder settings, typical compression quality — and your
forensic results should align with those characteristics if the footage is genuinely from that device. Use this
prompt to cross-reference them:

Camera Model Hardware Alignment Prompt

I have run a forensic analysis on a video/image. The ExifTool

metadata shows the following camera details:

Make: [paste camera make here]

Model: [paste camera model here]
Encoder: [paste encoder string here]
VideoFrameRate: [paste frame rate here]
ImageWidth x ImageHeight: [paste resolution here]

Media Authenticator — Forensic Analysis & Physics Guide Page 24

 Any other hardware fields ExifTool returned

I am also attaching the full analysis report and visual outputs

(ELA, FFT, optical flow images).

Please do the following:

1. CAMERA HARDWARE PROFILE

Based on the make and model listed, describe what you know about
this camera's technical characteristics:
- Sensor type (CMOS/CCD), size, and generation
- Native video resolution and frame rate capabilities
- Default encoder and compression quality settings
- Known rolling shutter behaviour
- Typical lens characteristics (FOV, distortion profile)
- Default metadata fields this camera normally embeds

2. ENCODER ALIGNMENT CHECK

Does the encoder string in the metadata match what this camera
model natively produces? Or does it suggest the file was
re-processed by third-party software after capture?

3. RESOLUTION AND FRAME RATE CHECK

Is the video resolution and frame rate consistent with this
camera model's known output capabilities? Flag any mismatch
between claimed hardware and actual file specifications.

4. FFT VS LENS PROFILE

Examine the FFT maps. Does the spatial frequency distribution
appear consistent with the optical characteristics of this
camera's lens system? Specifically:
- Is the high-frequency rolloff consistent with this sensor size?
- Are there any frequency artifacts inconsistent with this optic?

5. ELA VS SENSOR COMPRESSION

Does the ELA noise pattern appear consistent with this camera's
known compression algorithm and quality setting?
This camera's default compression profile should produce a
specific equilibrium ELA pattern — does what you see match it?

6. ROLLING SHUTTER CHECK

Examine the optical flow maps. Is there visible rolling shutter
distortion on fast-moving elements? Does the pattern and severity
of any rolling shutter effect match what is documented for
this specific sensor's readout speed?

Media Authenticator — Forensic Analysis & Physics Guide Page 25

 7. HARDWARE ALIGNMENT VERDICT
On balance — does the totality of the forensic evidence align
with what you would expect from genuine footage captured by
this specific camera model? List specifically:
- What aligns with the hardware profile
- What does not align or cannot be verified
- What remains ambiguous regardless of hardware match

Be specific about the camera model's known technical parameters

rather than speaking in generalities. I want to know if THIS
camera would produce THESE specific results.

6.3 Tips For Getting The Most From AI Analysis

Attach Everything
The more visual context the AI has the better the analysis. Attach the full report text, all five ELA images,
all five FFT images, and as many optical flow images as your interface allows. The AI can cross-reference
patterns across images that would take you much longer to manually compare.

Name The Subject Briefly But Neutrally

Describe what the footage claims to show in one sentence without emotionally loaded language. 'A video
claiming to show an unidentified aerial object over [location]' is better than 'an incredible UFO that proves
disclosure.' The framing you give shapes how the AI calibrates its prior probability before examining the
evidence.

Ask For Reasoning Not Just Verdict

Always request layered reasoning rather than a simple authentic/fake verdict. Ask the AI to explain what it
sees in each layer independently before synthesising. This lets you evaluate the quality of the reasoning
rather than just accepting a conclusion.

Push Back On Vagueness

If the AI gives a non-committal answer, push: 'Given the specific optical flow ratios of 93x and the ELA ring
signature, what is the most likely single explanation for these combined findings?' Forcing specificity
produces better analysis than accepting hedged generalities.

Media Authenticator — Forensic Analysis & Physics Guide Page 26

Run It Twice With Different Framing
Run the same prompt twice — once describing the subject neutrally and once not describing it at all, just
presenting the forensic data. Compare the responses. If they diverge significantly the AI may be letting the
subject description colour its forensic assessment, which is a form of confirmation bias worth being aware
of.

Keep The Forensic Conclusion Separate From The Phenomenon Conclusion

Explicitly instruct the AI: first tell me what the forensic evidence says about the video file itself, then
separately address what the footage might or might not show. These are two distinct questions that are
frequently and harmfully collapsed into one.

Media Authenticator — Forensic Analysis & Physics Guide Page 27

Part VII — Real World Case Studies
The following three analyses were conducted using the Media Authenticator script documented in this guide.
Each case was selected because it represents a meaningfully different forensic profile — together they illustrate
the full spectrum from clear fabrication through genuine ambiguity to the most forensically authentic result.
Reading them side by side is more instructive than any of them in isolation.

These are presented as worked examples of how to read and interpret each layer of output, and how the
convergence or divergence of signals across layers determines the overall assessment.

Case Study 1 — The Portal Over Switzerland

File: switzerland_portal.mp4 | Duration: 1:05 | Size: 3.8 MB | Resolution: 576 x 1022 | Frame Rate: 28.262 fps

Subject
A widely circulated vertical video claiming to show a large glowing ring of fire — described as a portal — in the
sky over a Swiss hillside. The ring appears geometrically perfect and dramatically lit against overcast clouds. A
text overlay reading 'THE PORTAL OVER SWITZERLAND' with a date is embedded in the lower portion of the
frame throughout.

Metadata Findings
Encoder: Lavf62.3.100 — FFmpeg

CreateDate: 0000:00:00 00:00:00 — Zeroed

ModifyDate: 0000:00:00 00:00:00 — Zeroed

Camera Make/Model: Not present

Filename pattern: Heavily formatted with emoji and embedded conclusion

Visual Analysis Findings

ELA: The ring produced blazing bright outlines on every ELA frame — a textbook composite seam indicating
the ring element was introduced from a different compression source than the background sky. The text overlay
in the lower frame also showed its own distinct ELA signature, confirming it was added as a separate
production layer.

FFT: Single bright centre point with smooth radial distribution — consistent with genuine optical capture of the
real sky and hillside. The base footage is real. The FFT does not flag the ring because it is too small relative to
the background to dominate the frequency map.

Optical Flow: Every single frame pair flagged with ratios between 30x and 93x. The ring shape was clearly
visible in flow maps as a geometrically clean isolated shape with hard motion boundaries — the characteristic

Media Authenticator — Forensic Analysis & Physics Guide Page 28

signature of a composited element with no physical coupling to the surrounding atmospheric motion field.

Optical Flow Ratios

Frame Pair Ratio Signal

0-1 93.2x Extreme

1-2 58.8x Very High

2-3 43.2x Very High

3-4 62.8x Very High

4-5 49.0x Very High

5-6 38.4x High

6-7 33.2x High

7-8 30.6x High

8-9 44.6x Very High

Verdict

Layer Result Weight

Metadata FFmpeg encoder + zeroed timestamps + no camera FAIL

ELA Blazing composite seam perfectly tracing ring outline FAIL

FFT Clean — base footage is genuine optical capture PASS

Optical Flow 30-93x consistent across ALL frame pairs FAIL

Visual Geometrically perfect ring, text overlay production element FAIL

Overall Three of three visual layers + full metadata failure FABRICATED

Key Learning — The Glamour Technique

This video demonstrates the most effective fabrication strategy: embed a false element inside genuinely
real footage. The Swiss hillside, sky, and clouds are completely authentic — the FFT confirms this. The
human eye extends the authenticity of the real environment to the fabricated ring by association. The ring
itself is forensically obvious once the analysis layers are examined, but visually convincing precisely
because everything surrounding it is real. The filename's emotional loading — emoji, capitalisation,
embedded conclusion — also functions as a presupposition that primes the viewer before a single frame
plays.

Forensic Visual Evidence

Media Authenticator — Forensic Analysis & Physics Guide Page 29

 ELA — Error Level Analysis

Note the blazing bright ring outline in every ELA frame — a textbook composite seam. The text overlay in the
lower frame also shows its own distinct signature. Compare the ring boundary brightness to the uniform dark
background: two completely different compression histories.

ELA Frame 0 ELA Frame 1 ELA Frame 2 ELA Frame 3 ELA Frame 4

FFT — Frequency Analysis

Clean single centre point with smooth radial dropoff across all frames — confirming the base footage is genuine
optical capture. The FFT does not flag the ring because the sky background dominates the frequency map.

FFT Frame 0 — Clean radial FFT Frame 2 — Clean radial FFT Frame 4 — Clean radial

Optical Flow — Motion Analysis

The ring shape is clearly visible as a geometrically clean isolated form with hard motion boundaries in every
flow frame. Colors show direction of motion — the ring moves independently of all atmospheric elements
around it. This isolation is the composite signature: no physical coupling to the scene.

Flow 0-1: 93x Flow 2-3: 43x Flow 4-5: 49x Flow 6-7: 33x Flow 8-9: 44x

Media Authenticator — Forensic Analysis & Physics Guide Page 30

Case Study 2 — Ocean UFO Sighting 2019
File: 2019 REAL UFO SIGHTING!!!!!!!!!!!!!!!!! - 01.mp4 | Duration: 0:31 | Size: 5.5 MB | Resolution: 608 x 1080 | Frame
Rate: 30.033 fps

Subject
A short vertical video showing an ocean horizon at dusk with a small cluster of white light dots visible low in the
sky over the water. The dots appear in a loose formation in some frames. The ocean and sky footage appears
to show a genuine handheld capture. The filename contains 22 exclamation marks and the word REAL in all
capitals.

Metadata Findings
Encoder: Lavf62.0.100 — FFmpeg

CreateDate: 0000:00:00 00:00:00 — Zeroed

ModifyDate: 0000:00:00 00:00:00 — Zeroed

Camera Make/Model: Not present

Filename pattern: 'REAL' presupposition + 22 exclamation marks — performative not organic

Visual Analysis Findings

ELA: Relatively uniform noise across the entire frame. The sky and cloud regions showed natural heavier ELA
activity consistent with higher-detail compression regions. The ocean surface showed clean dark ELA
consistent with uniform low-detail areas. Critically — the light objects showed only faint subtle ELA responses
with no hard composite seam outlining them. No obvious manipulation boundary detected.

FFT: A cross pattern extending horizontally and vertically from the centre — caused by the strong straight
horizon line where ocean meets sky. This is physically expected and normal for ocean footage. No repeating
grid patterns or AI generation artifacts present.

Optical Flow: Ratios of 10-15x across all frame pairs — elevated but moderate compared to Case Study 1. Flow
maps showed diffuse color spread rather than the geometrically clean isolated ring shape of a composited
element. The motion field does not cleanly trace the light objects the way a composite signature would.

Optical Flow Ratios

Frame Pair Ratio Signal

0-1 11.2x Moderate

1-2 11.8x Moderate

2-3 10.9x Moderate

3-4 11.5x Moderate

Media Authenticator — Forensic Analysis & Physics Guide Page 31

 4-5 12.4x Moderate

5-6 15.4x Elevated

6-7 12.4x Moderate

7-8 12.8x Moderate

8-9 11.1x Moderate

Verdict

Layer Result Weight

Metadata FFmpeg encoder + zeroed timestamps + no camera FAIL

Relatively uniform — no obvious composite seams on

ELA PASS
objects

FFT Cross pattern consistent with ocean horizon — normal PASS

Optical Flow 10-15x moderate, diffuse — no clean composite shape AMBIGUOUS

Visual Small indistinct dot cluster — not geometrically perfect AMBIGUOUS

Overall Metadata suspicious, visual layers ambiguous UNRESOLVED

Key Learning — Suspicious Packaging Around Ambiguous Footage

This case demonstrates how metadata and visual forensics can point in different directions
simultaneously. The distribution fingerprint is clearly processed — FFmpeg, zeroed timestamps, no
camera identity — suggesting the footage passed through deliberate production hands. Yet the visual
layers do not confirm fabrication of the objects themselves. The most accurate conclusion is that this is
real footage of something, re-packaged and distributed through a production pipeline. What that
something is remains genuinely unresolved. The 22 exclamation marks and embedded REAL
presupposition in the filename are themselves a forensic signal — genuine witness uploads rarely name
files this way.

Forensic Visual Evidence

ELA — Error Level Analysis

Uniform noise distribution throughout — no isolated bright seam tracing the light objects. The upper half (sky)
shows heavier natural ELA activity from cloud detail. The lower half (ocean) is clean dark. The objects
themselves show only faint subtle responses — no hard composite boundary.

Media Authenticator — Forensic Analysis & Physics Guide Page 32

 ELA Frame 0 ELA Frame 1 ELA Frame 2 — ELA Frame 3 ELA Frame 4
objects visible

FFT — Frequency Analysis

Cross pattern caused by the strong straight horizon line — physically expected for ocean footage and not a
manipulation signal. No repeating grid patterns or AI generation artifacts present in any frame.

FFT Frame 0 — cross pattern FFT Frame 2 — objects appear FFT Frame 4 — cross pattern

Optical Flow — Motion Analysis

Diffuse color spread rather than a geometrically clean isolated shape. The motion field does not cleanly trace
the light objects the way a composite signature would. The strong horizontal band is the ocean-sky boundary —
physically expected. No clean ring or hard-edged shape visible.

Flow 0-1: 11x Flow 2-3: 10x Flow 4-5: 12x Flow 6-7: 12x Flow 8-9: 11x

Media Authenticator — Forensic Analysis & Physics Guide Page 33

Case Study 3 — Mage, Brazil 2020
File: [Link] | Duration: 0:50 | Size: 762 kB | Resolution: 376 x 640 | Frame Rate: 30.02 fps

Subject
A low-resolution WEBM video beginning with handheld footage shot from a moving vehicle on a night-time city
street, then transitioning to footage of a dark sky containing multiple red and white light objects arranged in
formations that change between frames. The objects are visible against a near-black sky with a hillside
silhouette at the bottom of frame.

Metadata Findings
Filename: [Link] — Unix timestamp, converts to May 14 2020

File format: WEBM — consistent with WhatsApp / Telegram messaging app saves

Encoder: Lavf58.20.100 — older FFmpeg version, consistent with 2020 era tools

Camera Make/Model: Not present — consistent with messaging app re-encoding

Timestamps: Not embedded — typical for messaging platform distribution

Visual Analysis Findings

ELA — Sky Frames: Each individual light object showed its own small independent ELA response — meaning
each point source was behaving like a genuine bright object that interacted with the compression algorithm
individually. The surrounding dark sky was nearly completely black in ELA terms — exactly what real dark sky
produces. No composite seam, no boundary outlining a group of objects as an inserted layer.

ELA — Street Frames: Heavy chaotic ELA noise throughout — completely normal for a scene full of street
lights, moving cars, and complex urban texture. The transition from chaotic street ELA to clean dark-sky ELA
with small individual point responses is physically self-consistent.

FFT — Street Frames: Cross pattern from straight urban edges — normal. FFT — Sky Frames: A radially
symmetric Gaussian blob — soft and circular with no cross lines. This is mathematically exactly what you
predict from multiple small bright point sources against a dark background. Each point source contributes a flat
spectrum; their superposition creates rotational symmetry. The FFT is describing the scene honestly. No AI or
CGI generator produces this specific pattern from this specific scene type without also introducing characteristic
artifacts.

Optical Flow: Mostly moderate readings of 10-20x with two spikes at specific frame pairs (43x and 57x). This
spike-at-specific-moments pattern is more consistent with a real object making sudden directional changes than
a composited element which would maintain a consistent artificial motion signature across all frame pairs. The
formation of objects also visibly changes between frames — from a vertical linear column to a scattered
asymmetric cluster — which is physically harder to explain as CGI animation than as real objects.

Media Authenticator — Forensic Analysis & Physics Guide Page 34

Optical Flow Ratios

Frame Pair Ratio Signal

0-1 10.9x Moderate

1-2 17.5x Moderate

2-3 43.1x Significant spike

3-4 17.9x Returns moderate

4-5 Not flagged Normal

5-6 15.3x Moderate

6-7 57.5x Significant spike

7-8 22.9x Returns moderate

8-9 16.1x Moderate

Verdict

Layer Result Weight

Metadata filename Unix timestamp — organic messaging app origin POSITIVE

Metadata format WEBM — consistent with direct share chain POSITIVE

Metadata encoder Older Lavf58, consistent with 2020 era re-share MILD

ELA street frames Natural chaotic noise — genuine urban scene POSITIVE

ELA sky frames Individual point responses, no composite seams POSITIVE

FFT sky frames Gaussian blob — physically coherent with scene content POSITIVE

Optical Flow Spike pattern at specific pairs — real object behaviour POSITIVE

AUTHENTIC
Overall Most forensically genuine profile of all three cases
FOOTAGE

Media Authenticator — Forensic Analysis & Physics Guide Page 35

Key Learning — Authentic Footage Is Not Proof of What the Objects Are
This is the most forensically genuine of the three cases across every layer examined. The organic
distribution fingerprint, self-consistent frequency analysis, clean ELA on the objects themselves, and
physically plausible motion signatures all point toward genuine footage of something. The formation
change between frames is physically interesting and difficult to explain with common prosaic sources.
However — and this is the most important principle in this entire guide — authentic footage of unknown
objects is not the same as footage of paranormal objects. The forensic tools have established that the
video is not obviously fabricated. They say nothing about what the objects actually are. That question
requires additional investigation layers that no script can automate.

Forensic Visual Evidence

ELA — Error Level Analysis

The street scene frames show heavy chaotic ELA noise — completely normal for complex urban texture with
multiple light sources. The dark sky frames show each light object with its own small independent ELA
response, with near-black surrounding sky. No composite seam, no group boundary. This is the cleanest ELA
profile of all three cases.

ELA Frame 0 — street ELA Frame 1 — street ELA Frame 2 — ELA Frame 3 — ELA Frame 4 —
objects objects objects

FFT — Frequency Analysis

Street frames show cross pattern from straight urban edges — normal. Sky frames show a radially symmetric
Gaussian blob with no cross lines — mathematically exactly what multiple small bright point sources against a
dark background produce. The FFT changes coherently as scene content changes, confirming it is driven
honestly by what is actually in the frame.

Media Authenticator — Forensic Analysis & Physics Guide Page 36

 FFT Frame 0 — street cross FFT Frame 2 — Gaussian blob FFT Frame 4 — Gaussian blob
(objects) (objects)

Optical Flow — Motion Analysis

The isolated shape visible in the upper left quadrant across multiple flow frames shows an organic irregular
form — not the geometric precision of a composited element. The two significant spikes (43x at pair 2-3 and
57x at pair 6-7) represent specific moments of rapid direction change rather than a consistent artificial motion
maintained throughout.

Flow 0-1: 10x Flow 2-3: 43x SPIKE Flow 4-5: normal Flow 6-7: 57x SPIKE Flow 8-9: 16x

Media Authenticator — Forensic Analysis & Physics Guide Page 37

Case Study Comparison — All Three Cases

Viewing the three cases side by side makes the contrast between their forensic profiles more instructive than
any individual analysis. Note particularly how the most visually spectacular and emotionally compelling video
(Switzerland) produced the clearest fabrication signature, while the least visually dramatic (Mage, Brazil)
produced the most genuinely authentic forensic profile.

Layer Switzerland (Portal) Ocean UFO (2019) Mage Brazil (2020)

Encoder FFmpeg 62 FFmpeg 62 FFmpeg 58 (older)

Timestamps Zeroed Zeroed Absent (platform)

Filename Pattern Performative Performative Organic Unix TS

File Format MP4 MP4 WEBM (messaging)

ELA FAIL — seam PASS — uniform PASS — points

FFT PASS — clean PASS — cross PASS — Gaussian

Optical Flow FAIL — 30-93x AMBIGUOUS 10-15x PASS — spikes only

Overall FABRICATED UNRESOLVED AUTHENTIC FOOTAGE

The Inversion Principle: The most spectacular and emotionally compelling video was the most clearly
fabricated. The most visually underwhelming video was the most forensically genuine. This inversion is
not a coincidence — it reflects the fundamental mechanics of how fabricated content is designed.
Spectacular visuals trigger emotional engagement before analytical evaluation can engage. Forensic
tools reverse that sequence — forcing the data to speak before the emotion does.

Built for researchers who want to go beyond belief and dismissal — and into evidence.

Media Authenticator — Forensic Analysis & Physics Guide Page 38