October 7, 2025
A murder, a USB of mixed videos, and the timings are all wrong. Part One of the forensic video workflow opens the case in Amped FIVE. The first step is about creating the project, preserving the integrity of video evidence, and sizing up the file pitfalls so every next step rests on trusted evidence.
In this blog series, I’ll walk you through a full Amped FIVE case workflow from beginning to end. I’ll demonstrate how FIVE can help with the complexities of various types of digital media evidence, from drones, body worn video, to mobile phone footage.
Criminal investigations, from petty thefts to the most serious and organised crimes, now rely on video evidence in all different shapes and sizes. With the rise of body worn video and digital video surveillance, video has never been more important and demanding to work with in a forensic way. Nowadays, most witnesses, victims and suspects have a camera phone in their pocket at the very least, making the demand for effective video analysis even greater. Our previous blog series on acquisition and enhanced reflections offer even deeper commentary and insights on this very issue and more.
By the end of this series, you’ll see the full FIVE workflow from start to finish with various file types in an investigation case-building scenario. It may surprise you to find out that enhancement will not be our primary focus throughout this case!
In the first part of this series, I’m going to be showing the very beginning of the case. I’ll demonstrate how I use FIVE with the creation of the project file from the get-go, to the initial examination of the media files prior to an in-depth analysis. This will include:
- Using Copy and Verify
- Initial file analysis using Advanced File Info
- Format and codec consideration
- Timestamp considerations
An initial setup of the case and examination of the files will help to plan my workflow and determine any limitations I need to consider.
Right, let’s set the scene first! There’s been a murder and the victim was found dead in his home. A potential suspect has been identified, and a manhunt ensues before he is apprehended. Now safely in custody, a case must be built for the court.
I’m the video analyst in this case and I’ve been tasked with dealing with video evidence from body worn video to drone footage. In this series, you’re working alongside me. We’ll look at this case from start to finish, addressing all the common considerations and limitations from acquisition to presentation.
I’ve been handed a USB drive labeled with the operation name. The evidence includes body worn footage that has been downloaded, dashcam footage, police drone footage and a WhatsApp video a member of the public has emailed the officer. It’s now my job to handle this video evidence, perform analysis where necessary and present this evidence alongside a report. Where do I begin?! With the Copy and Verify utility, of course.
Copy and Verify
Here, I’ve created my case folder on the forensic workstation and have been able to use Copy and Verify to hash the contents of the folder. I can now show the file integrity from the moment I received these files. A large number of times, this is the reality of dealing with video evidence, with files losing their integrity due to incorrect handling or capture.
Format and Codec Considerations
Having created my project in FIVE, I’ve loaded in my files and I’m going to first identify any immediate concerns.
In this case, the types of evidence I have are:
- Body worn video: this is from the moment an undercover officer arrests our suspect;
- Drone footage: this is police drone footage showing the suspect during the manhunt;
- Mobile phone footage: this footage was recorded by a member of the public who saw the suspect fleeing the scene before dumping the murder weapon;
- Dashcam footage: this captures the suspect running past a parked vehicle not far from the scene;
- GoPro footage: this was captured by a cyclist who witnessed the suspect running with a bag, now known to contain the murder weapon;
- CCTV from a premises: this was recovered from outside the scene, an apartment building.
So quite an eclectic but not unusual mix of media types. Each will have to be considered individually prior to creating a timeline presentation of the events. You know as well as I do that this is not an exhaustive list of types of media that can be involved in a case!
Luckily, none of our files require any conversions at this point. It seems all our video streams appear to be standard codecs; in fact, all of them are H264. At least that’s one thing we don’t need to worry about for the time being.
Timestamp Considerations
The next step, now that I’ve hashed my files and my project and case folders are ready to go, is to consider timings and any immediate issues within the files. We know the suspect was arrested at around 14:00 on the 11th June 2025, and the incident happened a couple of hours before this. Do we know if any time checks were performed prior to the retrieval of the video files? No, this is another issue we need to document and be aware of, should this be questioned later on.
The body worn video from the undercover officer who made the arrest already shows a time discrepancy. The displayed timestamp indicates both the wrong date and the wrong time.
The colours on this file seem to be off, too, at the start of the clip. We may need to redact certain elements of the audio here to protect the identity of the officer.
The CCTV footage from the apartment also shows no timestamp, nor does the GoPro or mobile phone footage.
The dashcam footage is helpfully showing a date stamp from 2015!
I’m going to really have to look elsewhere for file timings and document these file issues. Bookmarking and reporting will be crucial in this project to help prove that I’ve maintained file integrity to the best of my ability, regardless of how the files were originally retrieved.
The drone sent up by the police during the manhunt does helpfully have an SRT file containing the flight information. We can import it straightaway alongside the file and we now see the data, including GPS co-ordinates, presented on our drone footage.
This could be helpful when creating a presentation for court, if we can integrate map data too.
Some of our other files, such as the dashcam, the GoPro from the cyclist and mobile phone footage, also include audio streams. We’ll need to check these for any further redaction requirements or any audio/video sync issues that might cause issues further on in our workflow.
So, we’ve collated our video files together, hashed our files, created our project and identified a few issues early on. What’s next? We’ll need to check our file timings so we can create a timeline showing the events of the day unfolding later on.
Here’s our project so far with the history panel highlighted:
I’ve organised the chains into two folders, one for police generated footage and another for witness-generated footage, to help me keep everything tidy and assist with redaction considerations during the presentation stage. I’ve added the hash code for each file under its individual chain, generated using both the Hash Code filter and the File Info filter. Both filters will add valuable hash and file information to my report when I come to produce it. The more you make life easier with steps like this, the better when you’re under pressure within a live case!
Final Note
Now our case is set up for the more in-depth analysis stage and we’re familiar with our files. It’s important to know what you’re dealing with to help avoid any surprises when you come to do another step in your forensic video workflow, which will help take the pressure off when the pressure is on!
In the next post, I’ll be looking at the file format analysis for each of these files in more detail. I will also discuss bookmarking and preparing our footage for the presentation stage. Stay tuned for the next post.