Chapter 18. Discovery of Video Evidence
Information in this chapter:
• Common issues with video evidence
• Collecting video evidence
• Example discovery language for video evidence
Whenever you must deal with video evidence, in any format, you will want to attempt to have the evidence properly preserved by specifying early on that the evidence is not to be viewed on the original media. Taking immediate steps to issue a preservation order for the evidence and specifying that the evidence is to be properly handled, preserved, and copied are critical elements in having evidence that can be used in litigation.
Keywords
Tape Media, Time Verification, Compression Ratios, Video Recording Devices, Collection methods.
Introduction
Video evidence is one of the more difficult types of evidence to deal with in cases. It is hard to collect, and in many cases is improperly collected and mishandled. Video sources vary widely in their recording quality, and in many cases the cameras used to record video are poorly focused, have lights shining directly into the camera, or are at an improper angle to record properly.
Whenever you must deal with video evidence, in any format, you will want to attempt to have the evidence properly preserved by specifying early on that the evidence is not to be viewed on the original media. Taking immediate steps to issue a preservation order for the evidence and specifying that the evidence is to be properly handled, preserved, and copied are critical elements in having evidence that can be used in litigation.
The greatest issue dealing with video evidence is not actually getting the evidence itself, but the manner in which it is obtained. It is often the case that by the time an attorney receives video evidence, video recording has been damaged in some way through mishandling or repeated viewing of the original media.
18.1. Common issues with video evidence
Many issues involving the collection and preservation of video evidence can have a major impact on the quality of the collected evidence, the ability to authenticate the evidence, and whether the video can be enhanced for use in a case. Depending on the type of recording media, recording device, and the settings for the recording device, the quality of a video recording can vary widely. In addition, collecting and preserving video evidence incorrectly can reduce its value a great deal.
18.1.1. Collecting and preserving tape media
With a VHS videotape, every time the video is viewed, the quality of that tape deteriorates. Unlike a digital video recording, a VHS tape is mechanical, with the tape running over spools, and the tape degrades as it plays, rewinds, fast forwards, and pauses. Usually with video evidence, only a small portion of the entire video is of interest. Let’s say, for example, that there is a one-hour VHS video tape that contains the footage of a supposed wrongful death incident, and the incident lasts only a matter of seconds. If someone reviews that footage of interest numerous times by watching it, rewinding the tape, and pausing throughout, that section of the VHS tape that is of interest can be degraded significantly or destroyed completely. If no effort to preserve the original was made, by working from duplicates or making a digital copy for instance, then by the time your video forensics expert gets his hands on the VHS tape for examination, it could be beyond help because the timeframe of interest in the footage has been degraded to the point that no enhancement can be performed.
18.1.2. Video recording devices
Video recording devices come in many shapes and sizes from systems that still use analog VHS tapes to systems that are fully digital and record directly to a hard drive in the Digital Video Recorder (DVR) unit. The type of recording device will determine what kind of video recording is being performed and how that video must be collected.
18.1.2.1. Collecting video from multiplex systems
Multiplexing involves using one screen to display the video recording from multiple cameras at once, with one camera having a large view, while the other cameras in the system are shown in smaller “thumbnail” views on the display. These systems can be set to automatically cycle through each of the camera inputs, or the operator can switch between these camera views manually. Figure 18.1 shows a multiplex system with all of the cameras on the display in a “thumbnail” view.
Multiplexed recording systems bring their own host of collection challenges. The most common mistake is using the main screen only when video evidence is collected. This main screen shows the video recordings from multiple cameras on it, meaning that you have multiple small, usually low resolution depictions of video as shown in Fig. 18.1. However, most multiplexed video recording devices allow you to make each one of the camera video feeds fill the whole screen before exporting that video, shown in Fig. 18.2. The correct way to collect multiplexed video is to get the video feed from each camera, not just the main screen that shows all of them.
18.1.2.2. File formats and video programs
When you are developing discovery for digital video recordings, it is important to specify how you want the video produced, especially as it relates to the file format the video will be in. If at all possible, you want the video file in its original condition, meaning that it has not been converted from one file type to another. When a video file is converted from one file format to another, it is possible for the quality of the video to degrade. Whenever possible, you want to make sure that the video is exported from the recording device using a file format that allows for lossless compression. This makes for larger files, but it helps to ensure that no quality is lost in the digital video, as compression can cause the overall quality to deteriorate.
If the video has been converted, you also want to make sure that the converted video will be viewable using common video software programs, such as Windows Media Player or Apple QuickTime. This helps to negate a common scenario, where a video file is produced that can only be played by a specific piece of software. This is an issue because that piece of software may allow you to view the video, but will not allow you to rewind, fast-forward, or pause. This type of situation typically occurs when the video is delivered by a law enforcement agency in encrypted form or as the direct output from some digital video recording systems. This scenario can make reviewing video evidence an overly time-consuming process. If you have a video that is an hour long, but only ten seconds is of interest, having to view the entire hour of video footage just to see that ten seconds every time is extremely inefficient.
18.2. Collecting video evidence
Depending on the recording device, the methods used to collect the video from the device can vary greatly. For instance, with many surveillance systems, the only way to get the video from the device is to export it using the controls on the device itself. Sometimes quality and file format options are available when exporting the video when it is collected. When it comes time to enhance or analyze the video evidence, how the video was exported is critical. The higher the quality of the exported video evidence, the more likely it is that a video expert can successfully enhance the video or analyze it. The video evidence should always be exported at the highest possible resolution in a format that loses the least amount of quality through compression.
In other situations, the video recording system may not have any method for exporting video, and the only way to get the evidence is to record the screen using an external video camera.
• Time Verification
Even if the video collected from a recording device is preserved correctly, it is usually the case that insufficient information concerning the recording device itself is documented. Many recording devices, such as surveillance systems and handheld video cameras, require that the user input a time and date manually. If the time and date are wrong on the recording device by even 15 minutes, an entire timeline of events can be thrown off, or a legitimate alibi could be erroneously deemed false. To determine the correct time, check and record the time on the recording device at the time of the collection, and then compare to an external time source like a cell phone and record the difference or offset. Despite how easy this is, more often than not, this vital step in the evidence collection process is skipped.
18.3. Example discovery language for video evidence
Included here is language for the technical items that should be requested when creating a discovery order for video evidence to make sure you get everything you can and in the proper format.
1. Any and all standard operating procedures (SOP) used by (Agency or Expert) regarding video evidence, to include but not limited to, standard operating procedures for the acquisition of video evidence, the preservation of video evidence, the storage of video evidence, the analysis and processing of video evidence, and the production of video evidence.
3. A listing of all the tools used in the acquisition, preservation, analysis, and processing of video evidence, to include both hardware and software tools. With software tools, the version of the software should be included. The tools should be listed as used in the examination of video evidence in sequential order.
4. Any and all chain of custody records regarding the video evidence.
5. Any and all reports and documentation concerning the methods used to preserve the video evidence, to include but not limited to, reports and documentation pertaining to hardware or software forensic write-blocking, and reports or documentation pertaining to the hardware or software tools used to create any duplicates of the original evidence and the method of storage for the original video evidence.
6. Any and all information, documentation, or reports concerning the viewing of the video evidence from the original media should also be included.
7. A copy of any forensic reports that detail the work process used by the forensic examiner in the course of his or her examination for the video evidence in this case, including any logs created by the analysis software used to examine the evidence.
Summary
In this chapter we looked at issues regarding the discovery of video evidence. We covered specific issues that arise when VHS video tape is not properly handled and preserved, the impact of different file formats and conversion on video evidence, and the problems that arise from improper collections of video evidence including failing to collect date and time information. Sample language was also included for use in discovery motions for video evidence.
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.