A structured assessment of whether a contested recording, image or file is what it is presented to be.
Where a recording or image is disputed, the question is rarely answerable with a simple yes or no. A finding needs to explain what was tested and why it points where it does.
The assessment examines integrity and origin: file metadata, container and encoding history, and content credentials where present. It also reviews evidence of re-encoding or editing, device and codec consistency, and internal plausibility. Findings are expressed as consistent with, not consistent with, or indeterminate, with the reasoning and its limits stated in full.
Two engagement modes are available, Standard and Litigation, set out below.
Applied to a contested photograph, screenshot, or still image.
| Verification Area | What We Examine |
|---|---|
| Metadata and EXIF data | Camera model, capture date, GPS data, and editing software signatures |
| Reverse image search | Prior appearances, stock or stolen content, and earlier versions |
| Compression and artefact analysis | Signs of re-encoding, cloning, or splicing |
| Lighting and shadow consistency | Physical plausibility of light sources and shadows |
| Facial and object consistency | Anatomical or geometric inconsistencies associated with synthetic generation |
| Content credentials | Embedded provenance signals where present |
Applied to a contested video clip or recorded call.
| Verification Area | What We Examine |
|---|---|
| Frame-by-frame analysis | Temporal consistency across frames |
| Compression history | Evidence of re-encoding, transcoding, or multiple exports |
| Audio-visual synchronisation | Alignment between lip movement and the audio track |
| Motion and physics plausibility | Consistency of movement with physical expectation |
| Source and container metadata | Codec, container format, and editing software traces |
| Synthesis indicator screening | Known artefacts associated with face-swap and synthetic media tooling |
Applied to a contested voice recording, voicemail, or call.
| Verification Area | What We Examine |
|---|---|
| Spectral analysis | Frequency patterns inconsistent with natural speech or splicing |
| Voice sample comparison | Comparison against a genuine voice sample of the claimed speaker, where available |
| Background consistency | Ambient noise and acoustic environment plausibility |
| Compression artefacts | Evidence of re-recording or synthetic generation |
| Vishing pattern cross-reference | The circumstances checked against known social engineering scripts |
Where a submission is a suspicious call or voice message rather than a standalone clip, the circumstances are cross-referenced against documented vishing patterns as a matter of course, since a genuine voice can still be used in a scripted deception.
Assessment of file integrity, metadata and encoding history
Review of content credentials and provenance signals where present
Analysis of editing, re-encoding and compression artefacts
Assessment of internal consistency, including acoustic and physical plausibility
Written findings with reasoning, confidence and stated limitations
A binary determination that content is or is not artificially generated
Speaker identification or voice attribution to a named individual
Recovery, extraction or acquisition of files from a device
Assessment of re-recorded or screen-captured material where original files are unavailable, unless expressly agreed in scope
Solicitors and barristers in family, employment and civil matters, insurers, and in-house counsel most commonly instruct this work. Individuals responding to a contested recording also instruct it directly.
Source files are submitted through a confidential inquiry, along with the question the assessment needs to answer.
The engagement mode, Standard or Litigation, is confirmed at scoping, along with turnaround.
Metadata, encoding history, content credentials and internal consistency are examined against the original files.
Findings are reviewed by the principal and expressed as consistent with, not consistent with, or indeterminate, with reasoning stated in full.
The report is delivered. Written clarification, or availability to answer questions under the Litigation mode, follows afterward.
The following are illustrative examples of how Provenance is typically used, not accounts of specific client engagements.
A party to a family dispute submits an audio recording said to capture an admission by the other side. Provenance assesses the file for splicing, re-recording and compression artefacts before either party relies on it in negotiation or proceedings.
An employer receives a video alleged to show misconduct by an employee. Provenance assesses the file's integrity and internal consistency before it informs a disciplinary decision.
An insurer receives photographic evidence supporting a claim. Provenance checks the metadata, compression history and internal consistency of the image before the claim is assessed further.
An opposing party serves an expert report relying on a contested image. Under the Litigation mode, Provenance independently re-examines the same file and tests the opposing report's methodology and conclusions.
Turnaround for a single-file assessment is three working days from receipt of usable source material, not from the date of instruction. Volume or format complexity may extend this; any extension is agreed in writing before work proceeds.
| Section | Content |
|---|---|
| Instructions and issues addressed | The specific questions the examination was asked to address |
| Scope of the examination | What was examined, what was not, and which engagement mode applies |
| Summary of conclusions | A short-form answer to each question, ahead of the full reasoning |
| Exhibit schedule | Every item examined, with format, size and hash on receipt |
| Provenance of the material | How each exhibit reached this firm, and what that means for what can be concluded |
| Chain of custody | Full handling record from receipt to examination |
| Methodology | The examination sequence followed and the standards it aligns with |
| Findings | What was observed in each exhibit, by analysis stream |
| Automated detector outputs | Classifier results, with published error rates and their limitations |
| Evaluation | Every anomaly weighed against the innocent explanations considered for it |
| Conclusions | The instructed questions answered, in defined terminology |
| What would change these conclusions | The further material that would allow a firmer answer |
| Limitations | What the examination does, and does not, establish |
| Declaration | The examiner's confirmations, including independence and completeness |
The specimen below shows a full Standard-mode report, illustrating the report structure above section by section. The case, the exhibits, the parties and every finding are fictitious.
Download the specimen report (PDF) →Assessment of contested media carries real limits, stated here rather than left implicit.
Every enquiry is reviewed by an analyst and routed to a scoping call, a written scope is confirmed before any work begins.