I'm a Certified Digital Forensic Examiner and Media Collector. I also do lighter weight data recovery. Here's my take.
EXPERT BLUF: There are several reasons why the Prosecution is wrong and the Defense is correct. The pinch to zoom function does alter the data it doesn't interpret the data. Here's why. During the course of a digital forensic investigation or digital forensics portion of an investigation among many things collected files are hashed, and all the identifiers are logged (type, size, etc). This is because when presented to the court, jury, etc; the forensic examiner / collector needs to prove 100% that data hasn't been altered.
1. FACT - Data is being manipulated on the fly and presented, not presented in its original form at a scale. In this instance the original video format would be scaled or aspect ratio changed as needed to fit the display. The frames stay the same and the screen they are rendered on stay the same. But more importantly the original file stays the same. But with this the portion that is zoomed in for viewing alters the data not only by adding but more importantly subtracting the pixels of the original file and enhancing the new rendering. The old pixels aren't magically rendered somewhere else because its not efficient computing (consumes ram, cpu, gpu resources, and battery). Now when you zoom back out they are recalled. The artifacts someone mentioned earlier is pretty close technically. A marker would be left each zooming motion to see which pixels of the original file were subtracted from rendering so they can be recalled instantly without the user ever realizing. So in short, the data is being modified from its original forensic form. Its different with zooming a picture though but that is a whole other discussion. The difference here is the medium that is being used to display information (Video).
2. FACT - I was unable to locate Apple's video software approved for use by DHS/NIST Forensic Validation Program (this software would be likely be under "Analysis" but a general search yielded nothing). This means it hasn't been forensically vetted or failed its vetting.
3. OPINION - On the adding pixel arguement. Without physically examing the ipad it is impossible to know for sure this portion, it is possible that the prosecution has ProRes on or used it to increase the quality of the video which would alter the original file and add more pixels and may create pixel bleed which may give an appearance of an object thats not there or in the original position of the original video. Seeing both an original and rendered video it would be easy to dissect in a pixel analyzer.
4. OPINION - It is highly likely that the pinch to zoom function utilizes some portion of the ProRes Software without even having it enabled because it would make the video look better and we all know how Apple likes showing off cool stuff (oooh.........ahhh.....).
As for me I obtained my certification (and several others) through the Department of Defense, with over 10 years experience in the IC with among many other things NAT SEC Investigations, and I have over 30 years computer experience. I hope this will help dispel some of the false information or at least clarify things for people who might have questions. I'm not a Democrat or Republican but I have to say The Engadget article on this topic is fake news, it was written by a Weekend Editor not a Digital Forensic Examiner.
EXPERT BLUF: There are several reasons why the Prosecution is wrong and the Defense is correct. The pinch to zoom function does alter the data it doesn't interpret the data. Here's why. During the course of a digital forensic investigation or digital forensics portion of an investigation among many things collected files are hashed, and all the identifiers are logged (type, size, etc). This is because when presented to the court, jury, etc; the forensic examiner / collector needs to prove 100% that data hasn't been altered.
1. FACT - Data is being manipulated on the fly and presented, not presented in its original form at a scale. In this instance the original video format would be scaled or aspect ratio changed as needed to fit the display. The frames stay the same and the screen they are rendered on stay the same. But more importantly the original file stays the same. But with this the portion that is zoomed in for viewing alters the data not only by adding but more importantly subtracting the pixels of the original file and enhancing the new rendering. The old pixels aren't magically rendered somewhere else because its not efficient computing (consumes ram, cpu, gpu resources, and battery). Now when you zoom back out they are recalled. The artifacts someone mentioned earlier is pretty close technically. A marker would be left each zooming motion to see which pixels of the original file were subtracted from rendering so they can be recalled instantly without the user ever realizing. So in short, the data is being modified from its original forensic form. Its different with zooming a picture though but that is a whole other discussion. The difference here is the medium that is being used to display information (Video).
2. FACT - I was unable to locate Apple's video software approved for use by DHS/NIST Forensic Validation Program (this software would be likely be under "Analysis" but a general search yielded nothing). This means it hasn't been forensically vetted or failed its vetting.
3. OPINION - On the adding pixel arguement. Without physically examing the ipad it is impossible to know for sure this portion, it is possible that the prosecution has ProRes on or used it to increase the quality of the video which would alter the original file and add more pixels and may create pixel bleed which may give an appearance of an object thats not there or in the original position of the original video. Seeing both an original and rendered video it would be easy to dissect in a pixel analyzer.
4. OPINION - It is highly likely that the pinch to zoom function utilizes some portion of the ProRes Software without even having it enabled because it would make the video look better and we all know how Apple likes showing off cool stuff (oooh.........ahhh.....).
As for me I obtained my certification (and several others) through the Department of Defense, with over 10 years experience in the IC with among many other things NAT SEC Investigations, and I have over 30 years computer experience. I hope this will help dispel some of the false information or at least clarify things for people who might have questions. I'm not a Democrat or Republican but I have to say The Engadget article on this topic is fake news, it was written by a Weekend Editor not a Digital Forensic Examiner.