What is Video Forensics?

With the rapid proliferation of surveillance cameras in public and private places, law enforcement agencies and litigators are increasingly making use of these recordings as evidence. Fixed and mobile digital video recorders and other portable video recording CCTV systems are making it easier to capture crime scene video that may be used as evidence in court.

What is forensic video analysis?

What is video forensics? Forensic video analysis is the scientific examination, comparison, and/or evaluation of video in legal matters. SWGDE.org/Glossary. Although digital video cameras/recorders produce video evidence of high probative value, the evidence isn’t always accurate. This is where an individual that is properly trained in the specialized methodology and tools can assist the trier of fact with accurate, peer-reviewable, objective science.

THREE CATEGORIES OF VIDEO FORENSIC SCIENTISTS

TECHNICIAN

Intake of the evidence, copies and converts media, performs preliminary enhancements and other assessments.

ANALYST

Includes all technician skills, performs image comparison investigations, aspect ratio calibration, color correction, reverse projection, photogammetry, authentication, motion tracking, image authentication.

EXPERT WITNESS

Includes all technician and analyst skills, provides consultation with litigators, generates formalized reports, peer/technical review, formulating opinions, evidence recovery.

To learn more about the training guidelines as a video expert, the best practices agency SWGDE has specific documentation outlining minimum training requirements.

What types of devices create video evidence?

CCTV DVR (Closed Circuit Television Digital Video Recorder)
CCTV NVR (Closed Circuit Television Network Video Recorder)
MDVR (Mobile Digital Video Recorder)
Body Camera
Tazer Camera
Concealed Camera
Mobile Phone
Police Dash-cam

DIGITAL VIDEO FORMATS

Digital video evidence is most commonly created by passive and active recording systems. A passive recording system is a recording system that doesn’t store information in its memory system. An active recording system is a recording that stores information in its memory system. Active recording systems are most commonly produced with a digital storage medium such as a HDD, SSD or Volatile (flash) memory. Video recorders create digital video recordings in these types of formats:

Open source format

An open source format is a file format for storing digital data, defined by a published specification usually maintained by a standards organization, and which can be used and implemented by anyone.

Proprietary format

A proprietary format is a file format of a company, organization, or individual that contains data that is ordered and stored according to a particular encoding-scheme. This scheme is designed by the company or organization to be secret, such that the decoding and interpretation of this stored data is easily accomplished only with particular software or hardware that the company itself has developed. These formats are more common when video evidence is extracted directly from the system that created it, because they are a more secure and higher quality formatting. These proprietary formats also contain digital information like Meta Data and Telemetry Data that can assist a video forensic investigation.

Courtroom ready format

A copy of the video recording that is easily playable in a court of law using a computer, projection system, or large television. This digital format today should be tested on the system that it will be played through prior to presentation in court. Often times this format is deliverable in the form of a flash drive, DVD or Data Disc. Although the playable copy will be encoded in a common video format (MP4, AVI, WMV) it still may require a freeware player like VLC player or DVD playback software to advance frames as well as play or decode smoothly.

Acquisition of Video Evidence

It is often necessary for a forensic technician, analyst or video forensic expert to perform a digital video evidence recovery in order to secure the Digital Media Evidence and establish a chain of custody. DME (Digital Media Evidence) is defined by LEVA as “Information of probative value stored in binary form” (LEVA-2013). CCTV surveillance video recordings are the most common type of digital media evidence (DME). Once the recordings have been secured, an accurate chain of custody can be presented to the trier of fact. In addition, the forensic expert that acquired the video evidence can ensure that the highest quality versions of the recording are obtained so that a successful forensic video enhancement or forensic image comparison can be performed.

Most fixed and mobile Digital Video Recorder (DVR)-based surveillance systems employ proprietary computer operating systems and record digital video to proprietary formats. Under these circumstances, causing minimal degradation of picture quality during the process of recovering and trans-coding video files is a complex challenge for both law enforcement agencies and video forensic experts. There are a wide variety of surveillance system manufacturers and an even wider number of models of DVRs, which requires the video forensic expert to prepare ahead of time and acquire the appropriate tools necessary to recover the recording accurately and efficiently.

In addition, the video forensic expert must follow protocols set forth by the scientific community in order to ensure that the processes used for video evidence recovery are systematic and admissible in a court of law. Video Forensic Expert recommends that every video expert prepare a forensic recovery kit that would include I/O cabling, storage mediums in varying sizes, a cloning device, video camera equipment, write blocker, evidence bags in order to be prepared for the various recovery situations from the various CCTV digital video and mobile video recorders.

Creating a disc image (clone) of the DVR’s hard drive is the most common first step in the evidence recovery protocol to protect the probative information stored in the system’s volatile and non-volatile memory. The technician must understand the file system structure on the primary and slave drive before performing a disc image or forensic clone.

FORENSIC VIDEO ANALYSIS INVESTIGATIONS

Video Comparison

The Forensic Image Comparison investigation is the process of comparing digital images, or digital images extracted from video recordings to determine the probability that the people or objects depicted in these images are the same or different. The Forensic Image Comparison investigation is most accurate when the images or videos are of sufficient quality, and they meet the forensic comparison criteria. It is considered that the most prolific source of evidence for police investigations are from video recordings. Video Forensics tells us that all video recordings are not an accurate medium because digital compression removes information and adds information that wasn’t originally included. It is because of these reasons that a Video Forensic Expert MUST be able to interpret the images and video recording in order to present the events as they occurred and compare these and analyze the results. Because of the unreliability of images and video presented as evidence, a Video Forensic Expert MUST also be able to qualify the events to ensure that the people or objects presented has sufficient detail and pixel information for an accurate forensic image comparison investigation. In some cases, when the objects or people displayed are not clear, we perform a forensic video enhancement in order to see the details of the images more clearly for an accurate comparison.

Video Clarification (Enhancement)

Forensic enhancement and analysis tools include software and hardware that are implemented and used on a powerful desktop computer. Methods applied to this scientific examination must be executed in a systematic and accurate nature. Our video forensics service is sought after by law enforcement agencies, attorney’s, government agencies and private clients. Opinions and conclusions drawn by the video forensic expert MUST follow best practices. A forensic report is created on completion that exhibits all activity performed in the lab as well as forensic processes performed. That way, any other qualified video forensic expert can follow our steps multiple times and establish the same conclusions and opinions. Our video forensic processes and executed with the utmost accuracy as we testify in court on our opinions and conclusions.

Video Authentication

Forensic video analysis and authentication is the scientific processes performed by a trained video forensic expert in order to determine events that occurred at the time of the video recording. CCTV cameras do not see the same as the human eye. Some of the video recordings we examine in our lab have been altered either with malice or unintentionally using processes that alter the integrity of the evidence. As video forensic experts we help our client attorneys understand any anomalies in the video recording we are asked to analyze and perform several scientific tests to determine the nature of any anomalies.

HOW VIDEO FORENSICS IS USED IN COURT

Video footage that has been examined and enhanced by a video forensic scientist may be submitted as evidence during a trial. Litigators consult with the expert witness, who provides formal reports on the video analysis and may testify during the court proceedings. An expert witness must help the trier of fact, whether a jury or judge, understand the video evidence.

Reports and testimony include details such as: