Mobile Surveillance Video Evidence Recovery – Hard Drive Cloning

hard drive cloningMobile Video Evidence Recovery: Simple as Cloning the DVR’s Hard Drive?

With the rapid proliferation of surveillance cameras in public and private spaces, law enforcement agencies are increasingly making use of these recordings as evidentiary video at trial. Moreover, mobile digital video recorders and other portable video recording technologies are making it much more practical to capture surveillance/crime scene video that may latter be used as evidence in court. Playback of these video recordings is straightforward, providing the video is played back using the original equipment on which it was recorded.

This caveat, unbeknownst to many attorneys and police officers,stems from a simple fact.Most fixed and mobile DVR-based surveillance systems employ proprietary computer operating systems and record digital video to proprietary formats. Under these circumstances, causing minimal degradation of picture quality during the process of recovering and trans coding video files is a complex challenge for both law enforcement agencies and video forensic experts. There are a wide variety of surveillance system manufacturers and a larger number of different models of DVRs, which makes on-site retrieval of video recordings a difficult process, often necessitating access to the technical manual of the DVR on which the recording is stored.

The investigators at Primeau Forensics have worked on countless evidence recovery assignments where simple cloning of the DVR’s hard drive would have been the worst retrieval strategy of all. First, the cloned drive may not mount on our computers, which run Windows and Apple operating systems. Second, proprietary files are often invisible files outside their native OS. They cannot be detected or read by any operating system but the embedded OS running on the dedicated device. Third, video files may be encoded using a non-standard codec and/or formatted within a non-standard wrapper.

For example, NVR format video files, frequently used in surveillance systems, come in a multitude of types, each with its own structural and descriptive metadata. Associated files present, such as the control files and system files that enable playback on the original DVR, will often impede playback on general-purpose computers. File Investigator Engine and File Expander Engine from Dark Data Discovery allow forensic investigators to identify and open over 4,300 different types of files, yet simply cloning the DVR’s hard drive remains a strategy fraught with complications.

Successful retrieval of DVR recordings always requires preparation and research beforehand. We always browse the Internet, contact the manufacturer, and read the manuals over and over to determine the best way to preserve this fragile digital evidence in its most pristine quality. As trial verdicts may turn on the outcome of our analysis of evidentiary video, we want to personally recover the video to establish a clear chain of custody, prevent accidental loss of files, and preserve the video quality through recovery and trans coding to an open format.

We recommend the following 4-step process for retrieval of video from DVRs:

1)      As previously mentioned, research the design, inputs/outputs and operation of the DVR you are examining. Obtain the special software, codecs, and technical manuals necessary to examine the unit properly.

2)      Photograph the digital video recorder before you begin the inspection. Take note of any markings or signs of tampering.

3)      Connect the DVR or mobile digital video recorder to the power source that will power the unit best. Sometimes, mobile digital video recorders require an AC/DC cable system to power the unit in an office environment. The vehicle or locale in which it was originally installed may have had custom power connections, not available if the unit is pulled for examination.

4)      Connect the data transfer cable supplied with the unit to your Windows laptop for examination. In some cases, this will be a standard USB or FireWire cable. Mobile video recorders, in particular, frequently require a proprietary cable. Having installed the DVR emulation software provided by the manufacturer and the proprietary encoder/decoder, you are ready to follow the instructions in the manual to retrieve the highest quality video possible.

If you need professional assistance recovering video evidence from a digital video recorder, please call us today! Call 800-647-4281 for a free consultation.

 

Tags: , ,

Leave a Reply

Video Forensic Expert Edward J Primeau Curriculum Vitae

download-cv