Video Splicing Expert Article

A frequently asked question in any type of case where video evidence is being used is whether footage has been edited. That is, whether portions of the footage have been intentionally removed.

Even in the ideal scenario when a spoliation notice was sent days after the incident, discovery occurs once the case is filed. Typically, the spoilation notice will request that video of the incident be preserved, including a segment of time prior to and after the incident. When the video is not preserved, the question arises as to what happened to the video.

In this article, security expert John Hassard provides a brief overview of modern video security systems, motion-based recording settings, and how an understanding of the back-end of the video system can provide the answers to some of these questions.

Expert Analysis of Video Evidence for Splicing

Video cameras become less expensive and produce higher quality video with more megapixels every year, just like cell phone cameras. Higher quality video generally means a file size is larger per minute than one of lower quality or resolution. As such, the major cost driver for video surveillance systems is file storage.

Lacking a statutory requirement for storage (of which there are few outside governmental premises) it is up to the business or system owner to specify the length of time video surveillance footage is stored, though 14-30 days are typical thresholds when systems are designed.

Video surveillance systems generally save files to a fixed storage device.  This may be a local SD card or hard disk drive installed in the recorder or an offsite storage site such as a network server or cloud storage facility.

Each of these has a fixed size, or storage capacity. Once it becomes full, video surveillance systems generally overwrite the oldest data with the newest which then determines the number of days video history available. While possible, it is uncommon to find a video system specifically programed to store footage for a specific number of days.  

When cameras are added to a video surveillance system throughout its life, that reduces the number of days available unless additional storage is added.

Pixels, Resolution, and Video Data Quality

Pixels, or “Picture Elements” are the basic element in video data. Each pixel represents both a color and an intensity. A digital photo file (JPEG for example) is a set of pixels arranged according to a formula based on the camera’s sensor. A digital video file (such as an MP4, MPG, MOV or AVI, representing the CODEC, or compression – decompression algorithm used) is basically a series of digital photos in a single file.

A common method to manage storage in modern surveillance systems is motion-based recording. Unlike a motion detector device in a burglar alarm which detects motion using microwave or ultrasonic motion detection, video surveillance systems use data from the cameras themselves to detect a form of motion.

Video systems may calculate the difference in pixel value between images (photos) and use that to enable motion-based recording.

Video Surveillance systems allow the use of motion detection recording, which can be set to a schedule and adjusted in terms of sensitivity and motion detection zones (depending on the system).

Pixels can change based on lighting, shadows, air currents, relative motion in a structure, or motion in the camera mount. As a result, motion detection in video surveillance systems does not represent pure motion of an object.

When motion-based recording is enabled on a video surveillance system, the adjustments are extremely course, generally using settings such as “1-10” or “Low to High” based on the manufacturer’s desired feature set and user interface. These settings do not follow a standard, nor do they allow precise calculation, they simply allow a system to use a “trigger” to be used to start recording.

A great example of the limitations of this setting is rodents. Does the system owner wish to detect and record rodents, or should they be ignored in favor of more important (and larger) events? The system allows both possibilities.

As the motion trigger setting is not precise, the best installations are allowed to operate for several weeks, then the recordings are reviewed with the system owner, allowing the technician to increase or decrease the motion trigger sensitivity.

When motion-based recording is enabled, the technician may specify an area in the image to use to detect (or ignore) motion and set the strength of “motion.” The technician then selects the duration of recording (for example, when motion is detected, the system may record and save a file one minute, five minutes, etc.).

Most systems also allow a “pre-event” duration, such as including the 5-10 seconds before that minimum threshold of “motion” was triggered. This allows the system to capture the footage before the event reached the threshold of motion necessary to trigger the record setting.

In the graphic representation below, two identical cameras are installed in close proximity and aimed in similar directions. One is set to record continuously. The other is configured to record (save video to a file) based on motion detection. The green areas in the timeline represent when video was saved. It is easy to visualize the amount of storage space saved by using this feature.

How can we determine if motion detection-based recording was used?

An examination of the video system configuration can easily determine the motion detection configuration. Unfortunately, that may not be possible during litigation, or the system may no longer exist.

The video file itself may contain enough information to assist with this review. Most files include metadata, which is simply an embedded file of information created by the system manufacturer.

This usually contains basic information, such as:

• Date and time
• Specific CODEC used
• Resolution of the image
• Make and model of the camera and/or video system
• Camera lens settings

There is no standard for this metadata, some manufacturers include very little. When reviewing a video file, a quick determination may be made by looking at the start and end times as displayed on the image and calculating the duration in minutes/seconds. 

If the file itself plays in that amount of time (most video players will display the file length) then motion detection may not have been a factor in this file. If the starting and ending times show a longer period of time than the video itself plays, then the file was most likely edited or motion-based recording is a factor. 

Analyzing Video for Evidence of Splicing/Tampering

Reviewing the video will generally provide an analyst with details to confirm that motion detection was used to create the file. While this can indicate that the file was not edited, it may not result in retrieving data which was never recorded based on motion-based recording.

A forensic evaluation of the video surveillance system itself may allow some date to be recovered, but in most cases the system is replacing the oldest data with the newest every minute of every day. That should serve as reminder to notify system owners of spoliation and data capture requirements as soon as possible, as generally when the data had been overwritten there is no retrieval possible.

Forensic Investigations Involving Video Evidence

The video analysis experts at Robson Forensic are familiar with the design, installation and operation of video systems, from simple home and dashcam devices to complex, enterprise systems covering hundreds of locations.

For more information, call us at 800.813.6736 or submit an inquiry.

Featured Expert

John Hassard, M.SC., CPP, CFE, LPC

Loss Prevention & Security Expert

John Hassard is a security and loss prevention expert with more than 30 years of experience in retail loss prevention, premises security and safety, physical security systems and corporate and fraud… read more.