The CCTV Acquisition blog series has now moved on to navigating a CCTV device and reviewing video. The competency level required increases here for two reasons. Firstly, you will be taking control of, what could be, a relatively expensive piece of electronic equipment that does not belong to you. Secondly, this device may contain vital evidence in your investigation, and a mistake could be very costly.
Before we move on, let us summarize what we have learned so far.
- In the Introduction to CCTV Acquisition, we learned the importance of Integrity and Authenticity when acquiring and handling Digital Multimedia Evidence (DME).
- In CCTV-The Beginners Guide, we looked at CCTV Cameras and then Digital Video Recorders (DVRs) and Network Video Recorders (NVRs). We also learned how the data is stored within these devices.
- In Search and Trawl, we identified the methods used to ensure CCTV is located quickly before it is overwritten.
- Then, in CCTV Recovery, the owner or controller of the device was given the responsibility of conducting the evidential cctv acquisition. We looked at how to detail the priorities and parameters of the request and ensure their competency.
In the most recent post, we identified that the Public Submissions of CCTV and Video Evidence must be controlled and managed carefully to avoid the submission of incorrect, low-quality imagery and avoid any risk to evidential integrity.
Every area will have different restrictions and guidance on who can control a device, and then conduct an acquisition. This series is not taking into consideration any geographical restraints. However, it would be remiss of us not to point out some warnings.
We have learned throughout the series so far that these devices can be temperamental and unreliable. Even navigating a calendar to identify recorded material could be enough to corrupt an index system. Slightly moving the device to make using the controls easier could be enough to cause a short in the wiring at the rear. (Author speaks from experience).
You must have the protection of your competency and your local procedures to cover you against any problems. From an evidence perspective, the loss of data, or any reduction in the data integrity (caused by incorrect acquisition), may result in breaches of a legal process.
The first consideration is access. Have you got physical access to the device? The next is safety. It may not be in the safest of locations and, balancing on a stack of crates whilst holding a roof panel above your head may not be in anyone’s best interest.
When faced with a video surveillance recording device that could contain evidence, the first thing to do is nothing! Do not start pressing buttons or clicking the mouse.
What is the device? Can you see a brand name? Is there any visible model number? Model numbers are often tucked away around the back or on the underside of the device, but remember to be careful when moving it. A small mirror or your cellphone camera can be handy to have a look around the back of the device.
Is the manual for the device available? If not Google! (Other Search Engines are available). Having the manual makes things so much easier, as the graphical user interfaces and menus can often be quite complicated with hidden features.
How will you control the device? Are there buttons on the front, or a mouse? If a mouse is not attached, will it accept a mouse? Although this DVR can be controlled with buttons, it is not easy!
How does the device look? Does it appear modern or old? Is it making noises? Is it very hot?
Having a sense of the device’s reliability may affect your decision-making. If the fans are making noises, the device is so hot it can’t be touched. Moreover, if it’s connected to an old CRT monitor may suggest a very careful approach.
Where is the monitor? This may sound like a silly question, but a recording device does not necessarily need to be connected to a monitor after it has been installed. The monitoring of the device may be done remotely, or the monitor may be in another location, such as the front of a shop.
If access is difficult and controlling the device is complicated, it may be beneficial to request higher technical assistance from a unit or officer with a full CCTV retrieval kit. Later in the series, we will look at equipment lists to cover this.
One last consideration. Does it look complicated? If you are greeted with a large rack of recording systems and data storage devices, it may be best to request further technical assistance.
At this point, start taking notes and photographs. These will form part of your CCTV acquisition evidence. They will also benefit you if problems occur during the CCTV acquisition or if any allegations are made at a later time.
There are, most commonly, two reasons for reviewing data from a surveillance device. The first is to identify if something was, or was not, captured by the cameras. This would involve observing the visual information to make a decision. Secondly, it is to evaluate the dates and duration of the recorded material held within the device. This will identify the presence of footage during a date and timespan. In this second example, the review of the imagery will only take place after it has been acquired.
In both instances, an understanding of the camera views is required. There would be no point in doing anything if the view from the cameras did not cover the area of interest. The monitor may be showing 4 cameras. However, there may be many more being recorded. To view all the cameras, it may be necessary to take control of the CCTV device and start navigating the menus.
This is where you must consider your backup. It’s like jumping out of a plane with no reserve chute! You may not have any method to have a backup. Nevertheless, you must consider the cases when it’s best to have one. Remember the old, hot, and whirring DVRs? Do you want to risk losing potential evidence?
CCTV retrieval officers will have methods to record everything that is done on a device. You can read more about them here in this post on using the Video Input Filter in Amped FIVE. Once set up, Amped FIVE becomes the CCTV monitor (handy again if there is not one accessible). It records everything you do, including all the device settings. This can be a huge benefit in itself, as it may save a lot of note-taking.
For our case today, though, we will be diving straight in without a backup!
We looked at this in the previous post. If you are searching for an incident that occurred around 2pm, but the CCTV clock is 2 1/2 hours slow. You will have to start reviewing footage using the CCTV Time of 11.30am. This time check should be accurately recorded in your review notes.
One last thing, before we start doing anything, is to identify what is connected to the device.
The first cable to be identified is the Ethernet. This allows network and internet access to the device. It is best practice to disconnect this whilst performing the recovery to avoid other people attempting to access and control the device at the same time.
Next are the video and audio (AV). If you identify 12 video cables entering the device, but you can only see 9 on the monitor, it may be that your access rights are limited to only viewing those certain views.
For audio, it is often of great help to identify that there were no audio cables attached. Many exported files will have an audio stream but no data inside it. Forensic video technicians have spent many hours attempting to extract and listen to audio from a file when there was never any audio to start with.
These AV cables will be at the back. Be careful if moving things around, as there may not be a lot of spare cables to allow full movement.
A reminder of something we touched on in a previous post is user access. What you want to do, and what you can do, will be controlled by the settings on the DVR. You may be able to change the monitor view to see all the cameras. However, can you access the menu to see what is recorded? User rights will dictate everything.
Whatever the control method, mouse or buttons, spend a few minutes getting used to moving around. This is especially important on older systems with push-button controls. Accidentally hit a button two or three times, and you could enter the menu that allows you to wipe the Hard Drive. This is not an exaggeration.
Now that we are navigating the CCTV device, we must identify what data is stored within it. There could be several different methods, but a common one is a general index.
Within this DVR, there is a menu item called Info.
Followed by another option for HDD Info.
Before we look in there, did you notice another menu item called LOG? We will look more at that later in the series. Anyhow, this is where all user interaction with the device is stored.
This may be the first piece of data to take a record of. It clearly displays the CCTV date and time range. This may be enough, as the parameters required to be viewed may be so large that it would not be practical to view on the scene.
For this post, though, we will look further at a specific date, time, and camera view using a Playback Menu.
We will come back to this menu in the next post in this series, as we will complete a Backup. For now though, we will simply Playback to review some recorded video.
The allegation is that someone may have entered this apartment at a certain date and time. The first thing to be considered is that the device was not changed to account for Summer Time, so it is 1hr slow.
Small systems may not be able to view several cameras at the same time. This can cause some difficulty when reviewing different camera views. Also, using a mouse makes things much easier to click on the date and then scrub along the 24hr time bar at the bottom. Different systems will have different methods to navigate in time.
Each player button has some useful text. Later in the series, we will look at this Start Editing button to see what it does. For now, though, we can hit play and review the footage as required.
Many systems now have sensors, such as motion. These can be helpful in navigating a CCTV device as you can skip to the next motion-activated recording. The system’s technical capabilities for searching will be directly related to its complexity. Large multi-camera systems may allow auto-tracking and searching of people and vehicles.
Whatever the outcome of the review, the device access and all the relevant data must be recorded. Even if nothing was captured, and no person is seen entering the premises, consideration must be made to preserving this data if an investigation is being conducted. The fact that no person entered may also be of importance and may be required for your region’s disclosure legislation.
In the next post in this series, we will move on to preserving some evidential footage by using an external temporary storage device.