Welcome to this new Amped Software blog series on CCTV Acquisition. In this fortnightly series, we hope to break down some misconceptions and challenges. Also, we hope to provide some solutions for the initial recovery of video evidence from surveillance systems.
Therefore, make sure to stay up-to-date with our blog by checking in regularly. In fact, we will be posting a new article every two weeks. You won’t want to miss out on any of the content!
To begin with, before we look ahead at what’s coming up, let us take a few moments to understand “evidence”, in general.
Evidence in CCTV Acquisition
Firstly, in any investigation, whether it is criminal, civil, or even within an internal business, evidence is sought to answer a question or belief and, subsequently, identify if an allegation is true or false. Most people are aware that witness evidence is when someone can state they saw or did something. Then, there is physical evidence, such as a document, a fingerprint on a glass, or an item of clothing found in a street. Moreover, the item of clothing may later be found to have no connection with the investigation. Finding it, recovering it correctly, and the analysis of it, must all be done in a manner that does not affect its value during any other part of the investigation.
Let us look more at this item of clothing.
The Investigation
An investigation may have started as a result of a person being assaulted. The offender ran away and was seen by a witness to be wearing a blue shirt. Accordingly, the police search the road and a blue shirt with red marks on it is found. Then, an officer placed this item into a paper exhibit bag, and it was sealed and labeled correctly. The officer knows what to do, and how, because of their training in the handling and packaging of clothing exhibits.
At the scene of the assault were blood and bullet casings. These, however, were not handled by the officer, but by an appropriately trained Crime Scene Investigator (CSI). The officer has no experience or competency in the forensic acquisition of such items.
Evidence Understanding and Handling
This level of evidence understanding and handling is the same for Digital Multimedia Evidence (DME), and CCTV falls into this evidence type. However, CCTV is very different from a standard audio or video file. Decades of under regulation, poor security industry understanding, and minimal academic research have resulted in the formation of a hybrid data type. There may be very little, if any, information on how the data is generated and how the data should be acquired, handled, and managed.
In most evidence types, there are known standards. However, an estimated 7-10 thousand different video surveillance systems exist. With each manufacturer being able to manipulate the data in any way they want, the importance of originality and integrity cannot be overstated.
To emphasize this point, we will return to those bullet casings, recovered earlier by the CSI.
They were photographed at the scene and then carefully packaged. They were not thrown away or placed into inaccessible storage. Full analysis cannot be completed later by just using the photograph. The original item must be used. The photograph may be suitable to answer some questions on the bullet casing but not many others.
Digital video is very easy to misunderstand and inadvertently alter. Consequently, when an analysis is being conducted, or any decisions being made, the data must be fully understood and the limitations of the product identified.
CCTV Acquisition
If CCTV acquisition is not conducted correctly, of course, the resulting data may only have the same worth as the photograph of the bullet casings. It may be able to answer some questions but not others. Importantly, questions are easily answered incorrectly without competency in the media type and a failure to identify the limitations of the footage.
Over the past few years, we have seen a sharp increase in CCTV data where the method of acquisition has affected the integrity, authenticity, and then the ability of the footage to be restored and enhanced effectively. These limitations have significantly reduced the ability of the item to answer the questions required and have negatively affected the investigation.
CCTV Device Handling
Let us now transfer the bullet casing scenario to what we encounter in CCTV. We have an untrained person that may be a member of the public or even a police staff member or officer, handling a piece of equipment they know very little about. They have the best intentions. However, due to a lack of training and knowledge, they decide to interact with the recording device and attempt to export the CCTV in a specific way. What appears to be common is that they select an export option within the device that they are comfortable with. “Export to Windows Media”, for example.
They may not use the main device. Moreover, they may use an app on their smartphone to communicate with it and then inadvertently save a lower-quality version of the original. They may not even be able to navigate the device effectively, so simply use a mobile phone to photograph or record the CCTV monitor.
Just like the photograph of the bullets, those versions of the CCTV footage may be able to answer some questions and may be the only thing possible in certain circumstances. Anyhow, they are limited in their value due to their acquisition.
Goal of the CCTV Acquisition Blog Series
To sum up, the intention of this series, prompted by the increasing number of cases where first-responder officers have to deal with video acquisition and handling, is to bring some understanding to this niche forensic area. Rather than looking at conflicting standards, guidance, and region-specific policies, it will focus on the two pillars of Digital Multimedia Evidence.
Integrity & Authenticity
Integrity asks if there are any changes since the time of creation, whereas Authenticity asks if it is a true and accurate representation of what it purports to be. So, acknowledgment of the importance of these is the key to ensuring that the right evidence is obtained in the right way, every time.
Upcoming Posts
The series will cover these topics:
- Introduction to CCTV Acquisition
- CCTV – The Beginners Guide
- Search and Trawl
- CCTV Recovery
- Public Submissions of CCTV and Video Evidence
- Navigating a CCTV Device and Reviewing Video
- Closed-Box Acquisition using Storage Media
- Closed-Box Acquisition using Network Access
- CCTV Device Removal and Replacement
- Open-Box Acquisition using the Internal Hard Disk Drive
- Remote Acquisition using a Mobile Device
- Acquisition from a Cloud-based Service Provider
- Master and Working Copies
- Viewing CCTV
- Series Summary
List of Acronyms
| Acronym | Expansion |
| CCTV | Closed-Circuit TeleVision |
| Codec | enCOder / DECoder or COmpressor / DECompressor |
| CSI | Crime Scene Investigator |
| DEMS | Digital Evidence Management System |
| DME | Digital Multimedia Evidence |
| DVR | Digital Video Recorder |
| FPS | Frames Per Second |
| HDD | Hard Disk Drive |
| NVR | Network Video Recorder |
| USB | Universal Serial Bus |
| VHS | Video Home System |
| VSS | Video Surveillance System |
| WMV | Windows Media Video |
Conclusion
Finally, so to get the series started, next time we have “CCTV – The Beginners Guide“. Until then, stay safe and have a great week.
