Research Methodology

Open Source Tools and Methods for Open Source Investigations - Digital Evidence Workflow

Research Methodology - Syrian Archive

This page provides an overview of the Digital Evidence Workflow methodology used by the Syrian Archive in carrying out its work. The methodology section contains the following elements:

A) Identification, collection and secure preservation B) Initial verification C) In-depth verification

A. Identification, collection and secure preservation

The Syrian Archive identification, collection, and secure preservation methodology comprises of the following five steps:

  1. Establish database of credible sources for content
  2. Establish database of credible sources for verification
  3. Establish standardised metadata schema
  4. Record additional metadata
  5. Collect, store, hash, and timestamp visual evidence from verified sources

These five steps are presented and outlined in greater detail in the visualisation below


Step 1 : Establish database of credible sources for content

The Syrian Archive has identified more than one thousand sources through following credible and verified social media accounts and channels of individual citizen journalists and larger media houses, such as. YouTube, Facebook and Telegram. Many of those providing video documentation began to do so in late 2011 or early 2012 and have published their work in other credible media outlets as well. It is important to note that many if not all of these sources are partisan, and thus require caution with regards to their claims.

Trusted sources report from different cities in Syria in order to spread news and information about alleged violations occurring in their areas. The Syrian Archive works with field reporters like Yasser Al-Haj, a journalist from Aleppo who began his career in 2012 and continues working until today.

The Syrian Archive also works with local and international news agencies, human rights organisations, as well as the Syrian Civil Defense (more colloquially known as the White Helmets) team, local field clinics and hospitals. Additionally, some video evidence analysed was sent to the Syrian Archive directly by reporters and was not previously been posted on social media platforms.

Step 2 : Establish database of credible sources for verification

The Syrian Archive has established a trusted team of citizen journalists and human rights defenders based in Syria who provide additional information used for verification of content originating on social media platforms or sent from sources directly.

Step 3 : Establish standardised metadata scheme

The Syrian Archive organises the preserved materials by cataloging them according to the categories used by the Independent International Commission of Inquiry on the Syrian Arab Republic, set up by the UN OHCHR in 2011. These categories include:

  • Massacres and other unlawful killing
  • Arbitrary arrest and unlawful detention
  • Hostage-taking
  • Enforced disappearance
  • Torture and ill-treatment of detainees
  • Sexual and gender-based violence
  • Violations of children's rights
  • Unlawful attacks
  • Violations against specifically protected persons and objects
  • Use of illegal weapons
  • Sieges and violations of economic, social and cultural rights
  • Arbitrary and forcible displacement

Additional value is added to the material by recording as much metadata and chain of custody information as possible. The recording of location, date and origin of video evidence are done in order to contextualise the material and help users identify and understand when, where and what happened in a specific incident. The full metadata schema can be seen in this section.

Step 4 : Collect, store, hash and timestamp video evidence from verified sources

To ensure that the original content is not lost due to removal on corporate platforms, visual evidence from credible social media channels is scraped and stored securely on external backend servers before it goes through basic verification. Videos are hashed with (SHA-256) and timestamped to ensure they are not tampered with after scraped from social media platforms or taken directly from sources.

B. Initial verification

Similar to the archival and collection methodology, the initial verification methodology comprises of the following five steps:

  1. Aggregate metadata from visual evidence
  2. Verify the source of the video
  3. Verify the location of the video
  4. Verify the dates in which the video was filmed and uploaded, and
  5. Publish verified video evidence on the Syrian Archive's online database.

These five steps will be discussed in further detail.

Step 1 : Aggregate metadata from visual evidence

Metadata from visual evidence sent directly or scraped from social media websites is parsed and aggregated using a predefined and standardised metadata scheme, as described above. This prepares the visual evidence for initial verification. Some of the metadata includes: Upload date and time, uploader's name, title and description of the video, location and device used to upload the video.

Step 2 : Verify the source of the video

To verify the source of the video, it needs to be established that the source of the video on the Syrian Archive's verified list of credible sources. If the source is not an existing trusted source, determine the new source's credibility by evaluating:

  • Whether the source is familiar to the Syrian Archive or to its existing professional network of Syrian journalists and media activists;
  • Whether the source's content and reportage been reliable in the past. This is determined by evaluating how long the source has been reporting and how active they are;
  • Where the source is based. This is determined by evaluating whether videos uploaded are consistent and mostly from a specific location where the source is based;
  • Whether the video account uses a logo and whether this logo is consistently used across videos;
  • Whether the uploader aggregates videos from other news organisations and YouTube accounts, or whether they upload mostly user-generated content.

Step 3 : Verify the location of the video

Each video has gone through basic geolocation to verify that it has been captured in Syria. More in-depth geolocation was conducted in order to verify that videos from this dataset were captured in Aleppo. This has been done by comparing reference points (e.g. buildings, mountains ranges, trees, minarets) with satellite imagery from Google Earth, Microsoft Bing, and DigitalGlobe, as well as OpenStreetMap imagery and geolocated photographs from Panoramio. In addition to this, the Syrian Archive has referenced the Arabic spoken in videos against known regional accents and dialects within Syria to further verify location of videos. When possible, the Syrian Archive has contacted the source directly in order to confirm the location, and cross-referenced video evidence by consulting existing networks of journalists operating inside and outside Syria to confirm the locations of specific incidents.

Step 4 : Verify the dates in which the video was filmed and uploaded

The Syrian Archive has verified the date of capturing the video by cross referencing the publishing date on social media platforms (e.g. YouTube and Facebook) with dates from reports concerning the same incident. Sources for reports used for cross-referencing include:

  • News reports from international and local media outlets, including Reuters, Smart News Agency, Aleppo Media Center, Qasioun News Agency, LCC;
  • Human rights reports published by international and local organisations, including Human Rights Watch, Amnesty International, Syrian Human Rights Network, Violations Documentation Center in Syria, Syrian American Medical Society, and Physicians for Human Rights;
  • Reports shared by the Syrian Archive's network of citizen reporters on Twitter, Facebook and Telegram about the incidents.

Step 5 : Published verified video evidence to Syrian Archive database

After videos have gone through the basic verification process, they are backed up and uploaded to the Syrian Archive website where they are made publicly available in a free and open-source format.

C. In-depth verification

In some cases, the Syrian Archive is able to conduct in-depth online open source investigations. Videos and other open source materials shared online are used in order to understand the incident and verify the veracity of claims made about incidents. Time and capacity limitations means not all incidents are able to be analysed in-depth, however by developing a replicable workflow it is hoped that others can assist in these efforts to investigate other incidents using similar methods.