Video evidence can make or break your investigation. CCTV, smartphone footage and proprietary formats, however, often create playback, acquisition, quality and disclosure risks. Learn how you can review footage, detect key events, create viewing logs, export evidential clips and redact sensitive content safely with Amped Replay, even without specialist forensic video expertise, under tight deadlines.
Hello everyone and welcome to a dedicated article on workflows, pitfalls and best practices associated with video evidence investigations.
We live in a time where digital multimedia evidence is finally starting to get the attention and scrutiny it deserves. During recurring visits to Police establishments and headquarters, we see more and more proper procedures, equipment and validation methods in place for the handling of video evidence. Not only in forensic video labs but also in places where regular Police officers and investigators carry out their daily job.
Conversely, defence law firms are now starting to more regularly challenge some key aspects of video evidence handling, such as acquisition, processing and analysis, to ensure the course of justice is duly served.
Key Takeaways
- Video evidence investigations start before playback. You need to acquire footage correctly to preserve quality, metadata, timing information and evidential integrity.
- Original footage matters. Working from verified copies of CCTV or source video helps you avoid quality loss, incorrect aspect ratio, timing errors and other issues introduced by conversions or DEMS exports.
- Proprietary CCTV formats can raise serious workflow issues. With Amped Replay, you can drag and drop proprietary video files and review them in a playable, forensically safe format.
- Motion detection helps you review long footage faster. You can identify relevant movement in lengthy CCTV recordings without manually watching every uneventful section frame by frame.
- Viewing logs should be accurate, clear and defensible. Amped Replay lets you bookmark key frames, add comments and generate a structured PDF report without compromising image quality or aspect ratio.
- Poor frame export can reduce the chances of identifying a suspect. You can use Amped Replay to find the best frame, clarify the image, annotate key details and export it safely for appeals or case files.
- Evidential video clips must remain authentic and compatible. Replay allows you to export relevant footage as a high-quality MP4 while maintaining a clear audit trail of the processing applied.
- Video redaction requires both speed and accountability. Assisted Redaction helps you obscure people, heads, vehicles, license plates or sensitive audio while keeping the human reviewer in control.
- Reports support transparency and disclosure. Amped Replay can document bookmarks, redactions, processing steps, file information and hash values to help you produce court-ready material.
- You do not need to be a forensic video expert to handle urgent video evidence safely. With the right workflow and tools, you can review, enhance, annotate, redact and export video evidence quickly.
Investigating Video Evidence with Amped Replay
The problem that remains, though, is that more than ever we need officers and investigators to review CCTV, or other video evidence, at the early stages of an investigation, as this is the stage where evidence needs to be turned around quickly.
As laborious as it may sound, gathered video material needs to be watched in full to first establish the presence of any evidence (if at all present!) and then assess the gravity of a potential offence, identify suspects, witnesses, modus operandi etc. This may happen during working hours or during weekends, or late at night or early in the morning, when video specialists are nowhere to be found.
- So how can an untrained officer deal with proprietary CCTV that is very problematic to play back, for example?
- How can he or she produce still images showing the crime and/or the suspect without a detrimental quality loss so that the prosecution can formally charge the perpetrator?
- How do they redact sensitive video or audio material and do so quickly and easily?
- And, how do they comply with current regulations they know very little about and produce a court-ready viewing log or report?
The solution we, at Amped Software, have provided for all these challenges is called Amped Replay. This is effectively a forensic video player, built with non-technical users in mind, for the purposes of aiding all the main aspects of video investigations, easily and safely.
In this article, we’ll talk about some of the most recurring workflows and challenges you’ll likely come across and how to deal with them effectively.
But before we jump through loops too much, it is important to understand that a video investigation starts well before you sit at your desk with the video in your possession.
Acquisition of Digital Multimedia Evidence
How the evidence is first acquired from the crime scene or from the device that recorded the video is probably the most crucial stage of a video investigation. And, unfortunately, it is also the part where things are most likely to go wrong.
Why? Because we have little control over how it is done and who does it. Most CCTV footage is downloaded from the DVR by the system’s owner. He/she may be familiar with how to review or playback the footage on site but may, and probably will, know nothing about the best export quality or options to use.
It gets even worse for video acquired from smartphones or portable devices, which of course, in this day and age, are probably the most predominant source of video and audio evidence used in criminal investigations. It is not uncommon for Police forces to use online portals to which witnesses or victims of crime can upload their smartphone videos for immediate access by the officer in the case. Although this is an incredibly convenient and fast method of sending digital evidence to the authorities, the issue is that the media received at the other end is very rarely the same as that recorded by the source device.
The video may have been downscaled or re-compressed in transit. Even if the visual quality was preserved, the process may have stripped crucial metadata, such as time/date of recording and GPS co-ordinates, which of course can be essential bits of information for an investigation. This may not seem to be a great deal for a great number of cases, but imagine if the video is key to a murder case where the identity of the suspect is crucial. Every available pixel of the video can be the difference between a guilty or not guilty verdict.
And what about the Police using DEMS (digital asset management systems) for the storing of evidence? Even these solutions can introduce significant breaches in the integrity of the evidence. Most DEMS are designed with data security and ease of access in mind. Very few of them can ensure the preservation of media integrity, especially when a piece of proprietary video needs conversion before it can be played back. Some support the playback of these videos, but may introduce technical issues such as wrong aspect ratio, de-multiplexing errors and timing inconsistencies. One typical example of the latter is the flattening of frame rate variability, which can cause major issues with timing and speed analysis of video.
This is just a taste of some of the issues caused by an inappropriate acquisition of video evidence. Luckily for you, we have an entire blog series dedicated to the acquisition of CCTV evidence, which we really encourage you to take a look at if you wish to find out more about risks, problems and solutions.
The Viewing Stage
Once we have the evidence stored on physical media or electronically, we need to play it back and, well, watch it! The actual watching of CCTV is a formal process, where a Police officer and investigator need to take notes on any meaningful events spotted in the video evidence and supply a chronology in evidential format. Even if the evidence does not contain any meaningful events, the task needs to be formally recorded. Imagine if something important is missed at this stage and later on found by the other side. That officer could get into a big deal of trouble. To complicate matters, the footage may not play on a standard computer. It may need specific playback software because the CCTV is proprietary.
This is a nightmare for officers who are not video-trained. We can help because most of our products feature a conversion engine known as Amped Engine. It automatically detects the CCTV format and variant, then converts the footage into a format that is not only playable, but also authentic to the original. We spend a lot of intellectual resources to make the video loading process (also known as decoding) as easy and as forensically safe as possible for you.
In Amped Replay, the loading of video, proprietary or not, is as simple as a drag and drop from its current location in Windows Explorer to the program interface. In the background, the video is first analyzed by the Amped Engine, and if needed, converted to an MKV open format, using a process known as stream copying. This ensures that the pixels, the smallest elements of a digital video, remain unchanged from the original. It also preserves the original timing references, such as timestamps and average frame rate, in the converted counterpart. The process is designed to be forensically safe, releasing you from the burden of decoding and converting digital video material manually.
In the example above, we have a DV4 proprietary video. Using the proprietary player (if we even have it!!) may not be possible or suitable for the tasks required. The issue of exporting the footage would also remain. Can the player export video in the common MP4 or MOV formats? If so, can it do it without further compression or loss? Does it retain the frame rate? Does it rescale (or downsize!!!) the video?
In Replay, we can bypass the player and simply drag the DV4 file into the program. We can see the file has been converted in the background and we can also see a timestamp has been extracted by the Amped Engine. Replay automatically selects the timing reference calculated by the timestamps as the default playback speed. You just have to press the play button and watch the video exactly as it was before conversion and at the correct playback speed.
Motion Detection
Ok, so we have the video playing. However, it is very long and we need to watch it to find evidence that a crime has been committed. First of all, we need to understand why the video is long. It is not uncommon for raw and original CCTV footage (downloaded directly from a DVR) to be split into one-hour chunks or even longer. This is especially common when the cameras do not have motion sensors. A lot of the footage is not going to be relevant to our investigation. But, it is still better to work with the original (as previously explained) than with a derivative, even if that derivative is topped and tailed to only show the event(s) of interest.
You have motion detection at your disposal in Replay to facilitate the finding of the evidential portions of the video. This tool is designed to find motion of relevance in a video. It is developed in such a way that you can filter out most false positives without missing anything important. A detailed explanation of how motion detection works in Replay and how to use it can be found in a dedicated blog article.
Creating a Basic Viewing Log
Once we have found meaningful events in the video, it makes sense to illustrate them as still images in an electronic document format for disclosure. This is known in policing as a viewing log. It is the tangible result of the hours and hours of video or CCTV watching endured by an officer or investigator in an effort to produce case evidence. It makes more sense to produce a viewing log, which effectively is a chronology of video frames of interest with side commentary, than to actually produce a video compilation.
It is easier and quicker to disseminate, electronically or in printed format and does not require the use of video playback equipment and applications in court or in barristers’ laptops (a lot of them use Apple Mac-based systems!). The issue lies with how a viewing log is actually created. We have seen CCTV viewing logs produced with the likes of Microsoft Word or Powerpoint containing tables or slides.
Ok, so far right? But the video frames were usually captured with freeware desktop snapshot tools (such as the Windows Snipping tool and the like). Then, they were dragged onto the said Microsoft Office applications. Resizing the images to fit into tables and slides often resulted in quality and aspect ratio being compromised. This normally happens because users are not video-trained. So, such issues are not even taken into account when producing what appears to be a completely safe piece of documentation.
Generate a Viewing Log with Amped Replay
This is where a program like Amped Replay can assist and minimize the risk of compromising imagery evidence. The creation of viewing logs is easy, intuitive and forensically safe. Once you have your video loaded, you can navigate to frames of interest, either located by you or by the motion detection tool and add bookmarks to register them into your chronology. When you have added bookmarks, you can edit their description and add a comment to explain what that frame portrays, as in the example below.
All the bookmarks you have added will be clearly visible in the timeline. You can quickly access them by clicking on the bookmark navigation buttons. You can also easily delete bookmarks and add more. It is that simple!
If you wish to continue viewing or adding bookmarks at a later stage, all you need to do is close the program. There is no need to save any projects or find export functions in a rush. Replay is designed to remember all the work you do, with all processes automatically stored. They are then available for further usage from the Recent tab when you run a new instance of the program.
When you have completed your viewing and added your bookmarks, you can export them all at once as digital images or as part of a fully compliant forensic report. Replay features an Export tab, which offers the most appropriate output format for your evidence. As we are producing a viewing log, we will simply click on the Generate Report button. The viewing log is printed in PDF format, featuring case and system information on page 1 as well as input file information. This page also contains an automatically generated hash value that can be used to verify media integrity. The remainder of the report is basically your viewing log, illustrating all your bookmarks in chronological order and corresponding commentary. The images are automatically resized to best fit the page and there is no risk of changing aspect ratio, quality etc.
Caught on Camera!
One of the tasks related to CCTV or video evidence occurring regularly in Police stations is the capture of a frame showing a suspect in need of identification with help from the public. This needs to happen very quickly during the early stages of an investigation. The more time that passes before identification, the more likely it is that the suspect will escape the course of justice. We have seen plenty of media appeals on Police websites or social media pages where the image of the suspect is “blurry” or “distorted”. In many cases, the image is simply not good enough for a member of the public to recognize the person. Not surprisingly, the main reason for this is the inadequate method used to capture and export a frame from the proprietary CCTV.
Another recurring issue is that the footage being worked from is not the original but a DEMS derivative, usually a converted video. Replay gives you the advantage of easily working with a direct copy of the original, even if it is proprietary, so it is recommended to work with the raw video. Most DEMS will have these stored somewhere on their servers.
An application such as Amped Replay is designed exactly for these types of challenges in mind. Immediately after opening and playing the proprietary video file, you can then clarify, annotate, and export a frame of the suspect in a forensically safe manner. In the example of the poorly handled image above, all we have to do is follow the workflow order of the buttons located at the top of the program. This allows us to obtain a clearer image of the suspect taken from a problematic and proprietary CCTV video format.
- Load the video (by dragging & dropping the proprietary file or by using the Recent or Import tabs)
- Find the best frame (by using the navigation buttons or motion detection tool in the Play tab)
- Restore previous processing issues and enhance the image (with the Enhance tab)
- Annotate the suspect (by using an appropriate object in the Annotate tab)
- Export the image (by using the Export Current Image button in the Export tab)
We now certainly have a much better chance of identifying this bad guy. This is because the crucial aspects of video decoding, processing, and export have been handled in a forensically safe manner, without needing to be a forensic expert.
Preparing an Evidential Video for the Case File
Another task carried out in-house by most Police forces is the production of video clips or compilations containing the sequence of significant events exported in a compatible video format (usually MP4 h264). This product is intended for the prosecution team to review what happened, and when possible (and in the public interest), to formally charge the suspect with the alleged crime. This is the stage when an investigation formally turns into a court case. When there is a variety of multiple video sources and other editorial elements to include (such as maps, graphics, multi-views etc), then video editing skills are usually required.
Most Police forces have dedicated video units to carry out this type of work in-house. But, we are usually talking about a small number of people taking care of an entire county or region. When the work is overwhelming, the services of an external company may be employed (at a dear cost!). However, when all we need is one short clip from a single camera view blatantly showing a suspect committing a crime, we can do it ourselves. A program like Amped Replay makes this process easy to manage. It is designed to produce forensic video evidence quickly and safely. In our recurring example, we are working with a proprietary video that has no associated playback application. To process it, all we have to do is drag and drop it into the program. Then, we follow a few simple steps:
- Select the relevant portion of the clip by using the Start Range and End Range buttons
- Switch to the Export tab
- Select the option “Export Processed Video as MP4”
Done!
This will be an MP4-contained video file, and compressed using a high-quality H. 264 clean codec. It is going to be fully compatible with all off-the-shelf laptop or desktop PCs or Macs. No more headaches caused by unplayable video before entering the courtroom.
Of course, in between the Play and Export stages, you can still use the Enhance, Redact (discussed next), and Annotate tab if necessary. These allow you to make further redactions or clarifications to your evidential video before export. And you can still produce a disclosable report auditing all the processes you applied to your video. In the Enhance tab, there are also filters designed to automatically detect and correct technical issues associated with proprietary video, such as aspect ratio and interlacing. Not dealing with these issues can severely compromise the authenticity of the evidence. An incorrect aspect ratio, for example, would make persons or vehicles appear slimmer, fatter, longer or shorter than their real counterparts. Remember that preserving the authenticity of the digital evidence is a legal court requirement!
Redacting Video and Audio
The topic of video and audio redaction is another one that makes police officers and investigators shiver. It is usually their responsibility to ensure that no sensitive content or unrelated content is disclosed either to the courts or to the press/public. One identifiable face of a child left visible in a video exhibit or a piece of audio containing the witness’ telephone number being heard in court, is enough to basically put them in a great deal of bother. Yet, historically, the task involved the use of video and audio processing or editing applications that only “experts” can use.
The more common solution nowadays is software that can automatically identify people or vehicles in videos and redact them. This makes the process extremely easy and time-efficient, even for “non-experts”. The issue is that these solutions use artificial intelligence to allow automation, which is still a methodology the criminal justice system does not yet fully trust. And quite rightly so! Let’s face it, machines are now intelligent but can make mistakes, just like us humans. Yet, we cannot hold a machine responsible for making such mistakes. This is why, at Amped Software, we have developed a feature in Amped Replay called Assisted Redaction. It uses a machine learning model to identify, follow and redact people, heads, vehicles and license plates in moving footage. It also allows for easy adjustments if the model misses something or makes some occasional mistakes.
The idea behind this concept is that the machine learning model carries out most of the tedious work and does so very quickly. And you act as a peer reviewer, making quick and easy adjustments and corrections and signing off the final product. Furthermore, Amped Replay is the only product that produces a disclosable report containing details of all the redactions applied to the video. The report also clearly states whether any or all of the redactions were processed using the machine learning model. The transparency and amount of detail inherent in the report are likely to be key to making the assisted redaction workflow compliant with the current regulations. This is especially important regarding the use of artificial intelligence in policing and law enforcement.
Watch this space! If you are interested in finding out more details on how Assisted Redaction works in Replay, go and have a look at the dedicated article in this blog right now!
Although there is no equivalent machine learning model employed in the redaction of audio in Replay, the process remains extremely easy. Removing unwanted or sensitive speech is designed to be accessible to all types of users. We have another dedicated blog article on the audio redaction tool you can read right now. It contains all the information you need to get redacting audio immediately!
Where to Go from Here
So far, we discussed the main workflows you are likely to encounter during your video investigations. As you can see, you now have the tools to produce sound evidence without being an expert in digital video. But there are many other effective ways of presenting video evidence, which you can explore in time. For example, in Replay, you can combine two different imagery sources by using the Image filter in the Annotate tab.
- Load a video (or an image).
- Pick the best frame for comparison.
- Navigate to the Annotate tab, select the Image filter and load the comparative image.
- Click and Drag on the Viewer to draw the image next to the main video (above, under, left or right).
- Click on the Options button and select “Extend Canvas”.
Another, more advanced workflow, yet very powerful, involves the creation of a viewing log (or a digital photo album) containing a mixture of enhanced, redacted and annotated bookmarks. Replay now gives you the ability to select what type of bookmarks to add to your log or to export. This means you can therefore produce an impactful evidence bundle using the program’s combined features and tools.
For example, let’s go back to our video of the car robbery. We previously produced bookmarks containing only unprocessed frames. However, we can also add enhancements (light, sharpening etc), redactions (for instance, to hide the face of witnesses) and annotations (such as magnifications, arrows and text labels). To do this, select the relevant tab from the Bookmarks & Descriptions panel, as shown below.
Now we can go to the Export tab and generate an album of images by selecting the option “Export All Bookmarks” or a viewing log by selecting the option “Generate Report”.
Conclusions
We come to the end of this dedicated article on Investigating Video Evidence. We hope it has given you some food for thought regarding the pitfalls, risks and challenges of dealing with video in a forensic setting. But at the same time, we hope you are now also reassured that there are tools available, such as Amped Replay, to safeguard you from any technical issues and speed up your workflow.
Replay is the main tool used during our Investigating Video Evidence training course. The content of the curriculum is targeted towards those users having to deal with CCTV and video evidence early in an investigation. Therefore, the application is an ideal match.
The use of Replay is already well integrated within the IT network of large law enforcement organizations worldwide. This means that every Police officer and investigator in that organization can access the program from any available computer on the network. They can then resolve urgent video investigations or appeals in minutes, safely and easily.
If you would like more information about Amped Replay and how it can assist you and your organization, get in touch with us and we will be happy to discuss your requirements and offer immediate solutions.
FAQ – How to Investigate Video Evidence
Proper acquisition is critical because mistakes can affect the whole investigation. If footage is downscaled, recompressed or converted incorrectly, you may lose image quality, metadata, timing information or GPS data that could be essential to understanding what happened.
You should work from the original data because transcoded or poorly converted copies may introduce compression, timing errors, incorrect aspect ratio or playback issues. Using the source data helps you preserve authenticity and gives you the best available evidence for review, clarification, export and disclosure.
Amped Replay lets you drag and drop proprietary or standard video files into the software. The footage is analyzed. When needed, it is converted into a playable format while preserving pixels and timing references as safely as possible. So, you can review video evidence without specialist forensic video knowledge.
A CCTV viewing log is a chronological record of important events found in video evidence. It usually includes still frames, timestamps, descriptions and comments. You can use it to document what you reviewed, what you found and how the footage supports the investigation.
Motion detection helps you locate relevant movement in lengthy CCTV recordings more efficiently. Instead of manually watching hours of uneventful footage, you can identify sections that may contain suspects, vehicles, witnesses or other investigative activity.
Video redaction is the process of obscuring sensitive or unrelated visual information before footage is disclosed, shared in court or released publicly. You may need to redact faces, heads, vehicles, license plates or other identifiable details to protect privacy and comply with regulations.
You can create an evidential video clip by selecting the relevant start and end points. You can do so by applying any necessary clarification, annotation or redaction, and exporting the clip in a compatible format such as MP4. The workflow should also preserve a record of the processing applied.
Yes, Replay projects can be opened directly inside the forensic image and video application, Amped FIVE. This allows processing to be checked and reviewed, or for more advanced work to be completed.