Dear friends, I’m so glad to introduce this new blog series! Every Tuesday, for several weeks, we’ll walk together to discover some delicate or even dangerous aspects that you may easily encounter when dealing with images and videos during investigations. And of course, we’re not belittling your skills when we write “because you don’t know what you don’t know”! It’s just something that comes from our experience: we talk with investigators on a daily basis, and we’ve noticed that, sometimes, there’s a tendency to treat images and videos as “something everyone knows about”. All in all, we have them on our smartphones, we share them on social media, perhaps we also edit them with some consumer app or software from time to time, and with nice results.
Alas, my friends, it’s not that simple, for many reasons:
- Videos you deal with in forensics often come from CCTV surveillance systems. The acquisition and processing lifecycle of such videos is very different than what goes on in a smartphone. Smartphones have never dealt with analog video, while many CCTV systems still work with analog cameras connected to a DVR. And what about compression? One minute of video on my Google Pixel 3a is worth hundreds of megabytes, while it would probably be <10 MBs in a CCTV system.
- Video encoding and playback is a complex topic, and this is especially true when it comes to proprietary video formats, that are used by most surveillance systems. Those working in the field know that most of the time, the original video extracted from a DVR just won’t play in standard computer players, it is normal. How do we “convert” it to a playable video? There’s a whole world inside, and investigators must at least know that such a world… exists!
- Remember that a shallow interpretation could steer a whole investigation in the wrong direction. Want an example? Take a look at this infrared picture of a shirt.
