Retrieving Evidence from CCTV

By Martino Jerian, CEO and Founder, Amped Software

In last month’s column, we discussed the main issues around the use of digital images and videos as evidence in general. This time we will focus our attention on footage retrieved from CCTV (Closed-circuit television) and the best ways of handling it to ensure it stands up to scrutiny in the courtroom.

Acquiring evidence from a digital camera or a smartphone is relatively easy to do. Images are usually in standard JPEG format and videos in MP4 or some other format that most players can read.

But how do you get videos from a CCTV? There are numerous possibilities and it depends on where the video is actually recorded. As of today, there are several options for storing/recording videos:

• The video is stored on a DVR (digital video recorder), which is basically an embedded PC with a hard disk that captures a signal from an analog camera. This is probably the most common option for shops, fuel stations and private properties.
• The video is stored on a NVR (network video recorder) or a VMS (video management system), usually based on one or more servers connected to network cameras. This is the solution often used in cities or large infrastructures such as airports.
• The video is stored locally inside the camera (quite rare).
• The video is stored in the cloud. This is starting to gain popularity especially for consumers.
• The video is stored on a VHS. It’s rare, but as of today it is still happening.

The most probable situation is that the video you need to acquire is on a DVR, so we will focus on this case. The NVR and VMS have issues and features very similar to the DVR from our point of view, so the following could be applied to these systems as well.

Now that you know where your data is, how do you get it out of there? This is another complication.

Depending on the system, there are different ways to export the footage on a USB drive, a CD rom, via network cable and so on. For critical cases it is even possible to do a forensic analysis of the hard drive with the techniques typical of computer forensics and try to recover deleted data or videos on a broken device.

What often happens is that some people who arrive at the scene don’t know how to properly perform an export of the video. So, what do they do? They take their mobile phone out of their pocket and film the monitor playing back the footage of interest. Maybe at this point this is the only piece of evidence that we have, because the video on the DVR was overwritten the next day.

While you may think that you can see something, this approach is very bad: it may be acceptable only when motivated by extreme urgency and should be then followed by a proper acquisition. Otherwise you are relying upon a video of the evidence instead of the evidence itself. In a ballistic analysis, would you present the actual gun and the bullet as evidence, or just the photos taken of the bullet and gun? This is exactly the same situation.

So, let’s proceed to export the video in the proper way with the facilities provided by the producer.

A big issue with DVR video is the fact that the files created by these systems are not normally in a standard format. This means that you need a specific video player program to view them. These pieces of software have a bunch of issues of their own, so what many do, is just capture what is being played on the screen and create a new video which is a recapture of the evidence. This is a bit better than filming the monitor with the mobile phone. However, in this case, not only is there a risk of missing data – entire frames – but also creating new misleading data with new compression and capture artifacts. You will also lose a lot of information not visible on screen but found inside the file, like precise timing information that can be critical in a case. Granted, sometimes screen capture must be done because there are no alternatives, but it must be the last resort and not the standard practice. It must be done with care, and getting it done in the right way is quite difficult.

In order to properly convert the video into a standard format to be more easily viewed and analyzed, you need to be able to do it by preserving the original data as much as possible and, if not possible, at least to minimize the loss of quality.

If you are handed an AVI or a standard MP4 as the original video from a CCTV, it is very likely (though not impossible) that this is not the original file coming out of the system in its native format. You need to always make sure that you request the most original version, if available, to get the best quality, in depth analytical information, and to respect the chain of custody.

Properly handled CCTV footage is one of the most compelling forms of evidence for the judge and jury. How well CCTV evidence is gathered and handled has a major impact on successful regulatory control, enforcement and/or prosecution. However, its value becomes zero if its mishandling presents it from being admissible in the first place.