Verifying Online Video: Provenance, Keyframes, and Context

BY DR. LELAND W. SMITH

A dramatic video starts circulating during a breaking news event. Within an hour it has been shared thousands of times, with captions that say it shows something that happened this morning. Your job is to work out whether that is true. Videos are among the most persuasive forms of online content and among the most often misrepresented, and most misleading videos are not sophisticated fakes. They are real footage with the wrong date, the wrong place or the wrong story attached.

Verification answers a few practical questions: where did this video first appear, who recorded it, where was it filmed, when was it filmed, and has it been altered? This guide works through each one with techniques you can use today.

Start by preserving the video

Before you analyse anything, save it. Videos are removed, re-edited and re-uploaded constantly. Record the URL of the post where you found it, the account that posted it, the caption, and the time you accessed it in UTC. Download the file where you are permitted to, at the highest quality available, and record a SHA-256 hash. Command-line tools such as yt-dlp can download publicly available video from many platforms; check the platform's terms and your own authorisation before using them.

Keep the original download untouched. Do all of your analysis on copies.

Find the earliest upload

The copy you were sent is almost never the original. It is usually a re-upload, a screen recording, or a compilation with music and captions added. Tracing a video back to its first appearance is often the single most useful step, because the earliest upload is the closest you will get to the person who filmed it, and its date sets a ceiling on how recent the event can be.

Searching for earlier copies

• Reverse search keyframes from the video (covered below). This is the most reliable way to find earlier copies.
• Search the platform for key terms describing the scene, sorted by upload date where the platform allows it.
• Look for watermarks, usernames or logos burned into the video. A watermark from another platform tells you where to look next.
• Check comments and replies. Someone often says "this is from 2019" or names the original creator.

Reading upload times

Platforms display upload times in different ways, often in your local time zone or as a relative value. The InVID-WeVerify plugin (described below) can show the exact upload time for YouTube videos. Record upload times in UTC and note which platform reported them.

The earliest upload you can find is not proof of when the video was recorded. It tells you the video existed by that time. The recording could be older, which is exactly how mislabelled old footage spreads.

Extracting keyframes for reverse search

Reverse image search engines work on still images, so you need to pull frames out of the video. Choose frames that are sharp and distinctive: a clear view of a building, a sign, a skyline, the opening shot and the final shot. Many re-uploads crop or add borders, so try several frames.

You can extract frames in several ways:

• InVID-WeVerify plugin: its keyframes tool extracts representative frames from a video link or uploaded file and lets you send them to reverse image search engines.
• A media player: pause on a clear frame and take a snapshot. VLC, for example, has a snapshot function.
• ffmpeg: the free command-line tool can export the video's keyframes (I-frames) with a command such as ffmpeg -i input.mp4 -vf "select='eq(pict_type,I)'" -fps_mode vfr frame_%03d.png, or one frame per second with ffmpeg -i input.mp4 -vf fps=1 frame_%03d.png.

Search each chosen frame on more than one engine. Google Lens, Bing Visual Search, Yandex and TinEye index different material and handle cropping and mirroring differently. If you find a match, open it, compare it frame by frame, and note which copy came first.

The InVID-WeVerify plugin

The InVID-WeVerify plugin is a free browser extension developed through European research projects and widely used by newsroom verification teams. It groups several tools in one place. The ones you will use most often are:

• Analysis: pulls available information about a video from supported platforms, such as upload time and description, and offers reverse search shortcuts for its thumbnails.
• Keyframes: extracts frames for reverse searching, as described above.
• Magnifier: zooms into a frame to read signs, plates and small details.
• Metadata: reads metadata from a video or image file you upload.
• Forensic filters: image analysis filters that may highlight areas of a still frame that have been edited.

Treat its output as leads, not verdicts. Forensic filters in particular are easy to misread and should only support conclusions you can reach by other means.

On metadata: most social platforms strip or rewrite metadata when a file is uploaded, so a downloaded video rarely carries the original camera's information. If you can obtain the original file directly from the person who recorded it, its metadata is worth examining, though it can be edited and should be corroborated.

Where was it filmed? Comparing landmarks

Geolocation means matching what you see in the video to a real place. Work from the most distinctive features you can find:

• Buildings, towers, bridges, mountains and coastlines
• Shop signs, street signs, language and script
• Road markings, which side of the road traffic drives on, and the style of street furniture
• Vehicle number plates (format, not individual plates) and public transport livery

Once you have a candidate location, compare the video with satellite imagery and street-level imagery from services such as Google Earth, Google Street View and Mapillary. Look for several matching features in the same spatial relationship, not just one similar building. Google Earth's historical imagery can help when a scene has changed, for example if a building has been demolished.

When was it filmed? Weather, light and season

The date is usually the hardest claim to verify, and the one most often falsified. Visible conditions can support or contradict it.

• Weather: compare rain, snow, cloud and wet roads in the video with historical weather records for that place and date. Many national weather services publish historical observations.
• Shadows: the direction and length of shadows depend on the sun's position. Tools such as SunCalc show the sun's position for a location, date and time, which can narrow down the time of day or rule out a claimed date.
• Season: leaves on trees, crops in fields and the clothing people wear should fit the claimed season.
• Temporary features: roadworks, posters, event banners and shopfronts change. A poster for an event that took place years ago is a strong clue.

These checks are better at ruling dates out than proving them. Snow on the ground in a video said to be from a city in midsummer is close to decisive. Clear skies on a clear day only fail to contradict the claim.

Audio cues

Listen to the video with good headphones, more than once. Audio can confirm or undermine what the picture suggests.

• Languages, dialects and accents of people speaking
• Place names, street names or events mentioned
• Sirens, call to prayer, train announcements and other sounds that vary by country or city
• Signs that audio has been replaced: music laid over everything, sound that does not match visible actions, or abrupt cuts in background noise

If people speak a language you do not know, ask a trusted native speaker to translate and to comment on accent and dialect. Machine translation is a starting point, not a final reading.

Re-uploads and mislabelled old footage

The most common problem you will meet is genuine footage presented with a false context. Typical patterns include:

• Footage from a previous storm, protest or explosion re-shared during a new one.
• Footage from one country presented as being from another.
• Clips from films, video games or training exercises presented as real events.
• Edited clips that cut out what came immediately before or after, changing the meaning.

Your reverse searches of keyframes are the main defence. If an earlier copy exists with a different description, compare the two, establish which is older, and look for any reliable reporting from the earlier date.

Synthetic media: proceed with caution

AI-generated and AI-altered video has become much more convincing. Artifacts such as unnatural blinking, warped hands, inconsistent text and faces that blur during movement still appear in some synthetic video, but newer tools produce fewer of them, and real compressed video can show artifacts too.

Some practical points:

• Do not rely on a single detection tool. Their results vary, and both false positives and false negatives are common.
• The provenance work described above still applies. A synthetic video usually has no earlier source, no other angles and no corroborating witnesses.
• Check for Content Credentials. The C2PA standard allows cameras and editing tools to attach signed provenance information to media. Its presence can help, but most content does not carry it, and its absence proves nothing.
• Look for independent footage of the same event from other people. Real events with crowds usually produce several angles.

A worked example

Suppose a video of floodwater pouring through a shopping street is being shared with the caption that it shows a named town this morning.

1. You preserve the post, download the video, and record the URL, account, caption, UTC access time and hash.
2. You extract six keyframes and search them. Yandex returns a match on a video-sharing site uploaded four years earlier, described as flooding in a different town in the same region.
3. You compare the two videos frame by frame. They are the same footage; the new version is cropped and has a caption overlay.
4. You geolocate the older video using a distinctive church spire and a shop sign visible at the end, matching both in street-level imagery of the town named in the older upload.
5. Historical weather records show heavy rainfall in that town on the date of the older upload. Local news from that date reports flooding on the same street.

Your conclusion: the video is genuine footage of flooding, but it shows a different town, recorded at least four years ago. It does not show today's event. You note that you found no evidence about the original filmer's identity beyond the earliest uploading account.

Limits and common mistakes

• Stopping at the first match. An earlier copy may itself be a re-upload. Keep looking for the earliest.
• Confusing "real" with "accurately described". Authentic footage can still be presented falsely.
• Single-feature geolocation. One similar building is not a match. Look for several features in the correct relative positions.
• Overtrusting tools. Forensic filters and deepfake detectors give indications, not answers.
• Not saying what you could not verify. State the open questions plainly.

Ethics and legality

Videos of crises often show people at their most vulnerable. Share only what is needed, consider blurring faces of bystanders and victims in any material you publish, and think carefully before amplifying graphic content, even to debunk it. If you contact the person who filmed a video, be honest about who you are and why you are asking, and remember that they may be in danger. Respect copyright and platform terms when downloading and re-publishing footage.

Checklist

1. Preserve the post, file, URL, account, caption, UTC time and hash.
2. Extract several distinctive keyframes.
3. Reverse search frames on multiple engines and trace the earliest upload.
4. Record upload times in UTC and note that upload is not recording time.
5. Geolocate using several matching features and satellite or street-level imagery.
6. Test the claimed date against weather, shadows, season and temporary features.
7. Listen for language, place names and sounds, and signs of replaced audio.
8. Check for earlier versions with different descriptions.
9. Treat synthetic media detection as one input, and look for independent angles.
10. State what is verified, what is assessed and what remains unknown.