Hi everyone, and welcome once again to the CCTV Acquisition blog series. In this week’s post, we are going to concentrate on the recovery of CCTV evidence. A recovery of CCTV evidence involves the simple request and collection of the video material. There are, however, some very important considerations. So read on, to learn more!
To put some context on this process, let us imagine a robbery in a shop. One of the first questions every investigator asks upon attending a scene, is “do you have CCTV?”
If the answer is yes, the next question should be, “do you have the authority and knowledge to use it?” It is often incorrectly assumed that the person has the right to use it, and most importantly, the knowledge of how to control their system safely and correctly.
At this point, we must be clear that every country will have different legislation that covers the recovery, acquisition, and retention of evidence. It would be impossible to cover every country’s legal guidelines so let us assume that all have been complied with.
Remember also that for this series, we will always promote processes to ensure evidential integrity and authenticity rather than a specific set of local or national practices.
Access to CCTV
Getting back to our robbery, we have luckily found someone who has full access to the CCTV system. There are several different access types and these are important as different access may limit how much a person can do.
The first is having physical access to the device itself. Some devices are hidden, and many may not be on the premises at all. Off-site storage is something we will look at later in the series.
A video surveillance system may be behind a locked door or cabinet. The user may only have computer network access to the device. This may affect the choices they have for exporting data. Their computer access rights may mean that they are only able to search and view footage, with no ability to export at all.
These user rights may also be on the recording device. There could be several different levels of access, from full admin control, search and view only, to only viewing live events. Each of these is usually password protected.
It is for this reason that every premise with a Video Surveillance System (VSS) must have someone on duty who has full access rights. This is regardless of a country’s regulations, it is simply common sense as the delay in getting access to footage can seriously hinder investigations. It is also beneficial for every system to have an evidential recovery plan that details the system and how to export the correct data when required.
Competency in the Recovery of CCTV Evidence
Now that we have confirmed full access to the actual recording device, what about competency? They must not change the data in any way. This is one of the key principles in accessing digital material.
Competency can be tricky to deal with as many people may believe they know what to do, but in reality, do not. Mistakes made when navigating and controlling a VSS can cause tremendous damage. Data corruption can lead to the loss of visual or date and time information.
Many of these devices may have been sitting untouched on a shelf for several years until it is required to be accessed. The words “Handle With Care” should be remembered when dealing with CCTV recording systems. With full access and the knowledge of how to use the system correctly, we can progress to the next stage. What do they recover and how?
The nature of the investigation will dictate the priorities and parameters. The priorities can be explained from what is absolutely needed, to what would be helpful but not necessary. Parameters are then cameras and time ranges.
Example:
- All inside public-facing cameras (1,4,5,6,9) between CCTV time 11:22 & 11:25 on 10/10/22
- Outside facing cameras (2,3) between CCTV time 11:00 and 12:00 on 10/10/22
Priority 1 would give us the incident, whereas Priority 2 would give us the direction of approach and departure.
Did you notice that we used “CCTV time” above?
The Difference Between CCTV Time and Real-time in CCTV Recovery
It is important to understand the difference between CCTV time and real-time.
Real-time is the true time. The CCTV time is what the system is presenting. It is vital to always document which time is being referred to and to have a clear understanding of what any difference is.
When viewing the system monitor, before any interaction with the device, compare and note the displayed clock showing the CCTV time, with real-time, perhaps by using https://www.timeanddate.com.
This should be done as close to the time of the incident as possible due to any clock drift, automated time changes, or further user interaction or power failures.
The difference in time, either forward or backward, is known as the time offset.
Let us summarize so far.
We have identified the time offset between real-time and CCTV time. Also, we have made a clear and documented request for certain priorities and parameters. The CCTV user will now proceed to export the requested data. This could be completed immediately, or later, depending on the urgency.
The “How” Stage of CCTV Recovery
We are now at the “how” stage of the recovery of CCTV evidence. As we learned earlier in the series, there are many thousands of different recording devices, which can record into any format, with multiple different ways to export.
For an investigator, you are putting your trust in that person to export what is required, in the original native format so it can be used as evidence. This is the key to ensuring that the exported data has integrity. We need to be able to prove that the data has not changed since the time it was first created.
If they have to make a choice of export format, will they pick the right one? By the time any errors are discovered, will the footage still be there, or will it have been over-written?
Many CCTV owners may think you require a certain format because that’s easy to play, but that would not be original. If it is changed in any way, the differences may affect not only the integrity of the data but its authenticity. It will also reduce how much restoration and enhancement are possible. The slightest change may make the difference in the successful recovery of a license plate, or not.
Conclusion
Later in the series, when we begin to perform the acquisition ourselves, we will look more closely at this and look at some of the problems that can arise when selecting the wrong export format.
We will also consider what is being used to facilitate the export process. Will the footage be placed onto an optical disk, an external hard drive, or a USB flash drive? For a basic recovery, has the CCTV owner got that device, and importantly, will the exported data fit into it?
For now, though, we are thankful that the CCTV owner did have the correct device. They were aware of what export format to use. All the data was exported correctly onto a temporary storage medium. Finally, an integrity statement will be required from the person creating that exhibit.
Next time we will look at public submissions of CCTV and video evidence before moving on to navigating a CCTV device and reviewing recorded material.
