Imagine the following scenario:
You're the first responding officer to a crime scene and have just completed taking the victim's statement. You then tell the victim you have to leave for another call. Before you go you politely ask the victim to take photos of the scene and their injuries, collect all of the DNA and fingerprint evidence, and note that you'll either be back later in the day or maybe tomorrow or the next day to pick it all up. You note that they can just leave the evidence at the front desk for you.

This is exactly how many agencies have chosen to deal with the overwhelming amount of DCCTV evidence available to them today. "Oh, there's video? Okay, have someone export it and we'll come back to pick it up."

This brief (approx. 9min.) introduction into the world of digital video evidence is intended to provide law enforcement professionals with a better understanding of the basic concepts and related issues.  It was geared towards first responders, who in many cases are the ones initially seizing video evidence.

It’s sometimes difficult for traditional Computer Forensic (CF) examiners to understand why they should treat video and multimedia any differently than other types of digital evidence. After all, a bit is a bit, and a byte is a byte. Right? CF examiners are typically highly trained and highly technical people. If anyone is going to understand how to recover and interpret multimedia data, one would think that a traditional CF examiner would be at or near the top of your go-to list. The problem with this assumption is that multimedia data is fundamentally different than most other types of data, and in more than one way.

I was out in Tacoma, WA last week to teach our DVR Assessment & Video Recovery course, and to provide a free seminar on Digital & Multimedia Evidence for area prosecutors, law enforcement and support staff. It was a really great class, and as always the group discussions during both the class and the seminar were really interesting and informative. Thank you to everyone who attended for their participation, and many thanks to Kim, Chris, and the entire Tacoma Police Department for being such amazing hosts.

If you missed the free seminar, we’ll be back out that way to provide it again on July 8th at the Washington State Criminal Justice Training Center, in cooperation with the Washington State Homicide Investigators Association (WHIA).

If you’re interested in our DVR Assessment & Video Recovery training course, check out our upcoming training dates and locations or contact us to inquire about hosting one of our training events.

Thanks again everyone. Be safe out there my friends!

* Updated with Corrected Images & Explanations. 

After the break you'll find several images of a bogus Person of Interest (PoI) that were recorded by a DCCTV system. Two different analog CCTV cameras with built-in IR illuminators were connected to the black-box, h.264 DVR. These JPG images were exported from the DVR’s proprietary player. All of these images exported at 704 pixels by 480 pixels. When the recorded video is played back via the proprietary player it is displayed at 630 x 455; however, analysis of the proprietary file and exported AVI files reveals both of those contain a 704 x 480 video stream.

Your task, should you choose to accept it, is to:

• Describe the PoI’s clothing items from these images as you would for producing a BOLO. Note any issues that may affect your description.
• Identify the single most important correction that should be made to these images prior to printing. (BONUS - Why does this correction need to be made, and what tipped you off to it?)

If you’ve taken one of my recovery classes or attended one of my presentations on the topic at a LEVA conference or other event, you may have seen these examples.

Last week I was back in Albany, NY to provide a free seminar on digital video evidence at the New York State Police Academy, followed by Ocean Systems 3-day DVR Assessment & Video Recovery training course. It was a sold-out class comprised of both students new to the field, as well as very seasoned digital and video evidence technicians and analysts. The end result was a really great week of training and peer networking. Many thanks to all of those who attended, and special thanks to the New York State Police (NYSP) for hosting both events!

The NYSP had a new academy class under way as well, with approximately 250 new recruits marching to-and-from the various classrooms within their renovated facilities. It was very cool to see so much activity at the academy again throughout the entire week. Best of luck to all the recruits in training. Hang in there and regardless of the outcome, thanks for stepping up to the plate!

Let me start by saying that I am by no means trying to imply that DVR, NVR or any other digital or IP based video system cannot produce good quality video evidence. There are even 2 or 3 high-end, mega-pixel quality digital surveillance cameras and systems on the market today whose capabilities far exceed those of a traditional analog based system. However, to my point, it seems more often than not digital based systems are producing very poor quality video evidence regardless of the system's actual capabilities.

So why do DVRs typically provide poor quality video evidence? Here are a few of the common reasons:

Ocean Systems just announced that the Anaheim Police Department will be hosting our DVR Assessment & Video Recovery training course September 16th - 18th in Anaheim, CA. Seats have been filling up fast in our DCCTV Recovery classes, with next month's class at the New York State Police Academy already sold out!

If your agency is looking to standardize your video evidence recoveries based on industry best practices, and you'd like hands-on training for those officers collecting your video evidence out in the field, get a quote from us today and then reserve your seat! Hope to see you in class soon. Be safe out there my friends.

Those who have been recovering video evidence from CCTV systems for any length of time know that every case starts as a research project. In some cases DCCTV evidence is submitted with little or no information about the recording device. In other cases the entire device may be submitted, but more often than not it’s submitted without any manuals or documentation.

Magnet Forensics launched the evolution of DVR Examiner today, Magnet WITNESS.  WITNESS includes all of the capabilities of DVR Examiner plus many new features, essentially creating a single solution to acquire, review, analyze and report on all of the video evidence from your case, regardless of source.  Proprietary DCCTV systems and files, cloud CCTV sources such as Ring & Arlo, MP4 & AVI exports from other sources such as in-car and body worn systems.

Unlike DVR Examiner, WITNESS includes the ability to create sub-clips, create synchronized previews, convert proprietary DCCTV files and more.  Learn more at https://www.magnetforensics.com/products/magnet-witness/

"Who designed this user interface, Stevie Wonder?" Actual statement from a LE technician and point well taken when it comes to proprietary DCCTV players. They're often horribly designed, and like all multimedia players/editors/tools regardless of who makes them, they are time & resource dependent (e.g. hardware resources, drivers, frameworks, codecs, etc.).

The Technical Support Working Group (TSWG) recently made their flip-book "Best Practices for the Retrieval of Video Evidence from DCCTV Systems" available electronically as a PDF file.  Visit the URL below to access the PDF and other TSWG resources:

http://www.tswg.gov/subgroups/isf/electronic-evidence/products.html