When aren’t you on Camera? The Integrity and Recovery of Digital Recordings & Video Evidence

It seems every angle of today's society is captured within the frames of public, private, or personal digital devices. With digital eyes everywhere, it is more likely than ever that conduct at the heart of civil and criminal cases has been captured on video. Accordingly, it comes as no surprise that video evidence has been increasingly seen inside the courtroom. But what else can digital data tell you about a recording? How can you verify a digital recording depicts what it is purported to show? And how do you ensure digital recordings will withstand the scrutiny of legal proceedings?

Especially in the context of a legal dispute, digital video evidence collection – as with all evidence collection – should always be performed in a manner that ensures it will withstand legal proceedings. While it is simpler than any time in history to record video footage, the same cannot be said for the preservation and presentation of this footage in a forensically sound manner. Digital evidence is said to be forensically sound if it was collected, analyzed, handled and stored in a manner that is acceptable by the law, and there is reasonable evidence to prove so. Digital forensic soundness gives reasonable assurance that digital evidence was not corrupted or destroyed during investigative processes whether on purpose or by accident.

What ensures that video is forensically sound and why does it matter?

Most casual users would encounter difficulty collecting and extracting potential digital video evidence in a forensically sound manner.  The toughest challenge in this process is to ensure that the collected image data can be tied effectively to the system that housed the data and to ensure the corresponding date and time are consistent and correct. These aspects are essential to ensure that the evidence meets legal requirements for authenticity and integrity. *

In order to end up with a forensically sound video, there must be a well-defined strategy for collecting, analyzing, and processing the data being obtained. Next, the media should be inspected for signs of tampering to ensure its authenticity. To confirm the data is complete and comprehensive, the media must be presented in a way that allows a forensic examiner to search for potentially hidden or modified information. Finally, the media must be accurately presented in court. If any of these steps is not performed with care you are decreasing your opportunity of success.

At Capsicum, we routinely engage in the following steps for a case involving digital video to ensure it is forensically sound:

Retrieval: The video retrieval operation can be a delicate one, particularly if a case revolves around overwritten or otherwise damaged media. As with any evidence, digital evidence is vulnerable to “contamination” during the retrieval process. With digital evidence, in most situations, a forensic investigator will “image” the data, allowing the examiner to analyze a perfect copy rather than risk adulterating the original media. In addition to retrieving the entire data set, a forensics team must record the make and model of a recording device, which assists in subsequent authentication and analysis. The team must also have the capability to host and reproduce the data, which has the potential to be vast.

Data culling and auditing: Due to the ubiquity of information recorded on digital devices including cell phones and cameras, many cases involve large amounts of data, much of which may not be required. These excess files will need to be accurately distilled to the relevant portions identified by the court or parties in a dispute.

Authenticity: An experienced digital forensics team can detect whether a video has been deleted or manipulated. Techniques and software for the purpose of video manipulation are more widespread and accessible than ever before. Legal teams should expect the authenticity of any video evidence to be contested in court. While not visible to a casual viewer, encoding can reveal discrepancies that indicate whether portions of video have been deleted or altered.

Reconstruction: Often due to deletions, accidental damage, or malicious tampering, a forensic team must painstakingly reconstruct a video.

Enhancement: Multiple techniques are used to enhance a video. Typically, closed-circuit television (CCTV) and other video formats are not high definition enough to provide all the visual or audio details necessary for corroborating statements or disproving claims. Techniques like sharpening (reducing blurred images) and interlacing (increasing the perceived frame rate) help draw out previously missed details from a lower-quality video so that the images can be admissible as evidence. Often “still frame” enhancements are used at case presentations to drive home key points.

Conversion: Often, closed-circuit television digital recording devices (CCT DVRs) rely upon a proprietary format; in other words, manufacturers use exclusive methodologies to maintain commercial control over the DVR format and prevent third-party copying of a particular file. It is very common to encounter problems when handling a proprietary format. While many established manufacturers will provide tools that allow the playback and copying of footage from such systems, our forensic experts are well-versed in approaching and converting these file types for convenient presentation in court or other casual environments.

Analysis: To be accepted in court, digital forensic findings must be accompanied by analysis that accounts for the procedures employed, techniques used, and possible margins of error. Often, digital video evidence is accompanied by a slew of technical information that must be broken down and explained so that it can be understood by the average juror. At Capsicum, our internationally recognized forensics experts can do just that, keeping the thread of our discovery process intact while elucidating the results of our analysis in easily understandable terms.

Video retrieval operation can be delicate, particularly in cases where the evidence may have been overwritten or otherwise damaged. Digital video recorders (DVRs) for closed-circuit television (CCTV) commonly have a built-in capability to export stored video files to optical storage media. When a DVR is damaged or erased, its contents cannot be easily exported. This renders the forensically sound recovery of proprietary-formatted video files with their timestamps from a DVR hard disk an expensive and challenging exercise.

By way of example, Capsicum was recently called upon to assist in a case that involved charges of workplace threats and violence. Our task was to sort through CCTV video in order to discover any recorded evidence of the alleged events. Although some of the events were overwritten, in this particular case, the data was recoverable. In addition to retrieving the entire data set, our forensics team recorded the make and model of a recording device for subsequent enhancement and analysis. A comparison copy was created as well. In this case, we had to sift through hundreds of hours of recorded data, narrowing our set down to the relevant timeframes that were pinpointed by counsel. In the end, the recordings revealed that the allegations were unfounded, based on out-of-context incidents and mischaracterized representations about the recorded events. Because of the involvement of a digital forensic specialist in this matter, the truth was uncovered, justice was served, and our clients obtained a favorable result. 

Capsicum Group’s team of legal and tech experts can help determine potential stores of video evidence, as well as go on to retrieve, preserve, examine, analyze and host it, as well as testify regarding our findings. Claims of fraud, financial tampering, computer crime, employee misconduct, and other wrongdoings require corporations, law firms, and government agencies to follow digital trails to piece together facts that lead to the truth. Capsicum Group, with offices in California, New York, Philadelphia, South Florida, and Texas, assists with all types of digital forensics, including video analysis, by investigating the content of digital recordings on behalf of attorneys, corporations, and others.

*This is not legal advice. It is important to note that each state has its own guidelines for the use of surveillance films as evidence, and federal law offers its own standards as well. While some of the most important factors that are generally considered include disclosure, authentication, prejudice, and other admissibility issues, always consults with a licensed attorney

About Us

From day one, Capsicum Group, LLC has provided clients in multiple sectors across the globe with complex legal, tech and regulatory programs. For over fifteen years, we’ve perfected our team and our services, allowing us to tackle digital forensics, e-discovery, data recovery, cybersecurity and regulatory compliance projects of any size, for clients that range from local governmental agencies to multi-billion-dollar corporations. No matter the level of complexity, Capsicum Groups’ team of tech and legal experts is equipped with the leading-edge technology and intensive strategies for your success. Learn more about our forensic recovery and cybersecurity services.

If you have additional questions regarding any of our services, reach out to us via our Contact page or by calling (215) 222-3101.