Discovery Questions for Video Evidence Expert Article

With the prevalence of video recording devices (phones, smart security systems, dash cams, etc.), video evidence is often available to support litigation of just about every type. This article outlines where to look for video evidence, and initial steps to take to assist in obtaining such video before it is lost.

Video Evidence: Expert Insight & Discovery Questions

Video clips and associated metadata (with few exceptions) are stored as digital files to a local storage device (SD card, internal memory, or hard disk drive) or remote storage device such as a corporate server, cloud storage, or some combination thereof.

These storage platforms generally record video until they are full, then overwrite the oldest video with the newest. It is critical to act fast to secure video evidence before the data is overwritten and irretrievably lost.

One fact often overlooked in litigation is that surveillance video contains more than just images. Video data includes metadata (data about data) such as the recording date, time, camera details, GPS location, associated audio files, etc. which may provide more value to the investigation than the images themselves.

Even if video data has been overwritten (or deleted), a forensic investigation can potentially uncover other useful evidentiary material. For example, most systems contain a system log showing any changes made, including manual manipulation, copying, or deleting of data.

Sources of Video Evidence

While we typically think of video data coming from overt camera systems such as those installed in commercial properties, other possible sources of video include:

• Social media
• Dashcams
• Home security systems like doorbell cameras
• ATMs and similar devices
• Nearby gas stations & convenience stores
• Police body worn cameras

While there are few standards that apply, many businesses size their video storage to retain up to 30 days of video, however if additional cameras or other changes have been made to the system without increasing the storage, retention times may decrease.

Most, if not all, of these systems have the ability to either mark data to be saved, preventing overwriting, or the data may be exported for preservation prior to being overwritten.

Below are some suggested items for an order of preservation followed by items to request during the discovery process.

Preservation Order

Few systems retain data longer than 30 days, and many will be shorter. For this reason, a timely and thorough preservation notice is critical.

Remember, for each minute the system is operating, it is deleting a minute of old data from each camera in the system.

• Never rely on the system owner/operator determine which cameras and times are relevant to your litigation.
• Determine the time offset.  Video systems often overlay a time and date stamp on images.  This may be different from the actual time. 
• Determine a reasonable time period of video data to request for preservation. This will be based on the incident; for example, an assault may need only an hour of video, however some incidents may need days or weeks. Don’t overlook time after the incident; the response is often as critical as the incident itself.
• The start time should be carefully considered.  For example, a video showing a slip and fall and the subsequent response that begins just before the fall may miss the action that caused the fall, such as a spill an hour earlier.
• Remember that the owner or operator of these systems is rarely an expert in operating them. Consider involving a specialist to export or preserve relevant evidence.
• Request the evidence be exported or stored uncompressed. Many video systems allow the data to be compressed to save storage space, but this removes information.
• It is not uncommon to have a qualified video system technician remove the hard drive, replacing it with a new one, allowing the subject video to be preserved.  Do not allow anyone to attempt to connect to the subject hard drive after it has been removed until you have engaged the services of a qualified forensic video analyst. Most computer technicians lack the specialized equipment and software to prevent damaging a video-specific hard drive.

Discovery Questions

While the actual video files are important, details about the overall system are often critical.

Typical requests for video evidence are worded like: “Provide all relevant video from the incident on January 2, 2024.” This lack of specificity can lead to counsel receiving a single 90-second video lacking context from a site with a dozen cameras that should have relevant video.

• What are the video system details? To include:
  • Make, model, and version of the core video system/application.
  • Map/CAD of the facility with the location and general aim of each camera identified. Request each camera on the map be titled with the specific name/number as programed in the system, as well as the camera make and model information.
  • What are the system configuration details, to include camera resolutions, frame rate, recording type (motion, continuous, on a schedule, etc.).
  • What are the video storage details? Is the video stored on a local hard drive, network server, cloud system?
• Request installation invoices from the installer, which will often contain helpful system information.
• Request the system log. This is generally maintained for the life of the system, and will show changes made to the system for configuration, file deletion, etc.
• Request video data from specific cameras associated with not only the incident itself, but those that may provide other relevant evidence. Specify the start and end time. For example, request “all video from cameras #1,2,5,6,7, and 11 from 7:00 PM through 11:30 PM on the subject date.”
• Request the evidence be exported uncompressed. Many video systems allow the data to be compressed to save storage space. This removes information.

Again, don’t let the system owner/operator determine what they think is relevant, they may have no training in investigation, video surveillance, or litigation whatsoever. This includes systems operated by security and law enforcement personnel; it’s always best for the legal and subject matter experts to determine what is and is not relevant.

Forensic Investigations Involving Video Evidence

There are many other key details that may be important to request during discovery. As in any other discovery process it is wise to consider a qualified subject matter expert to assist in asking the right questions.

The video analysis experts at Robson Forensic are familiar with the design, installation and operation of video systems, from simple home and dashcam devices to complex, enterprise systems covering hundreds of locations. Not only can we assist in ensuring thorough retrieval of video evidence, forensic services such as interpretation and analysis, measurement and speed calculation, analysis of system logs, and other services are available.

For more information, call us at 800.813.6736 or submit an inquiry.

Featured Expert

John Hassard, M.SC., CPP, CFE, LPC

Loss Prevention & Security Expert

John Hassard is a security and loss prevention expert with more than 30 years of experience in retail loss prevention, premises security and safety, physical security systems and corporate and fraud… read more.