Question 1

Can you just run a deepfake detector and get an answer?

Accepted Answer

No, not a reliable one on its own (§4, Example 3). Detection tools are indicative, produce errors, are defeated by post-processing and are outpaced by new generators, so a detector's verdict is evidence, not proof. The reliable approach pairs media-forensic analysis, read with an understanding that compression itself creates artefacts, with provenance: where the file came from, its capture device and its corroboration (§5). Together those answer the question far more safely than any single tool.

Question 2

How do you prove a video or recording is fake?

Accepted Answer

By combining forensic tells with absent provenance (Example 1, §5). Media analysis may indicate synthesis or manipulation, and provenance asks whether the recording has a capture device, a native original and a corroborating web of contemporaneous copies and independent event evidence. A fabrication typically has the tells and lacks the provenance, existing only where the producing party supplied it (§8). That combination, not either element alone, exposes the fake.

Question 3

The other side says our genuine recording is a deepfake. What do we do?

Accepted Answer

Authenticate it positively, do not merely deny the denial (§6, Example 2). Trace it to the device that captured it, recover the native original with its metadata and capture time and place, identify the people who held copies at the time, and corroborate the event with independent evidence like CCTV or location. A bare "it's a deepfake" carries no weight against a recording embedded in that web of provenance. The liar's dividend is beaten by proof, not by argument.

Question 4

Does a clean forensic result mean the recording is genuine?

Accepted Answer

Not by itself (§6). Absence of manipulation tells does not prove authenticity, just as the presence of some artefacts does not prove fakery, since ordinary compression and re-sharing also leave marks. A clean result is one input; authenticity is established positively through provenance and corroboration. The honest conclusion combines both and is stated at a level of confidence, rather than treating a clean scan as a certificate of genuineness.

Question 5

Why does it matter whether we have the original file?

Accepted Answer

Because provenance and clean analysis both depend on it (§5, Example 3). Re-sharing through messaging and social platforms re-encodes media, stripping capture metadata and adding compression artefacts that both weaken forensic analysis and can be mistaken for tampering. The native original, from the capturing device, preserves the metadata and the cleanest version of the media, which is why preserving it early, before it is re- shared, is essential.

Question 6

Who has to prove whether it is real or fake?

Accepted Answer

That is a legal question addressed with evidence rather than rhetoric (§6, §7). In practice, a party relying on a recording should be ready to authenticate it, and a party alleging a deepfake should be pressed to substantiate the allegation rather than merely assert it. The forensic role is to supply the evidence, of provenance and of media analysis, that lets the tribunal decide the issue on a proper basis instead of on the unaided possibility that fakery exists. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

Deepfakes And Synthetic Media