Challenges surrounding the extraction of CCTV evidence

Q: What are the main challenges faced by police when it comes to extracting raw CCTV evidence?

A: Quite simply it’s the multitude of different systems out there, all recording in a myriad of proprietary formats and using different recording methods. There’s no standard way of extracting data. This means that the task of retrieving CCTV evidence is becoming increasingly more complex. Most systems now tend to fall into one of two categories: DVR-based or NVR-based.

DVRs, or digital video recorders, are stand-alone units that are essentially the modern equivalent of the old video cassette recorder (VCR). The CCTV cameras are connected directly to the unit and the DVR digitally compresses the analogue video onto an internal hard drive. They are often found as single units in small business or retail premises, although they’re increasingly to be found in private residences too. However, DVRs can also be cascaded together and networked for use in much larger systems, such as town centre schemes.

NVRs, or network video recorders, differ in that they record video that’s been digitally encoded by the camera and then transmitted over a network. The advantage is that they don’t have to be connected directly to the cameras and can be placed anywhere within an IT network. This in turn means that recordings can be remotely managed and viewed from any location across the network.

However, just to confuse things further, there are also numerous PC-based systems where the CCTV recording and playback is integrated within the computer rather than a standalone DVR/NVR unit.

Q: And within these groups, presumably the devices are all different?

A: Absolutely – there is no real industry standard, and most digital CCTV systems use a proprietary compression format, or codec as it’s known. This means that there is no simple way of extracting viewable video files – and therein lies the problem.

Q: How much of a problem is this?

A: It can be a big one. Many digital CCTV systems have a built in CD/DVD writer or USB port for downloading and archiving data, but this will still be in a proprietary format and needs an associated proprietary player to view the video.

There may also be occasions when the recording unit itself must be removed, but this can have numerous cost and legal implications, particularly in terms of insurance, security, etc.

The solution is that you need a large array of tools to get at this evidence, and then to process it into a form which means you can use it in court without compromising the chain of evidence and losing quality of the footage.

Q: So, what’s the advice for investigators who need to seize CCTV evidence?

A: Most investigators already know that it is preferable to download the data directly from the system rather than remove the device from the premises.

The most important thing is to ensure that the CCTV footage is retrieved in its native format, as this retains image quality and integrity. Ideally the replay software should be downloaded too, or at the very least a note made of the make and model of the system. If you can’t download it at the scene then you’ll need to take the whole recording unit, which will need to be treated like a standard computer exhibit and the hard drive forensically imaged.

It is also important to remember that it’s often impractical to download all the recorded footage, and consideration must be given to the time period of interest and the cameras required.

Whatever you do, don’t just pull out the hard drive! This may seem like an obvious option but it’s fraught with problems. The hard drive from a DVR will rarely be compatible with anything other than the original recorder, and will often not be in a Windows-compatible format. Therefore the video files will not be accessible when connected to a PC.

Q: So if you have the data on disc, what happens next?

A: It tends to fall into three categories:

  1. You have the data in a proprietary format, and it comes with a player application.
  1. You have the proprietary data, but with no player.
  1. The device exports in a format (for example .avi) which can be viewed with, say Windows Media Player. Whichever one you get, you will still have to process this data, and maintain its integrity and quality. This is where you need the vast array of tools mentioned previously, firstly to replay and capture the relevant footage from the player, and then to edit, enhance, and compile it into something court-friendly. You can’t just walk into a pressurised court environment with a collection of discs containing hours of footage and expect to spin through to the points of interest!

Q: …and if you have to image the hard drive in the device?

A: You still have to find a way to extract and convert this raw data into something usable, and that takes time. It should also be noted that a clone may not always be recognised by the host DVR, in which case using the original hard drive may be the only option. Either way, this should only be undertaken by suitably competent technical staff.

Q: When you have extracted and converted the footage, how do you go about editing, compiling and analysing it?

A: Again, this is where the range of tools comes in. Here at CCL-Forensics, we have invested considerably in cutting-edge image processing technologies and have the most powerful forensic video enhancement, editing and analysis systems available today. With this technology there isn’t any sort of CCTV or video footage that we shouldn’t be able to deal with. I’d be more than happy to give anyone a guided tour, to show just what’s possible.

Why not give CCL-Forensics a call on 01789 261200 or if you have any queries, or a current case. A no-obligation chat about CCTV is just a phone call away!


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s