Video forensic analysis — checking whether a video has been modified — can be genuinely interesting. A video forensic report asks two separate questions about the same thing, and measures opposite signals to answer them: “Inter-frame tampering?” and “Duplicate frames detected?” One flags frames that are too different from their neighbours. The other flags frames that are too similar. Between them, they cover the two ways a video cut gets made — and the two ways someone tries to hide one.
Splice a cut into a video (i.e. insert a clip, remove one, join two takes together) and the frames right at that join are abruptly different from each other in a way a continuous recording never is. Cover a cut by freezing or repeating a frame instead, and you get the opposite problem: two or more frames that are near-identical in a way real, continuously-recorded footage essentially never produces by chance. Same underlying goal, two opposite fingerprints.
What “too different” actually measures
A real, unedited recording drifts. Frame to frame, most of the picture stays where it was a fraction of a second ago — some motion, some noise, nothing dramatic. snapWONDERS measures how much each frame differs from the one before it, across the whole video, and watches for a sudden spike well outside that normal drift. A splice point produces exactly that: two frames from different moments — sometimes different scenes entirely — sitting next to each other where a smooth transition should be.
That’s the whole check — not sentiment, not pixel content, just how much changed between one frame and the next, measured directly and compared against the rest of the same video.
What “too similar” actually measures
The opposite tamper leaves the opposite trace. Freeze a frame to cover a gap, or duplicate frames to stretch a clip’s timing, and you get consecutive frames that are near-identical — not “similar because nothing much happened,” but the kind of exact-or-near-exact repeat a rolling camera doesn’t produce on its own. snapWONDERS checks the sampled frames across a video for that specific pattern and counts how many turn up.
It’s a simpler check than it sounds, and that’s deliberate — it isn’t trying to interpret the footage, just to notice when the sequence stops changing the way a real recording does.
Why they’re read the same way
Although we have two opposite signals to determine video modification, the report describes both findings with the same phrase, which is confusing at first. But that’s not an accident — it’s by design: a spike is “consistent with cuts, splices, or frame insertions,” and a run of duplicates is “consistent with frame insertion or dropped-frame cover-up.” Both are read as evidence of the same underlying act — something was added, removed, or hidden at that point in the timeline — just approached from opposite directions. A video that’s been cut and spliced cleanly might trip one check without the other. A lazy attempt to cover the join might trip both.
The honest failure mode for both
Here’s the part worth being straight about, the same way the GPS timezone triangle check has one. Real footage produces both signals too, for entirely innocent reasons — worth taking care that either signal may have fired for a perfectly ordinary reason, not a cover-up.
A whip pan (a fast, blurry camera swing — like quickly turning to follow someone running past), a strobing light (rapid flashing, like a nightclub strobe or an emergency vehicle’s lights), fireworks, or a genuine hard cut between two camera angles in a video that was edited but not faked — all of these produce a large, sudden frame-to-frame jump, the exact shape “Inter-frame tampering?” is built to catch. Neither check knows the difference between “someone spliced this” and “someone panned the camera very fast.”
The duplicate-frame check has its own honest false alarm, and it’s an unusually common one: frame-rate conversion (a form of video re-encoding). Converting 24fps footage to 30fps (the classic film-to-video “pulldown” process) manufactures genuinely duplicated frames as a normal side effect of the conversion math — nobody hid anything, the maths of stretching one frame rate into another just repeats frames by design. A tripod-locked static shot, a screen recording, or security-camera footage sitting still between events reads the same way. A video that has simply not moved much looks, on paper, identical to one where a frame was frozen on purpose.
That’s not a flaw to apologise for — it’s a precise description of what each check can and can’t claim, and exactly why they’re two signals inside a wider report, never a verdict read alone.
Two witnesses, not a verdict
On their own, “too different” and “too similar” are each just a shape in a sequence of numbers — neither knows anything about what actually happened in the video. What they give a reader is something concrete to point at: a specific timestamp where the sequence stopped behaving like continuous footage, worth checking against everything else the report finds, rather than a claim to accept or reject by itself.
If you want to see what these two checks actually say about a real file, run a video through snapWONDERS’ video analyse tool — including one you know has been cut, which is the clearest way to watch the spike show up rather than take my word for it.
If you’re building on top of this instead of uploading one file at a time
Both checks are part of the same forensic pipeline that’s reachable through the snapWONDERS API — useful if you’re checking video at any real volume rather than one file through a browser. I wrote up the fuller story of why that API and its official SDKs (Python, JavaScript, Go, PHP) exist in a separate post; the short version is that a video’s inter-frame-tampering and duplicate-frame findings come back as structured, machine-readable fields — not just a pass/fail grade — so a script checking video authenticity programmatically gets the same “why” a person reading the web report does.
Kenneth Springer is the founder of snapWONDERS, a digital forensic analysis platform for images and video. The two frame-tampering checks described here run automatically on every video uploaded for analysis. snapWONDERS video forensic analysis — no account required.