Neverenders
Worked example

Catching a clock
that lies.

This walkthrough uses entirely synthetic footage built for demonstration. No real case material appears anywhere on this site. The goal is to show how the pipeline turns a single file into a finding that a person can verify by eye.

The exhibit

A 20 second clip from a fictional camera labelled CAM-01. It carries a burned-in clock in the lower strip and plays continuously at one frame per second. The footage looks ordinary.

file CAM-01_clip.mp4 duration 20.0 s resolution 640 x 480 sha-256 recorded at intake, before any processing working_copy analysis runs on a copy; the original stays read-only

Stage 1 hashes the file and locks the original. Every later stage reads the working copy only, and writes its own record. That is the chain of custody: if anyone questions whether the file changed during analysis, the intake hash answers it.

Two timekeepers, tracked separately

Stage 5 reads the burned-in clock out of each frame. Stage 6 also knows exactly how much footage has actually elapsed. Holding those two numbers side by side is the whole trick.

Synthetic frame at nine seconds, on-screen clock 14:27:09
Footage second 09   clock 14:27:09
Synthetic frame at ten seconds, on-screen clock 14:30:10
Footage second 10   clock 14:30:10

One frame of footage separates these two images. The on-screen clock between them advances by three minutes and one second. Real elapsed footage advanced by one second. A continuous recording cannot do that.

The reconciliation

Stage 6 fits the on-screen clock against elapsed footage and reports the drift at each step. Nineteen of the twenty intervals line up to the second. One does not.

FootageOn-screen clockElapsedClock stepDrift
00:00:0714:27:07+1.0 s+1.0 s0.0 s
00:00:0814:27:08+1.0 s+1.0 s0.0 s
00:00:0914:27:09+1.0 s+1.0 s0.0 s
00:00:1014:30:10+1.0 s+181.0 s+180.0 s
00:00:1114:30:11+1.0 s+1.0 s0.0 s
00:00:1214:30:12+1.0 s+1.0 s0.0 s

Three minutes of wall-clock time vanish between footage second 9 and second 10, with no corresponding footage. That is the signature of a paused recording or a removed segment.

The finding

The pipeline records this as a single, machine-readable finding with a severity and a recommended next step. The same object appears in the JSON output and in the final report.

High wallclock_discontinuity

One interval where the burned-in clock advanced differently from the elapsed footage. Strong indicator of paused recording or removed and inserted footage. Demand the full unedited original and metadata.

code wallclock_discontinuity severity high between_sec [9.0, 10.0] media_elapsed 1.0 wallclock_adv 181.0 discrepancy_sec 180.0

The clean version of the same footage, with a clock that ticks honestly, produces zero such findings. The test that matters for any detector is that it stays quiet when nothing is wrong. This one does.

What ships in the report

Every engagement ends with one self-contained report and a PDF. It carries the findings, the exhibits they rest on, and the custody log, so the document stands on its own.

Findings tableEvery flag with severity, plain-language explanation, and the evidence behind it.
Chain of custody logIntake hashes and an append-only record of every action taken on the file.
Transcript and audioTime-coded transcript, spectrogram, and audio anomaly map where audio is present.
Frame exhibitsThe keyframes that support each visual finding, embedded directly in the document.
TimelineThe fused, reconciled timeline that exposed the discontinuity above.
Legal reviewA structured written analysis: issues, admissibility, disclosure to demand, and cross-examination points.
A note on certainty. A discontinuity in an on-screen clock is powerful because a person can confirm it without trusting any software. Many forensic signals are softer than this and only narrow the question. Neverenders reports the strength of each signal honestly, and a contested result should always be confirmed by a qualified examiner.
Access your case Back to overview