A flash drive containing recorded media was received via FedEx by Coalfire on September 17th, 2015, where it was examined using industry-standard forensic tools and techniques. The flash drive contained (i) a total of ten (10) videos with audio recorded on two (2) separate devices, and (ii) a total of eight (8) audio recordings made with two (2) audio only devices.
Coalfire’s analysis of the recorded media files contained on the flash drive indicates that the video recordings are authentic and show no evidence of manipulation or editing. This conclusion is supported by the consistency of the video file date and time stamps, the video timecode, as well as the folder and file naming scheme. The uniformity between the footage from the cameras from the two investigators also support the evidence that the video recordings are authentic.
With regard to the “Full Footage” YouTube videos released by the Organization, edits made to these video “restroom breaks,” lacking pertinent conversation. Any discrepancies in the chronology of the time codes are consistent with the intentional removal of this non-pertinent footage as described in this report.
Furthermore, four of the five raw video recordings, which also contained audio captured from the video recording device, are accompanied by a raw audio recording captured from a separate audio-only recording device. The raw audio only recordings last for the duration of their associated raw videos. These raw audio recordings support the completeness and authenticity of the raw video recordings since they depict the same events within the same duration as captured from the two separate video recorders
