Glossary Forensics

Keyframe

A keyframe, or I-frame, is a video frame stored as a complete picture, while the frames between keyframes store only the changes.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

Modern codecs save space by storing most frames as changes relative to earlier (and sometimes later) frames. A keyframe, also called an I-frame, is stored whole, so a decoder can start there without any other frame. Keyframes recur at a steady interval (the group of pictures, or GOP), so an irregular pattern can show a video was edited and re-encoded. Because only keyframes decode on their own, forensic tools sample them to extract stills quickly.

Why it matters

Keyframe spacing decides how a video behaves. Seeking jumps to the nearest earlier keyframe and then decodes forward, so long gaps make scrubbing slow, while frequent keyframes cost file size. Streaming services cut segments at keyframes. For an examiner, a keyframe at an unexpected place, or a GOP length that suddenly changes mid-file, suggests a splice or a re-encode, because a normal single encode keeps its rhythm. Absence of a clean break proves nothing: a careful editor re-encodes everything with one setting.

Example

Encoding a 30 frames-per-second clip with a keyframe every 60 frames (ffmpeg ... -c:v libx264 -g 60) gives one I-frame every 2 seconds, and a listing of only the keyframes shows them at 0, 2, 4, 6 and 8 seconds for a 10-second clip:

ffprobe -select_streams v -skip_frame nokey -show_entries frame=pts_time,pict_type -of csv=p=0 clip.mp4

The frames in between are P-frames (and, in many files, B-frames) that depend on those keyframes. Examine a file's frame structure with the Video Forensics.

Common confusion

The keyframe interval is not the Frame rate: the frame rate says how many pictures play per second, the interval says how many of them are complete. Which compression is used is set by the Codec.

AdSense Placeholder
Slot: footer_leaderboard