Category Archives: Video Evidence Retrieval

The importance of proper video evidence recovery is clear to those of us involved in forensic video enhancement. During the process of video evidence recovery, we make sure the highest quality video recording is properly saved for court use. Video forensic experts receive extensive training in video evidence recovery.

As a forensic expert, I have worked on many cases involving digital video recordings admitted into evidence in court. Much of our work with these recordings involves video enhancement, which allows the trier of fact to better see events as they occurred. Often times, video surveillance systems or smartphones record the digital evidence in question. We properly remove recordings from both mobile and stationary surveillance systems for forensic enhancement.

Stationary surveillance systems record video at locations such as convenience stores, banks, and other businesses or institutions. Buses, trains and other types of public transportation utilize mobile surveillance systems.

Evidence Recovery Importance

There are three main factors we would like to mention regarding the reason for proper evidence recovery. First, when we retrieve recorded video evidence, we create a video recording of our process. This establishes an indisputable chain of custody. It also demonstrates for those who were not present the process and procedure we used. We take special precautions during the retrieval process to make sure we leave with at least one version of the recording. Additionally, we leave with the recorded video evidence for future forensic enhancement and authentication as necessary.

We retrieve the recording so as to minimize any degradation of quality. When a lawsuit depends on the analysis of a surveillance video, it is important not to leave evidence retrieval to an untrained security guard.

We research the operator’s manual and connect with tech support from the surveillance company before traveling to perform evidence recovery. While on site, we also examine the administrative log and determine additional forensic information for the chain of custody.

Video Evidence Recovery Best Practices

An excellent manual for retrieval of electronic evidence developed jointly by the federal government’s inter-agency Technical Support Working Group, the FBI Forensic Audio, Video, and Image Analysis Unit, and law enforcement agencies from around the world. Entitled Best Practices for the Retrieval of Video Evidence from Digital CCTV Systems, it contains an authoritative (if somewhat dated) overview of the topic and covers many of the protocols we have adopted at Primeau Forensics.

Before digital audio and video recorders, retrieving a tape-based analogue recording was fairly straightforward. Recordings were made to tape cassettes, which were stored in climate-controlled conditions. Evidence retrieval was as simple as picking up the original cassette recording. Digital video recorders (DVRs), however, do not record to easily portable cassettes. Rather, they record to the kind of hard disk drives found in computers. These internal hard drives are not portable, making evidence retrieval more difficult. Whether we take the DVR or its internal drive with me or make a lossless copy of its contents, I always follow anti-static procedures and carry all media in specially shielded cases.

Proprietary vs Open Source Video

All surveillance and standard digital video uses a specific compression/decompression scheme or codec to record. The compressed file’s storage structure determines its format. It is not uncommon for surveillance DVRs to use proprietary formats, allowing playback only through the original recording DVR. Some DVRs can re-compress the original proprietary format file, trans-coding it into a non-proprietary format for easy playback. However, these more accessible files often contain lower quality video and audio. When we retrieve these digital video files, we study the DVR’s operating manual to find the best way to make a high quality copy that retains all data and metadata. By minimizing or eliminating the degradation that can accompany translating the file from one format to another, we ensure that our lab analysis is based on the best video recording available.