Original Evidential Export

It is Imperative, when conducting any type of Forensic Video Processing and Analysis, that the native digital data is used. This should have been exported correctly from a Digital Video Recorder (DVR), by a person competent in doing so.

If the footage has been exported incorrectly or it has been trans-coded and/or processed incorrectly prior to analysis, any enhancement or the correct interpretation could either be not possible or, called into question.

The native digital data can usually be acquired from a DVR using disk, USB device or over a network.

If the network is used, it is common practice to either store this on a dedicated server or copy this to optical or Hard Disk, ensuring and verifying a bit for bit true copy. It is then possible to only use part of this export for evidential use, but any splitting of the files must be documented and verified to ensure no loss or change in data.

For USB devices, these are classed as temporary storage media. The data must be copied to an optical or Hard Disk as soon as practical and the copy process verified to ensure a bit for bit true copy. Further copies of disks can be created, as long as no trans-coding or ‘format changing’ occurs.

Optical disks, used for the original export process, can be copied in the same manner.

Due to the many different types of Digital Video, it is common for video files and images to be used in different ways. At each point, they are changed in order to fit the purpose used. A common example of this is converting the original data to Video DVD in order to assist viewing. For presentation purposes, if completed correctly, this may not cause any problems BUT, this footage cannot be used for analysis, image processing, enhancement or interpretation. The reasons for this is that there will be a considerable change to the digital image with both a loss of data and also digital artifacts introduced into the image.

It is usually common to use documentation provided with an exhibit to identify its source. There may be a report detailing the extraction of the video data from the DVR and the production of the first exhibit. A true copy of this data is the one that must be used.

If the first acquisition of the data has been dealt with incorrectly, further assessment may be be required to establish how this could effect the image being analyzed.

If the true digital data of the incident forms part of a larger piece of data then, again, further assessment may be required to identify the best course of action to extract the relevant material.

Advertisements