One of the day to day activities of a video forensic expert is to determine if a digital video recording is an exact representation of the facts as they occurred at the time of the recording. In order to do this, the video expert must know how the digital video recording was created. There is a series of best practices for digital video evidence that is followed in the forensic lab.
For example, was the video recorded on a closed-circuit television system? Who was responsible for exporting the copy that has been provided for examination? This is a particularly important question because the integrity of that copy is proportionate to the experience of the person who removed it from that closed-circuit television system.
If the video evidence is on a portable media device, such as a CD-ROM disc, a DVD-ROM disc or an external hard drive or thumb drive, then we know beyond a reasonable degree of certainty that that digital video was removed from the original security surveillance system or digital video recorder (DVR). It’s not a problem working from a copy as long as both sides in the litigation understand and agree to the authenticity of that copy. However, whenever there is a doubt as to the authenticity of that digital video on that external media, then the original digital video recording must be examined in its native environment, which is the original digital video recorder that is part of the closed-circuit television system.
When an export copy video from a closed-circuit television system is used in courts without debate, both sides in the litigation agreed that this export copy is an actual representation of the facts as they occurred. Because of this, there was no dispute as to whether or not it was an original because it didn’t matter. The digital format, when cloning, is technically all considered originals because of the digital formatting. In other words, it’s all Xs and Os and metadata that has been transferred from a digital video recorder or computer hard drive. Just like when making copies of a compact disc for a friend, the copy, if done properly, sounds just as good as the original. But I digress. When there’s a dispute over the contents of an exported digital video recording and the original has to be sought to approve and display the facts as they occurred, the video forensic expert’s job is now to go back to the source that created the digital video recording and obtain a copy of it through supervised procedures of exporting. That way the forensic expert and both parties in the litigation have no dispute as to whether or not that digital video recording is authentic and true.
Oftentimes the original video recording is no longer available because of the time that it takes for cases to rotate in court. As a forensic video expert, I often receive evidence copies for authentication, examination, clarification, and restoration up to a year and even two years after they were recorded. When there’s a doubt to the integrity of this video evidence and the original is no longer available because of the first in-first out operation of closed-circuit television systems, then it’s the forensic video expert’s job to find clues within that digital video recording to help process the litigation.
When working in a Windows-based PC forensic laboratory, I have discovered that some of the closed-circuit television exports do not play properly, if at all, on the Windows 7 operating system. This is why we have older versions of Windows operating systems in our laboratory. It’s a best practice of a forensic expert to be prepared for any situation in order to conduct a proper video forensic investigation.
Occasionally the forensic video expert must use screen capture technology in order to retain a portion of the closed-circuit television recording for clarification purposes. Recording a portion of the closed-circuit television video using screen capture technology allows me to create a file format that is suitable for forensic investigation. Closed-circuit television systems record video using a proprietary format that is native to the original operating system of the digital video recorder. This is why the footage is considered secure, and authentic because it was recorded in an armored car environment. This security often interferes with a video forensic investigation because, depending on the source of the copy that has been given to the forensic examiner, the proper CODECS may not be available to the forensic expert in order to view that surveillance footage. Therefore, one of the first activities that a forensic expert does in that situation is to try to find the CODECS proprietary to that surveillance system in order to get one of the Windows operating systems to play that video footage for examination. Once the video forensic expert plays and views the original footage using the proper CODEC, a screen capture software program is used to create a new file of that surveillance video. Once that new video footage has been created, the digital video is then imported into a forensic video software program for investigation, authentication, clarification, restoration, or any other activity necessary to help process the litigation. Of course, the forensic video expert records their process, which is accepted in the scientific community and aids the forensic video expert in compiling a report at the conclusion of their investigation.
All of these activities are the best practices of a forensic video expert. With technology changing faster than ever, it is the forensic video expert’s job to be able to know where to go to find answers to difficult situations caused by a lack of understanding of the originator of the video evidence. Sometimes security personnel who export the original video evidence from the closed-circuit television system are not aware of the fact that in order to view that digital footage, the player or the software must be embedded on the media where the file is being transferred to. Instead, security personnel sometimes just export one of the digital video files from the closed-circuit television system without realizing a specific CODEC is necessary for future viewing of that footage.
As a scientific community, we are always learning additional best practices for examining digital media evidence. I welcome any feedback or communication from anyone who reads this post and has a comment about any of their best practices experiences or anything that has been written in this blog post.