Posts Tagged ‘Video Evidence Recovery’

Video Evidence Recovery for Video Enhancement

Monday, April 14th, 2014

1153871_61229211-1-1024x951 Video Evidence Recovery for Video EnhancementThe importance of proper video evidence recovery for video enhancement is very clear to those of us involved in forensic video enhancement. During the process of video evidence recovery, we will make sure the highest quality video recording will be properly saved for use in court. Video forensic experts are trained in video evidence recovery.

As an audio/video forensic expert I have worked on many cases involving digital video recordings. These recordings are admitted into evidence in court. Much of the work we do on these recordings is video enhancement which allows the Trier of Fact to better see the events as they occurred. Some of the time this digital video evidence is recorded on video surveillance systems. Other times it is recorded on smart-phones.  Video surveillance recordings that we forensically enhance are properly removed from both mobile surveillance systems and stationary surveillance systems.

Stationary surveillance systems record digital video at stationary locations like convenience stores, banks and other businesses or institutions. Mobile surveillance systems are being used more and more in buses, trains and other types of public transportation.

Evidence Recovery Importance

There are three main factors we would like to mention regarding the reason for proper evidence recovery. First, when we retrieve recorded video evidence, we create a video recording of our process. This establishes an indisputable chain of custody. It also demonstrates for those who were not present the process and procedure we used. We take special precautions during the retrieval process to make sure we leave with at least one version of the recording. We also leave with the recorded video evidence for future forensic enhancement and authentication as necessary.

We retrieve the recording so as to minimize any degradation of quality created by a less experienced person. When a multi-million dollar lawsuit may depend on the analysis of a surveillance video, it is important NOT to leave evidence retrieval to an untrained security guard.

We research the operator’s manual and connect with tech support from the surveillance company before we travel to the location of the surveillance equipment and perform the evidence recovery. While we are on site we can also examine the administrative log and determine additional forensic information for the chain of custody.

Best Practices

An excellent manual for retrieval of electronic evidence developed jointly by the federal government’s inter-agency Technical Support Working Group, the FBI Forensic Audio, Video, and Image Analysis Unit, and law enforcement agencies from around the world. Entitled Best Practices for the Retrieval of Video Evidence from Digital CCTV Systems, it contains an authoritative (if somewhat dated) overview of the topic, and covers many of the protocols we have adopted at Primeau Forensics.

Before digital audio and video recorders, retrieving a tape-based analogue recording was fairly straightforward. Recordings were made to tape cassettes, which were stored in climate-controlled conditions. Evidence retrieval was as simple as picking up the original cassette recording. Digital video recorders (DVRs), however, do not record to easily portable cassettes. Rather, they record to the kind of hard disk drives found in computers. These internal hard drives are not portable, making evidence retrieval more difficult. Whether we take the DVR or its internal drive with me or make a lossless copy of its contents, I always follow anti-static procedures and carry all media in specially shielded cases.

Proprietary V.S. Open Source Video

All surveillance and standard digital video is recorded using a specific compression/decompression scheme or codec. The compressed file is stored within a wrapper, a file structure, which determines its format. It is not uncommon for surveillance DVRs to use proprietary formats, allowing playback only through the original recording DVR. Some DVRs can re-compress the original proprietary format file, trans-coding it into a non-proprietary format for easy playback. However, these more accessible files often contain lower quality video and audio. When we retrieve these digital video files, we study the DVR’s operating manual to find the best way to make a high quality copy that retains all data and metadata. By minimizing or eliminating the degradation that can accompany translating the file from one format to another, we ensure that our lab analysis is based on the best video recording available.

Mobile Surveillance Video Recovery – How to Recover Video

Wednesday, March 26th, 2014

There are two sections to this blog post. The first section provides information about mobile surveillance video recovery. The second part a guide ‘How To Recover Mobile Surveillance Video.’ We have created a Four Step Process of how to recover video from mobile devices.

This how to guide will help you understand the process of scientifically recovering video recordings from mobile devices. There are areas of concern and protocols to follow. We hope to help you understand the best methods to follow when recovering video recordings from mobile devises.

Recovery of mobile surveillance video is a scientific process. Mobile surveillance video can be recorded on a smart phone, CCTV system or other mobile digital video recorder.  This process also includes establishing a chain of custody. Documenting the recordings integrity for use in court. This documenting of the chain of custody is the beginning step for forensic video authentication and analysis.

During the recovery process, the qualified video forensic expert may also perform hard drive cloning. Hard drive cloning is a process that creates an exact bit for bit clone image of the mobile surveillance DVR’s hard drive. This is most always performed during the mobile surveillance video recovery process and requires additional time.

Video in the Court Room

opened-hard-disk-drive-liying-on-other-hard-drive_zJrBFjCd-234x300 Mobile Surveillance Video Recovery - How to Recover Video

Mobile digital video recording technologies can be difficult and challenging for playback, especially in court. Many systems have proprietary software and require a proprietary video player to view the video.  Playback of these video recordings in court is straightforward, provided the video is played using the original equipment that created the video recording. Otherwise, a qualified video forensic expert can create an open source video file which is much easier to play using various players like VLC and Media Player Classic

Proprietary V.S. Open Source

To further explain, many attorneys and police officers are not aware that there are two types of video recordings that can be recovered. Most fixed and mobile DVR-based surveillance systems employ proprietary systems and record digital video to proprietary formats. Proprietary video recovery has minimal degradation of picture quality during the process of recovering. However, they can be difficult to operate in a court room setting. This is why they are converted to open source. Converting a video file created on a mobile device is often complicated for law enforcement agencies as well as video forensic experts.

There are a wide variety of surveillance system and smart phone manufacturers and a larger number of different models of DVRs. This complicates on-site retrieval of video recordings a difficult process. This often requires access to the technical manual of the DVR or device that created and stored the video recording.

Primeau Forensics Mobile Surveillance Video Recovery

Primeau Forensics experts and technicians perform mobile surveillance video recovery assignments and investigations on many different types of equipment. We have learned that simple cloning of the equipment hard drive would be a mistake.

First, the cloned drive may not mount on our computers, which run Windows and Apple operating systems. Second, proprietary files are often invisible files outside their native operating system. They cannot be detected or read by any operating system but the embedded OS running on the dedicated device. Third, video files may be encoded using a non-standard codec and/or formatted within a non-standard wrapper.

For example, the format of the mobile video recordings frequently used in surveillance systems, come in a multitude formats. Each format has its own structural and descriptive metadata. Some of the files included, such as the control files and system files may not work on general-purpose computers.

Recovery Preparation

Successful mobile surveillance video recovery always requires preparation and research beforehand. We have outlined a four step process for mobile surveillance video recovery outlined below that will help you understand the legalities and science involved.

At trial, verdicts may be determined on the outcome of our analysis of a video that was forensically recovered. We suggest that a qualified video forensic expert recover the video recording to establish a clean chain of custody. A forensic expert will also prevent accidental loss of files and preserve the video quality. This is accomplished though recovery and trans coding to an open format.

How To Recover Mobile Surveillance Video

We recommend the following 4-step process for retrieval of video from DVRs:

1)      As previously mentioned, research the design, inputs/outputs and operation of the DVR you are examining. Obtain the special software, codecs, and technical manuals necessary to examine the unit properly.

2)      Photograph the digital video recorder before you begin the inspection. Take note of any markings or signs of tampering.

3)      Connect the DVR or mobile digital video recorder to the power source that will power the unit best. Sometimes, mobile digital video recorders require an AC/DC cable system to power the unit in an office environment. The location where the mobile video recorder was originally installed may have had custom power connections. These connections may not be available if the unit is removed for inspection.

4)      Connect the data transfer cable supplied with the recorder equipment to your Windows laptop for examination. In some cases, this will be a standard USB or FireWire cable.

Mobile video recorders, in particular, frequently require a proprietary cable. Install the DVR software provided by the manufacturer of the system and you are ready to recover mobile surveillance video. Read the equipment manual to help retrieve the highest quality video recording possible.

If you need professional assistance recovering video evidence from a digital video recorder, please call us today! Call 800-647-4281 for a free consultation.

Video Forensic Expert Edward J Primeau Curriculum Vitae


sidebar map
sidebar video
forensic associations