Posts Tagged ‘Forensic Video Analysis’

A Video Forensic Expert Looks at the VIEVU Wearable Camera

Friday, April 25th, 2014

Camera-300x300 A Video Forensic Expert Looks at the VIEVU Wearable Camera

Giving the VIEVU LE2 my highest recommendation is easy.

It is, without a doubt, the best wearable personal surveillance camera I have encountered in 25+ years as a video forensics investigator. Developed by police for police, this unit just gets it all right: size, shape, weight, operation, picture quality, sound quality, date & time stamp, capacity, convenient downloading, storage, management, and digital signature security.

Most important of all is getting a video recording of what is said and done at a traffic stop, pedestrian stop, crime scene, or call for assistance. A video that captures the point of view of the officer is invaluable as a record of all an officer’s activities. It protects officers as well as citizens, holds all parties accountable, and can be introduced as an evidentiary recording in a court of law. Put simply, having some kind of recording is always better than having no recording at all. And clearly, I would choose the VIEVU over a fixed vehicle cam or handheld camcorder every time. Unobtrusive, reliable, and easy to operate, I look forward to the time when every police officer in the country wears a VIEVU whenever on duty.

Testifying as an expert witness, I’m most often challenged by the opposition attorneys in two areas: authenticity/chain of custody, and findings. Years of experience help me stay confident about my analysis of and findings from the evidentiary video recording. Issues arising from authenticity and chain of custody can be more challenging. Frequently, I am not the person who retrieves the recording. That means that I must rely upon the record keeping of others to establish an unbroken chain of custody, a paper/digital trail that accounts for every individual who had the recording in his or her possession up until I receive it and thereafter. Any break in the chain, and the evidence can be challenged. VIEVU solves this problem with its VERIPATROL VidLock Security Suite. The software utilizes a FIPS 140-2 (Federal Information Processing Standard) compliant Digital Signature, which guarantees the recording’s authenticity and integrity. This cryptographic standard ensures the authorship of the recording and that it has not been tampered with or edited in any way.

The LE2 records at 640 x 480, standard definition, but with an important difference. Under forensic examination, most standard definition video is actually 640 x 240, because each frame of video is made up of two fields. With standard, interlaced scanning, the odd vertical lines are recorded before the even lines, which produces a visible lag when viewing the full frame. The LE2 employs progressive scanning, where all 480 lines are recorded simultaneously, producing superior vertical resolution. 30 ips (Images Per Second) is always preferable to 30 fps (Frames Per Second). This makes my job easier when performing forensic video analysis. Digital footage captured at 640 x 480p strikes a good balance between file size and resolution. Since most conversations occur at a distance of six feet or less, officers wearing a VIEVU record an ideal, detailed field of view, thanks to the unit’s well chosen, 71°, wide-angle lens.

From a personal perspective, I use the LE2 myself to document evidence retrieval in the field. The camera works perfectly, providing a time stamped video record of the DVR I’m working on and its location. And I’m looking forward to receiving the company’s newest upgrade, the Hi-Def LE3.

For more info on VIEVU and their products, check out CEO Ed Primeau’s interview with VIEVU CEO Steve Ward here!

Video Evidence Recovery for Video Enhancement

Monday, April 14th, 2014

1153871_61229211-1-1024x951 Video Evidence Recovery for Video EnhancementThe importance of proper video evidence recovery for video enhancement is very clear to those of us involved in forensic video enhancement. During the process of video evidence recovery, we will make sure the highest quality video recording will be properly saved for use in court. Video forensic experts are trained in video evidence recovery.

As an audio/video forensic expert I have worked on many cases involving digital video recordings. These recordings are admitted into evidence in court. Much of the work we do on these recordings is video enhancement which allows the Trier of Fact to better see the events as they occurred. Some of the time this digital video evidence is recorded on video surveillance systems. Other times it is recorded on smart-phones.  Video surveillance recordings that we forensically enhance are properly removed from both mobile surveillance systems and stationary surveillance systems.

Stationary surveillance systems record digital video at stationary locations like convenience stores, banks and other businesses or institutions. Mobile surveillance systems are being used more and more in buses, trains and other types of public transportation.

Evidence Recovery Importance

There are three main factors we would like to mention regarding the reason for proper evidence recovery. First, when we retrieve recorded video evidence, we create a video recording of our process. This establishes an indisputable chain of custody. It also demonstrates for those who were not present the process and procedure we used. We take special precautions during the retrieval process to make sure we leave with at least one version of the recording. We also leave with the recorded video evidence for future forensic enhancement and authentication as necessary.

We retrieve the recording so as to minimize any degradation of quality created by a less experienced person. When a multi-million dollar lawsuit may depend on the analysis of a surveillance video, it is important NOT to leave evidence retrieval to an untrained security guard.

We research the operator’s manual and connect with tech support from the surveillance company before we travel to the location of the surveillance equipment and perform the evidence recovery. While we are on site we can also examine the administrative log and determine additional forensic information for the chain of custody.

Best Practices

An excellent manual for retrieval of electronic evidence developed jointly by the federal government’s inter-agency Technical Support Working Group, the FBI Forensic Audio, Video, and Image Analysis Unit, and law enforcement agencies from around the world. Entitled Best Practices for the Retrieval of Video Evidence from Digital CCTV Systems, it contains an authoritative (if somewhat dated) overview of the topic, and covers many of the protocols we have adopted at Primeau Forensics.

Before digital audio and video recorders, retrieving a tape-based analogue recording was fairly straightforward. Recordings were made to tape cassettes, which were stored in climate-controlled conditions. Evidence retrieval was as simple as picking up the original cassette recording. Digital video recorders (DVRs), however, do not record to easily portable cassettes. Rather, they record to the kind of hard disk drives found in computers. These internal hard drives are not portable, making evidence retrieval more difficult. Whether we take the DVR or its internal drive with me or make a lossless copy of its contents, I always follow anti-static procedures and carry all media in specially shielded cases.

Proprietary V.S. Open Source Video

All surveillance and standard digital video is recorded using a specific compression/decompression scheme or codec. The compressed file is stored within a wrapper, a file structure, which determines its format. It is not uncommon for surveillance DVRs to use proprietary formats, allowing playback only through the original recording DVR. Some DVRs can re-compress the original proprietary format file, trans-coding it into a non-proprietary format for easy playback. However, these more accessible files often contain lower quality video and audio. When we retrieve these digital video files, we study the DVR’s operating manual to find the best way to make a high quality copy that retains all data and metadata. By minimizing or eliminating the degradation that can accompany translating the file from one format to another, we ensure that our lab analysis is based on the best video recording available.

A DVD is NOT an Original Video

Monday, November 25th, 2013

1418171_59762260-300x199 A DVD is NOT an Original VideoMore often than not, a DVD is not an original video.

Many law enforcement organizations create DVD copies for defendants because they are much easier to play than native digital video formats. This can be confusing so allow me to further explain. Over the last 30 years as a practicing audio/video forensic expert, I have experienced many digital file formats, as well as analogue tape formats, used in litigation. Usually, they are able to successfully serve a purpose by showing the facts as they occurred. These videos help bring the scene of the crime into the court room so the Trier of Fact and the jury can make decisions more accurately. People alter video and eliminate sections they do not want the court to see. This is why as a video forensic expert, I am asked to examine and authenticate video evidence when one of the parties in the litigation disagrees with the contents of the video.  When the video evidence is presented on a DVD as a VOB ‘burn,’ it is nearly impossible for me to authenticate because the meta data has been stripped. When digital video is created, the meta data in the digital video file has information about the equipment that made the digital video file, the date and time the digital video was recorded and most importantly, a footprint of any video editing software that was used before that video was admitted into evidence. All of this meta data information is stripped from the digital video recording if the video has been burned to a DVD. Part of my job is to investigate the history of the video in evidence and help attorneys and prosecutors obtain originals or better understand the video evidence before any due process begins. One of the biggest problems I find is that most of the video entered into evidence is on a DVD and is not original. When either of the litigators question the contents of a video, they ask for my help to determine if any editing or alteration has occurred. I always encourage prosecutors and lawyers to maintain the original video evidence in the recorder that created it because that way, a full forensic investigation is easily executed. Once that original video is deleted, it becomes much more difficult to investigate forensically. In some cases, a properly made copy of the original evidence will include the important meta data necessary for the authentication process. Leaving the digital video file in its native format is much better than converting the video format to a DVD VOB file through the burning process.

Video as Evidence – The Importance of Video Authentication

Thursday, September 26th, 2013

video-authentication-1024x768 Video as Evidence - The Importance of Video AuthenticationSo why is video authentication important? As a video forensic expert, I often find that videos submitted into litigation are not an original as the person admitting has stated. Instead, they are copies that have been altered to only contain the events they want the Trier of fact to see. From a forensic perspective, this is not fair because the original video will contain all the events as they actually occurred. Some of the events that were omitted have relevance to the criminal or civil litigation.

Last week, I testified in court in a video authentication case. The report that I wrote for the case was admitted into evidence. My report revealed that a video had been altered and was not an original.

I testified that my report revealed the scientific findings and my conclusion that the video recording was altered and not an original. Both conclusions were scientific and if I conducted the same test 1000 times over, I would arrive with the same conclusions. If any other forensic expert were to conduct the testing that I had documented in my work product and report, they would arrive at the same conclusion as well.

Lately, I authenticate all forms of video. Store CCTV, cell phone video and tablet video. We live in a video world! Anywhere you go out in public you are more than likely being video recorded. If you are riding a city bus, you are more than likely being video recorded. Some civilians have installed mobile CCTV systems in their cars just in case they need to defend themselves or catch a crime in progress.

The police originally installed cruiser video recording systems to first protect themselves and to also protect the citizens from prejudice. Cruiser video holds the police accountable by recording probable cause for traffic stops.

Forensic experts have many tools to determine scientifically if a video is first, original and second, if a video has been altered. It is especially difficult with digital video to determine how a video was edited if it does not purport to contain the information or events either litigator states that it should contain. This is where forensic investigation becomes the only way to determine the video evidence authenticity.

If you believe a video has been edited, here are a couple things you can do personally to determine if your video may have been edited.

  1. First determine the file format on your DVD or CD Disc. Insert the disc into your computer, left click on the drive (more than likely it’s your ‘D’’ drive) and select open. Is the file format VOB or MP4, AVI, MOV? This format is actually the video container.
  2. Next, go back to the file folder, left click to open, find the video (it’s the largest file in that folder) and right click on the file. All the way at the drop down menu is the word ‘properties.’ Left click to open and review the MAC information. Modified, accessed and created information will reveal dates. Does the disc/CD created day read a date that the litigator who submitted the video stated the date created to be?
  3. The length of the video can also be a clue for your preliminary video authentication. Are there any phone records to compare to the length of the video? Does your memory of the series of events match the length of the video and video events?

Of course there are many more steps a video forensic expert will take in order to determine if your video is genuine and authentic. Even if there is no audio on your video recording, the audio track can also reveal information about the authenticity of your video recording.

If you have a question about video authentication, give us a call for a no cost telephone consultation 800.647.4281 or email

Video Enhancement Strategies of a Video Forensic Expert

Tuesday, April 23rd, 2013

video-enhancement-1024x681 Video Enhancement Strategies of a Video Forensic ExpertEvery case that requires video enhancement requires the video forensic expert to develop a strategy comprised of a series of steps and forensic software tools. Back when surveillance video was analog video tape, video enhancement was more difficult. The equipment forensic experts used to conduct video enhancement was entirely hardware based. Forensic experts did the best they could with what they had to work with.

Today, technology has progressed, making several scientific community approved software programs available. One of the things that causes difficulty during video enhancement is poor camera placement.

Installation of CCTV cameras must be well thought out in advance in order to aide in the forensic investigation, should a crime be committed. In addition, the sun constantly moves throughout the day and affects the surveillance video camera by over and under exposing the surveillance area.

Outdoor cameras become dirty after a period of time, making video enhancement difficult. Point Tilt Zoom (PTZ) cameras provide much better video surveillance footage because of their ability to move, follow and zoom in on perpetrators more effectively than surface mount cameras. ‘An ounce of prevention is worth a pound of cure.’ Making sure the surveillance system is properly thought out and installed will make video enhancement more successful than trying to fix problems that could have been avoided.

I do not have to convince you of the value of surveillance video; the number of court cases that have video forensic evidence speak for themselves. Surveillance video recordings produce very useful high-quality digital video recordings that aide litigators in the court room see the events as they originally occurred.

Video enhancement is challenged by one thing: the fact that most security video recordings must be viewed on a proprietary player, a software program that has the ability to interpret the specific manufacturer’s secure codec, which maintains the integrity of the video recording, keeps the video secure and reduces the vulnerability of editing. This proprietary player makes it very difficult to alter or edit the surveillance video. Some manufacturers allow the ability to export video files from their surveillance propriety players and others do not. This poses a challenge for the video enhancement expert.

The best bet in any situation that requires video enhancement is to talk to an experienced video forensic expert to learn what is possible and what is not. Video enhancement is mislead by what Hollywood produces and often confuses the public as to what is possible and what is not.

How to tell if a video recording has been edited

Tuesday, April 23rd, 2013

Is my video edited? How to tell if a video recording has been edited?

Is my video edited? How to tell if a video has been edited? In order to authenticate video evidence accurately, a trained video forensic expert must perform the testing to ensure the authentication process is done accurately. The expert performs a series of tests on the meta data as well as visual characteristics of the entire video. Does the video have a definitive beginning and end? Are there jumps in the video that are observed during playback? Does the meta data match the file format and other playback characteristics like frame rate and sample rate??

Preliminary Analysis

We begin all forensic video authentication and analysis investigations with a preliminary analysis.  This scientific analysis is performed in our video forensic laboratory by a video forensic expert. The goal of the prelim analysis is to determine if any signs of tampering, anomalies or other red flags are present. This preliminary analysis allows us to learn some truths about your video recording before proceeding to more costly and detailed forensic testing. We prefer to NOT take our clients money if we aren’t confident that we can assist your investigation and the trier of fact scientifically and purposeful. Our preliminary analysis includes an hour in the lab reviewing all aspects of your video recording looking for reasons to believe the video recording is genuine or lacks integrity.

Chain of Custody

Another important ingredient to consider is the established chain of custody for the video recording in question. Has the creator who presented the video recording as evidence provided a chain of custody document to support the video recording as evidence? A chain of custody is a document that explains details about the recording. Who created it, what equipment was it created on? Who had access to the recording since it was created? What activity did each person who had the video in their possession do with the video? Even is a party only viewed the video recording while they had it in their possession, that activity should be noted in the chain of custody document.

The Importance of an Original Video Recording

Often times we receive video evidence that has been copied,  and makes the analysis process difficult.  The Scientific Working Group on Digital Evidence (SWGDE & IOCE) defines Original Digital Evidence as ,”The physical items and the data objects associated with such items at the time of acquisition or seizure.” In other words,  when the video evidence has been removed from the system that created it, it is susceptible to manipulation and tampering, and is no longer an original. When a copy has been produced as evidence that is not an original it’s important for all persons in the litigation to know that the video is authentic and represents the events as they occurred accurately.

The forensic video analysis process involves several steps that help the court better understand the history of video evidence that is being presented in the litigation.

Authenticate Video Evidence:

  • Establish a Chain of Custody: Determine how the video evidence was created, and who was involved in transporting & obtaining the evidence from the source. The most original video evidence is crucial for maintaining this chain of custody.
  • Video Evidence Recovery: Sometimes it is necessary to recover the video evidence onsite when the original is available.  This process assists the video forensic expert through examining the equipment that created the video recording.
  • Physical Inspection: Examine the video evidence for signs of physical tampering, scratches, or dis-assembly.
  • Intake: Create a bit for bit clone or carbon copy & HASH test analysis
  • Visual Inspection: Carefully watch the video evidence. Use Frame by Frame analysis, Vector Scope Analysis, and Vector Detection Analysis, Slow Motion Analysis. 
  • Digital Inspection: Examining the digital properties of video evidence such as, EXIF or Metadata and Hexadecimal information, is crucial to determine if manipulation is present. 
  • Research the Equipment: It is important to the Video Forensic Expert to familiarize themselves with the equipment that was used to create the video evidence. Every case is a research project! 
  • Create an Exemplar: Re-Create the events as they occurred using the same technology or digital recorder that created the video evidence. Reverse Projection is an example using people. 
  • Observation: Note inconsistencies & anomalies. Create a formal report stating results, and opinions.
  • Courtroom Testimony: Document the video authentication process, providing notes taken, and state all forensic findings about the authenticity of the video evidence.  The forensic report is used as the basis for courtroom testimony by the video forensic expert.

If you have a video that you question or need help understanding, please give me a call for a pro bono conversation. I apply my forensic expertise to cases in the United States and many countries around the globe. Any and all formats of audio and video accepted. Retainer agreement available on request; travel expenses will be quoted in advance excluding meal expenses and flat rate time for travel instead of hourly.

Click HERE to email your questions or

Call 800-647-4281 in the USA or +01-248-853-4091 Internationally.

Ed Primeau’s Curriculum Vitae has several references which include cases he has testified in as well as clients he has worked for in these cases.

Boston Marathon Bombing and the Video Forensic Process

Friday, April 19th, 2013

After the bombs exploded at the Boston Marathon, the FBI immediately went to work investigating all available video evidence to begin the video forensic process.

Several sources of video evidence were available for FBI forensic examiners, including:

The first camera that FBI investigators began working with to clarify images was from the Lord and Taylor retail store directly across the street from one of the explosion sites. FBI video forensic experts were able to locate digital video recordings of a suspect placing a backpack at that location.

Review of the additional municipal CCTV surveillance video revealed 2 suspects walking calmly down the street both carrying backpacks.

One of the questions I have been asked over the last several days during the media interviews is how will authorities set up a video forensic triage.

The term triage is used in this instance as a way to describe the almost incomprehensible task of reviewing surveillance video.

First, the authorities had to establish a chain of command.  This began by assigning a person in charge of leading the video forensic investigation.  It continued by identifying the FBI agents with the most experience and talent with video enhancement.

The result video and pictures were released to the media in about 6 hours. Boston police and FBI agents had several reports of the suspect’s sightings. As America woke this morning, one of the suspects was shot and killed while the other remains at large.

Any situation that receives video forensic investigation requires a strategy for implementing video forensic best practices.  It is very obvious that the American people can rest assured that our law enforcement community is well trained and experienced with crisis situations. Thanks to our FBI it appears the Boston bombing investigation is nearly complete.

Boston Bombing and the Forensic Video Investigation

Wednesday, April 17th, 2013

boston-1024x682 Boston Bombing and the Forensic Video InvestigationIt is very obvious that we are vulnerable to attacks with little or no advance warning as exhibited in the recent bombing in Boston during the marathon. There are so far reported 176 casualties; 17 critical; 3 fatalities. Now the daunting task of forensic video investigation must take place.

Part of the forensic investigation requires video forensic experts to review all city surveillance CCTV recordings to look for persons who may have contributed to this attack. Another forensic strategy is to gather smart phone video recordings and photographs from civilian spectators that were at the event.

The task of reviewing the surveillance digital video recordings is extremely labor intensive. I suspect there are dozens of municipal cameras that recorded events before, during, and after the bombs exploded in the surrounding areas. This activity is extremely important because if a suspect is discovered in the video, video forensic experts have tools available to help scientifically identify the suspect. We can measure height once we establish a scale of measurement for the video as well as clothing logos which also help in identification.

One central location should store all digital video recordings from the municipal CCTV system as well as individual civilian smart phones. The videos should be categorized by either geographic location or some other method of organization that allows easy reference and quick accessibility.

A few years back, the city of New York’s CCTV cameras caught images of a person who planted a bomb in a car in Time Square. That suspect was eventually apprehended and convicted because of the aid of the municipal CCTV video recordings that caught a glimpse of him walking away from the car.

As days progress with the Boston forensic investigation, expect video forensic experts to discover clues that will aid authorities with other forensic information and evidence to eventually apprehend those persons involved in this tragedy.

CCTV Surveillance Camera Placement from a Forensic Perspective

Wednesday, April 17th, 2013

CCTV_SYSTEM-1024x930 CCTV Surveillance Camera Placement from a Forensic PerspectiveIn many of the cases I investigate as a video forensic expert, there could have better outcomes. If more thought was put into CCTV surveillance camera placement locations, more CCTV video would be useful in litigation. Here are a few things to keep in mind when deciding where to place cameras in your business or home.

First, remember that it’s better to install too many cameras than too few. If you are not sure if you have an area adequately covered, then you probably do not. You will save money in the long run by installing plenty of cameras to cover an area rather than trying to salvage CCTV footage that is either poor quality or the crime is not close enough to cameras.

Point tilt zoom (PTZ) cameras are worth the extra investment. Surface mounted cameras work well for areas that are small and pedestrian traffic is close to the camera. However, for larger areas, PTZ cameras will provide much better coverage.

Do not mount CCTV cameras pointing toward light – mount cameras with the light source (daylight or interior lighting) behind the camera. Light in front of the camera will cause the subjects that you want to see to be dark.

Set your frame rate to at least 12 or 15 images per second (also known and frames per second). It is better to have higher quality surveillance footage with more frames per second that is useable when a crime is committed than low quality footage with less frames per second missing part of the crime committed.  The video below will help you better understand this point:

If a crime is ever committed and caught on your CCTV system, do not delete the original video recording from your DVR. Rather, export the portion of your recording that shows the crime in as high a digital video resolution as possible. 720 X 480 is very good. Anything lower will be hard to work with forensically.

If you follow these guidelines and a crime is committed at your business or residence, your forensic investigation and ability to identify perpetrators and criminals will be greater than if you simply install and operate with little or no knowledge. Take my advice and install your CCTV system right. Hopefully you will never need the recordings but if you do you will be glad you installed it right.

Virtual Chain of Custody for Video Forensics

Thursday, April 4th, 2013

chain-of-custody-1024x768 Virtual Chain of Custody for Video ForensicsTraditionally, a chain of custody is established between all parties when handling video forensic evidence. Most of the time, the chain of custody process is easily established and agreed on when bringing in a forensic expert to authenticate or clarify and enhance the video evidence. This is a blog post about a new technology that is helping make this process easier and more convenient for all parties involved.

In an effort to provide good service while respecting the expectations of my clients, I have been using Cloud storage methods for sharing video evidence and work product.

Now that high speed Internet has hit critical mass it is easy and safe to share video forensic evidence over the Internet without violating the evidence integrity.

One network I have been using very successfully is to upload clarified video evidence to Vimeo using a password protected video post. Only the persons privy to the password can view the video. Of course, this practice is not acceptable in cases that involve children or pornography.

The link to the video post is then emailed to the client. The password is provided to the client in a separate email.

Once the forensic video process is complete the video evidence is then burned onto a CD or DVD Rom and returned to the client for the litigation proceeding.

Other virtual methods for safely transferring video evidence are Dropbox and YouSendIt.  As technology evolves, so does the forensic expert. Litigators are pleased with the convenience and forensic investigators are utilizing technological advancements to help speed up the forensic approval process.

Video Forensic Expert Edward J Primeau Curriculum Vitae


sidebar map
sidebar video
forensic associations