A crime occurs and is “witnessed” by a digital CCTV system. The files that your investigation wants/needs are in the system’s recording device (DVR). What do you do to get them? Do you seize the entire DVR as evidence (“bag and tag”)? Do you try to access the recorder through its user interface and download/export/save the files to USB stick/drive or other removable media?
Answer: it depends.
There are times when you’d want to seize the DVR. Perhaps 5% of cases will present a situation where having the DVR in the lab is necessary:
- Arsons/fires can turn a DVR into a bunch of melted down parts. You’re obviously not going to power up a melted DVR.
- An analysis that tests how the DVR performs and creates files. For example, does the frame timing represent the actual elapsed time or how the DVR fit that time into its container? Such tests of reliability will require access to the DVR throughout the legal process.
- Content analysis questions where there’s a difference of opinion between object/artifact. For example, is it a white sticker on the back of a car or an artifact of compression (random bit of noise)?
If you’re taking a DVR from a location, you can follow the guidance of the computer forensics world on handling the DVR (which is a computer) and properly removing it from the scene.
What’s wrong with this video? Hint: look at the Inspector’s results for width / height.
Unfortunately, the answer in many people’s minds is …. nothing. I can’t begin to count the number of videos and images in BOLOs that attempt to depict a scene that looks quite like the one above. If you don’t know what you’re looking at, it’s hard to say what’s actually wrong with this video.
The Joint Technology Committee (COSCA)(NCSC)(NACM) had released version 1 of their document Managing Digital Evidence in Courts.
“Technologies including smartphones and body-worn cameras are capturing an ever- increasing volume of evidence. The exponential increase in the quantity of digital evidence is challenging the court’s ability to receive, evaluate, protect, and present digital evidence. This report identifies potential challenges and recommends steps courts should consider.”
In its recommendations around the conversion of proprietary video file types, it noted the following:
- Avoid creating arbitrary limitations on acceptable formats for digital evidence.
- Work with law enforcement, prosecutors, and local labs to consider the tradeoffs
between converting and not converting digital video evidence.
Interestingly, when the state of Texas (US) was considering a statewide standard for video sharing in its many court districts, Amped Software was the only company to be able to say: “Yes, we’re ready now. We can convert an overwhelming majority of proprietary file types into the proxy file type of your choosing.”
Want a .re4 file converted into a Raw MOV file? Done. Want a .SEC file converted into an MP4 or an AVI file? Done. Our standalone conversion tool is second to none. We’re converting over 80% of proprietary video file types found, with more being added as we encounter them.
Meet Amped DVRConv – our best-kept secret.
We receive quite a few phone calls and e-mails from well-meaning customers wanting us to “crack” secure in-car or body worn camera video files. They get frustrated because our conversion tools in Amped FIVE or Amped DVRConv don’t “crack” files for them. The easiest explanation is that our tools aren’t designed to defeat security.
It took us a while, but we wanted to make sure it was perfect! Today, we finally officially launched our newest product called Amped DVRConv. In a nutshell, Amped DVRConv allows you (our customers) to easily and quickly convert unplayable/proprietary video files from surveillance cameras and digital video recorders, in minutes. This means you can now get to that vital digital evidence faster than ever!
Read below for the official announcement or click here.
Visit the new Amped DVRConv product page on our website for further technical details.
When working on DVR videos, how many times do you have not just a single file, but a folder full of files from different cameras of different times?
An often overlooked tool in Amped FIVE is the Convert DVR interface that enables a user to pre- process files prior to loading.
It is good practice, when conducting any sort of batch processing, to work on a copy of the folder containing the evidential files. Although FIVE has safeguards in place to ensure you don’t overwrite anything, it’s a good habit to get into!
Here we have a folder containing our 4 evidential files.
Our friend David Spreadborough, better known as Spreadys, has written a bunch of articles on different DVRs he tried at IFSEC 2014. The articles are packed with a lot of very useful technical insights, which system producers should take as a checklist to improve their products.
The good thing for us is that (as Spreadys notes) most of the proprietary video files produced by these systems are easily reproducible with Amped FIVE. Continue reading
Today, David Spreadborough (better known in the community as “Spreadys”) posted an article where he has shown different ways of converting proprietary video formats in one specific case, with all the quirks of the method explained in the previous post about the topic. Amped FIVE is one of the tools used for the comparison. Continue reading
In a recent post, Larry Compton of DME Resources makes some excellent points about video format conversion.
Jim Hoerricks adds some further insights that are also related to Amped FIVE workflow, especially concerning our proprietary video conversion feature we are constantly improving.
The bottom line of the two articles is that, even if you have third party tools to decode the proprietary video formats, they are called “proprietary” for a reason. Thus you cannot be 100% sure of the results unless you test, verify, and analyze in depth.
I wanted to add something to the discussion. The following extracts are from Larry’s post, following some comments from my experience:
Dave Glover from our partner, GP Sift, will be at the MediaSolv booth #2407 showing the new workflow for converting and viewing proprietary video files in the latest version of Amped FIVE. If you’re in Washington D.C., come by and see it! GP Sift, MediaSolv, and Amped Software have developed an integrated workflow for homeland security specialists, investigators, intelligence analysts, and digital media forensic experts to provide the most effective solution in the industry.