Welcome back to the blog series on CCTV Acquisition where, in this article, we cover viewing CCTV after acquisition. At initial thought, you may believe this to be a quick subject. However, as we dive deeper you will see that there are several considerations at different stages. Read on to learn more!
Before Acquisition
The first stage comes before any acquisition is conducted and we looked at this in the Search and Trawl post. Let us look further at this now and consider options for when there is no footage to acquire.
What if the system was not working? There are investigations where it may be necessary to identify why nothing was recorded and obtain documentary evidence to support this.
Does the field of view capture the area of interest? If not, then although there may be no requirement to view the footage, evidence of the camera views may still be beneficial. This is one of the few times that a snap of the CCTV monitor, often referred to as a “screen snap”, would be recommended.
What about the time range? If footage has been overwritten by some considerable period, then the chances of any raw data recovery are minimal. Yes, it is often possible to identify small fragments of frames. However, being able to decode them, and then relate them to a specific date and time is very rare. Even if the footage has only just disappeared from the index, the work involved in data recovery could be considerable.
Again, this is another situation where some evidence may still be required. This evidence can take the form of either a statement from the owner or an image taken of the index data on the CCTV monitor. This will show that footage for the required priorities and parameters was not present. Remember: check the date and time difference.
Preservation
What if the camera does face the area of interest, and the date and time required are present on the system? When you safely view the footage, you identify that the incident or event you are searching for cannot be seen. An example is that you are searching for a person walking down a street after intelligence or other evidence points to this area of interest. By viewing the footage related to the information known at the time, is there a requirement for that footage to be acquired and preserved?
If the footage is viewed, it is often best practice to ensure the footage is preserved so another person can view it if necessary. Putting the responsibility on a CCTV owner to preserve the data may not always be reliable.
After Acquisition
Immediately after an acquisition, or as soon as it is received within an investigation, footage must be viewed to ensure that it is viable digital multimedia evidence (DME). This is the assessment stage.
Assess
If you have conducted the acquisition at a scene, then the files should ideally be assessed before leaving. This verifies that the files have been created correctly.
As we have discussed many times within this series, it may not always be possible to decode and play the native files immediately. Ensuring you have another set, perhaps in a standard format, may assist the initial assessment process. It can act as a backup if native decoding is not possible.
If you have recovered the files from a witness, have they provided them correctly? Any delays in identifying problems with what has been created could result in the footage being overwritten. Consequently, the files must be viewed as soon as received to establish their validity.
It is easy to identify what files have been acquired and if they all work correctly when conducting the acquisition and initial assessment yourself. However, if receiving the files from a witness, either physically on storage media or via an online sharing service, it is essential that questions are asked quickly.
- Are the files individualized to assist in the chain of custody, and future copy and movement verification?
- Do the files have integrity? Have they changed since the time of creation?
- Does the visual data relate to what is required?
- Is there a date/time difference between what is shown and real-time?
- Is there documentary evidence on the file(s) creation and handling?
Initial viewing at this assessment stage, to verify that the digital evidence is intact and that it does relate to what is expected, should be documented within the evidence chain. It is also vital to record what software was used to view the evidence.
Evaluate
Let us move on now to the next viewing stage. Again, it has various components that all depend on the nature of the investigation. For a simple case, it may be possible to combine the initial assessment of footage with an evidential evaluation. Then, after identifying key moments, that footage could quickly be processed for evidence.
Amped Replay was designed exactly for this purpose. It allows an investigator to assess, evaluate and then even conduct some simple processing tasks. There is no need to separate up the tasks, and no need to request basic processing from another department. Replay is built on a forensic backbone so first responders and investigators are protected, and cases can be progressed quicker.
Moving back to the viewing, the key concept to take away from this is that you are not simply watching a video. That was the first stage. Here you are evaluating evidence. It is, therefore, vital that you are viewing the evidence correctly, to make the correct decisions. Remember that forensic backbone I mentioned earlier in Replay? The application ensures the decoding and presentation are controlled for legal use, rather than a CCTV player built as an afterthought.
Proprietary Players
Proprietary players are notoriously problematic. They often require installation onto a computer. It is not known what exactly they are installing and if it will conflict with something else.
Even when a player does not need installation, the main problem is that the manufacturer is taking control of the evidence presentation. How it gets displayed, how it plays back, and what information it presents. The challenge with proprietary video players is an article in itself. But, although certain functions are often required to be used, they must be used with care.
A more modern challenge is the review and triage of video evidence after it has been transcoded by a Digital Evidence Management System. How that system changes the video, and then how it is being displayed within the interface, can be very different from the original.
We see evidence of these two challenges every day when images are published on social media, perhaps to trace persons located within CCTV or dashcam footage. Many of the poor images are not caused by the original system. The errors are caused by wrong acquisition and then subsequent poor processing of the file, followed by incorrect playback.
Putting those challenges aside, the following example shows an officer reviewing some video evidence after it was acquired and stored correctly.
Decisions can now be made on how to progress the investigation. Even if nothing is of interest, and no visual evidence can be found, the viewing of the video can easily be documented.
If several people need to view footage as part of a larger investigation, it is easy to annotate, bookmark, obtain still images, or create smaller files to support further evidence gathering or intelligence.
Process
Although the processing of CCTV and video evidence can often involve a lot of viewing, this is another subject entirely. This stage does, however, encompass the reporting of event chronology. Although not required in every investigation, viewing CCTV to document the actions of people or vehicles within it can be made easier by using the right applications. Linked heavily to this is the right environment. It would be difficult to complete a full chronology report on a small laptop in a noisy area.
Having a quiet room, controlled lighting, and large or multiple screens can ensure that video is viewed comfortably and correctly. Any accompanying text report can be completed professionally, along with frame-referenced images to supplement the information.
Review
Last, but by no means least in this article on viewing CCTV, we have the viewing of any produced presentation media. Many of the rules already discussed also apply here.
To view a certain key fact, does the viewer need to do something? If so, then it may be best to have the video re-processed and a new presentation exhibit created. You do not want a reviewing lawyer to resort to “zooming” in on their screen to try and see something better.
One of the many purposes of forensic video analysis is to ensure that interpolation, the adding of values to increase the visual data, is conducted in a controlled way. By reviewing any processed media before release or presentation, you can ensure that no uncontrolled user actions will affect the visual facts.
This last review stage is important for several other reasons. With automated transcoding, (the changing of files from one format to another), there must be a review to compare what changes have been made to the original video. This will establish if the visual facts have been maintained.
Also, does the processed video meet the requirements for the viewing environment? The courtroom is a good example here.
The video may have been suitable during the investigation. However, is it suitable to be presented on a screen in court? Viewing the footage before any court requirement will ensure that the facts can be clearly and accurately presented.
Summary
We have learned that there are four separate viewing stages.
- Assess: verify the validity of the video files
- Evaluate: identify the evidential worth of the video files
- Process: complete the tasks required, or answer the questions being asked of, the video files
- Review: an examination of processed video files
Each stage may be dealt with by one person, but may also be separate people. Whoever it is, it is important that the viewing is fully documented. This report should include the reason for the viewing, what was used, and then the next steps required.
With digital video being easily susceptible to changes and misinterpretation, the viewing of CCTV for legal purposes must be controlled.
The next blog in the CCTV acquisition series will be the last! We will look back at the series and also put together some ideas to assist you in CCTV acquisition. At a time when video evidence is relied upon so much, having dedicated, competent CCTV acquisition personnel has never been needed more.
