Video Evidence: Forensic Analysis of Surveillance Systems & Footage Expert Article

Forensic analysis of CCTV video evidence is potentially broader than scrutinizing the visible elements in a recording. System analysis can often be used to identify other relevant video files, potential evidence, or indications of spoliation. 

In this article, premises security expert John Hassard discusses video surveillance systems, considerations for analyzing video evidence, and methods for determining if other relevant data may exist.  

Video Evidence: Forensic Analysis of Surveillance Systems & Footage - Expert Article

Video technology is among the fastest growing segments in physical security systems. Video serves a valuable role in deterring inappropriate and criminal activity as well as detecting and investigating incidents. While crime by outsiders is typically considered to be the focus, video surveillance is one of the most effective tools to both deter and detect occupational fraud and other unacceptable activity by employees. In addition to the typical security benefits, businesses gain valuable management, quality control, and training benefits from effective use of video data. The primary purpose of a video surveillance system installation is generally to record business transactions, accidents, and routine activity; allowing for thorough post-incident review and documentation.  

When reviewing recordings of an incident, we should remember that the system manages other useful information in addition to the video. The date and time information is obviously included, but there are other items worthy of review. System logs will often indicate if the video has been altered, changed, downloaded, and in most cases, viewed. 

Occasionally, despite there being a state of the art video system installed, there is no available video of an incident, or the video is not usable because of field of view or poor lighting/quality. Review of the video system itself can often show adherence to standards, assist in determining the effectiveness of a security program, facility safety, maintenance, and even training; which is often critical in evaluating an incident subject to litigation. 

What can be expected from a thorough review of a video system in relation to an incident? 
Let’s step through a review.

Following an incident, it is not uncommon to have video provided on a CD, DVD, USB thumb drive, an emailed video file, or on a VHS tape. However, there is a big difference between “data provided for review” and “all data pertaining to the incident available in the video system.” For example, while footage of an incident may be provided, what about other cameras in the facility, and times before and after the incident? Often footage of entrances/exits will provide the best view for identification purposes when the parties enter/exit before or after the incident. Reviewing camera placement throughout the facility may reveal the existence of information and facts not initially known, but extremely relevant to an investigation. 

A digital video system, as most commonly encountered, allows the user to search and download recordings from specific cameras for specific time periods. If you received a disk, USB drive or emailed video file, you have no way of knowing what happened before or after the provided video, what other cameras may or may not have captured, and none of the system administration data will be available in such a format.  Whether a system utilizes VHS tapes, hard drives, or cloud based storage, data is typically overwritten at specific intervals, which makes it important to preserve evidence. Involving an expert early in the discovery process who is knowledgeable in video surveillance systems can help to ensure that no important information is lost. 

Conducting a Forensic Analysis of Cctv Footage

The first step in a forensic investigation of security footage is to determine the make and model of the video system, and from the system administration menus, identify key details such as:

• Number of cameras and make/model of each
• Video quality settings (resolution) for each camera
• Data storage locations and capacity
• Additional inputs/outputs – motion sensors, temperature sensors, microphones
• System user information – user IDS and specific system authority for each

Applying this information to a drawing of the facility with all camera locations and views indicated can shed light on what other recordings may exist relevant to the incident.

A thorough review of the incident in question will then be conducted. While the incident may be clearly visible on one or several cameras, a complete review of the system is warranted. For example, video data of accident “victims” from other cameras, and footage from before or after an incident have served to refute claims, indicate complicity, or otherwise affect litigation. Review of entrance, exit and other cameras has served to identify participants who were not visible from a review of the direct incident footage.

Additional analysis of the system will allow the use of metadata, or “data about data.” The video system will capture, in addition to the video footage, other valuable information which may include time, system status (was it turned off or were any cameras specifically disabled), was video data searched, viewed or downloaded, and if so, by whom. It is also valuable to determine if camera settings were changed (ex: the recording resolution or quality raised or lowered), if camera settings were adjusted to not record, or if data was erased. 

For example, if video footage is not available for an incident but system logs show the power was interrupted for a 15-minute period surrounding the incident, the information from the logs may prove to be as useful as the video data that was lost. If system logs show a specific user adjusted several cameras to stop recording several days prior to an incident, that too may be relevant. By treating the video system itself as a subject of thorough investigation, it is not uncommon to discover key evidence that may have been otherwise missed. This is only possible by reviewing the overall system, rather than simply relying on a provided recording. 

Integrating Multiple Systems

Video surveillance systems are increasingly connected to other security and business systems, such as Intrusion alarms and access control. Even if these systems are not connected, the information in these other security systems can be vital to an incident review. The date/times that an individual’s access card was used may provide valuable insight regarding an incident, as well as user data and other information from an intrusion alarm system.

Standard of Care for Security System Installation

At times, the video surveillance system itself may be the topic of the dispute, rather than the footage it contains. Questions to guide an investigation include:

• Was a standard of care met by the video system’s owner, installer, maintainer or operator? 
• What was the overall condition of the system regarding proper service and maintenance at the time of the incident?
• Was user training documented? 
• Was the system properly designed? 

According to the US Department of Homeland Security: 

“In order for an organization to properly implement a CCTV system, site-specific characteristics need to be assessed by a knowledgeable multidisciplinary team of personnel.”

For example, if a response to robberies included installation of a video system, yet entrances to the facility and teller/cashier locations were not adequately covered in order to identify a subject, then “installation of the video system” may not have been an effective response. 

Sales floors and locations of high value items are a concern for some installations; accident-prone areas and secluded entrances may be of more concern to others. Camera count, camera position, type of camera for each position, and individual camera settings are all key in designing a system appropriate for a specific application. An evaluation by an expert can identify issues resulting from improper installation. Common issues discovered during a review include:

• Cameras mounted too high or low for the specific scene
• Improper adjustment and initial setup of cameras or the overall system
• Camera and system passwords unchanged from the default 
• Improper user account setup
• General system upkeep and maintenance

Premises Security Investigations

Robson Forensic experts in premises security and retail operations are frequently retained to investigate claims of injuries and assaults as they relate to security and operations in retail, hospitality, institutional, commercial, and residential settings. Our premises security experts evaluate the adequacy of active or passive security measures in relation to physical assaults and economic loss claims. Through analysis they determine whether or not the security measures were reasonable and sufficient based on a number of factors.

To discuss your case with an expert, submit an inquiry or call 800.813.6736.

Featured Expert

John Hassard, M.SC., LPC, CFE, CPP

Loss Prevention & Security Expert

John Hassard is a security expert with over thirty years of experience in retail loss prevention, premises security, and fraud investigation. He applies his expertise to forensic casework involving… read more.