ARCHIVE

Posts Tagged ‘Video Evidence Recovery’

Video Evidence Recovery for Video Enhancement

Monday, April 14th, 2014

1153871_61229211-1-1024x951 Video Evidence Recovery for Video EnhancementThe importance of proper video evidence recovery for video enhancement is very clear to those of us involved in forensic video enhancement. During the process of video evidence recovery, we will make sure the highest quality video recording will be properly saved for use in court. Video forensic experts are trained in video evidence recovery.

As an audio/video forensic expert I have worked on many cases involving digital video recordings. These recordings are admitted into evidence in court. Much of the work we do on these recordings is video enhancement which allows the Trier of Fact to better see the events as they occurred. Some of the time this digital video evidence is recorded on video surveillance systems. Other times it is recorded on smart-phones.  Video surveillance recordings that we forensically enhance are properly removed from both mobile surveillance systems and stationary surveillance systems.

Stationary surveillance systems record digital video at stationary locations like convenience stores, banks and other businesses or institutions. Mobile surveillance systems are being used more and more in buses, trains and other types of public transportation.

Evidence Recovery Importance

There are three main factors we would like to mention regarding the reason for proper evidence recovery. First, when we retrieve recorded video evidence, we create a video recording of our process. This establishes an indisputable chain of custody. It also demonstrates for those who were not present the process and procedure we used. We take special precautions during the retrieval process to make sure we leave with at least one version of the recording. We also leave with the recorded video evidence for future forensic enhancement and authentication as necessary.

We retrieve the recording so as to minimize any degradation of quality created by a less experienced person. When a multi-million dollar lawsuit may depend on the analysis of a surveillance video, it is important NOT to leave evidence retrieval to an untrained security guard.

We research the operator’s manual and connect with tech support from the surveillance company before we travel to the location of the surveillance equipment and perform the evidence recovery. While we are on site we can also examine the administrative log and determine additional forensic information for the chain of custody.

Best Practices

An excellent manual for retrieval of electronic evidence developed jointly by the federal government’s inter-agency Technical Support Working Group, the FBI Forensic Audio, Video, and Image Analysis Unit, and law enforcement agencies from around the world. Entitled Best Practices for the Retrieval of Video Evidence from Digital CCTV Systems, it contains an authoritative (if somewhat dated) overview of the topic, and covers many of the protocols we have adopted at Primeau Forensics.

Before digital audio and video recorders, retrieving a tape-based analogue recording was fairly straightforward. Recordings were made to tape cassettes, which were stored in climate-controlled conditions. Evidence retrieval was as simple as picking up the original cassette recording. Digital video recorders (DVRs), however, do not record to easily portable cassettes. Rather, they record to the kind of hard disk drives found in computers. These internal hard drives are not portable, making evidence retrieval more difficult. Whether we take the DVR or its internal drive with me or make a lossless copy of its contents, I always follow anti-static procedures and carry all media in specially shielded cases.

Proprietary V.S. Open Source Video

All surveillance and standard digital video is recorded using a specific compression/decompression scheme or codec. The compressed file is stored within a wrapper, a file structure, which determines its format. It is not uncommon for surveillance DVRs to use proprietary formats, allowing playback only through the original recording DVR. Some DVRs can re-compress the original proprietary format file, trans-coding it into a non-proprietary format for easy playback. However, these more accessible files often contain lower quality video and audio. When we retrieve these digital video files, we study the DVR’s operating manual to find the best way to make a high quality copy that retains all data and metadata. By minimizing or eliminating the degradation that can accompany translating the file from one format to another, we ensure that our lab analysis is based on the best video recording available.

Mobile Surveillance Video Evidence Recovery – Hard Drive Cloning

Wednesday, March 26th, 2014

Video evidence recovery is the scientific process of removing a video recording from a smart phone and preparing it for court. opened-hard-disk-drive-liying-on-other-hard-drive_zJrBFjCd-234x300 Mobile Surveillance Video Evidence Recovery - Hard Drive Cloning

With the rapid proliferation of surveillance cameras in public and private spaces, law enforcement agencies are increasingly making use of these recordings as evidence video at trial. Moreover, mobile digital video recorders and other portable video recording technologies are making it much more practical to capture surveillance/crime scene video that may latter be used as evidence in court. Playback of these video recordings is straightforward, providing the video is played back using the original equipment on which it was recorded.

This caveat, unbeknownst to many attorneys and police officers,stems from a simple fact.Most fixed and mobile DVR-based surveillance systems employ proprietary computer operating systems and record digital video to proprietary formats. Under these circumstances, causing minimal degradation of picture quality during the process of recovering and trans coding video files is a complex challenge for both law enforcement agencies and video forensic experts. There are a wide variety of surveillance system manufacturers and a larger number of different models of DVRs, which makes on-site retrieval of video recordings a difficult process, often necessitating access to the technical manual of the DVR on which the recording is stored.

The investigators at Primeau Forensics have worked on countless evidence recovery assignments where simple cloning of the DVR’s hard drive would have been the worst retrieval strategy of all. First, the cloned drive may not mount on our computers, which run Windows and Apple operating systems. Second, proprietary files are often invisible files outside their native OS. They cannot be detected or read by any operating system but the embedded OS running on the dedicated device. Third, video files may be encoded using a non-standard codec and/or formatted within a non-standard wrapper.

For example, NVR format video files, frequently used in surveillance systems, come in a multitude of types, each with its own structural and descriptive metadata. Associated files present, such as the control files and system files that enable playback on the original DVR, will often impede playback on general-purpose computers. File Investigator Engine and File Expander Engine from Dark Data Discovery allow forensic investigators to identify and open over 4,300 different types of files, yet simply cloning the DVR’s hard drive remains a strategy fraught with complications.

Successful retrieval of DVR recordings always requires preparation and research beforehand. We always browse the Internet, contact the manufacturer, and read the manuals over and over to determine the best way to preserve this fragile digital evidence in its most pristine quality. As trial verdicts may turn on the outcome of our analysis of evidentiary video, we want to personally recover the video to establish a clear chain of custody, prevent accidental loss of files, and preserve the video quality through recovery and trans coding to an open format.

We recommend the following 4-step process for retrieval of video from DVRs:

1)      As previously mentioned, research the design, inputs/outputs and operation of the DVR you are examining. Obtain the special software, codecs, and technical manuals necessary to examine the unit properly.

2)      Photograph the digital video recorder before you begin the inspection. Take note of any markings or signs of tampering.

3)      Connect the DVR or mobile digital video recorder to the power source that will power the unit best. Sometimes, mobile digital video recorders require an AC/DC cable system to power the unit in an office environment. The vehicle or locale in which it was originally installed may have had custom power connections, not available if the unit is pulled for examination.

4)      Connect the data transfer cable supplied with the unit to your Windows laptop for examination. In some cases, this will be a standard USB or FireWire cable. Mobile video recorders, in particular, frequently require a proprietary cable. Having installed the DVR emulation software provided by the manufacturer and the proprietary encoder/decoder, you are ready to follow the instructions in the manual to retrieve the highest quality video possible.

If you need professional assistance recovering video evidence from a digital video recorder, please call us today! Call 800-647-4281 for a free consultation.

 

Video Forensic Expert Edward J Primeau Curriculum Vitae

download-cv


sidebar map
sidebar video
forensic associations