The Switch to Digital: A New Kind of Collection

The video surveillance industry is undergoing a dramatic change with the move from analog video tape systems to digital video recorders, or DVRs. The new technology has delivered real benefits to businesses of all sizes, but has created a new set of challenges for law enforcement.

Consider an example. A small business owner buys a four camera DVR surveillance system for under $500, and installs it himself in his store to replace his old analog tape system. He no longer has to bother with rewinding and swapping tapes, or worry about whether reused tapes are degrading the quality of his video. He can customize recording settings like frame rate and resolution that were not configurable at all on his old system. He may even be able to access and manage the system remotely from his home computer. When the day comes that his store is robbed, the business owner calls the police and waits for their arrival, ready to see his surveillance investment pay off.

Things aren’t so simple for the law enforcement personnel who arrive to collect evidence of the robbery. To begin with, they have never encountered this DVR model before. With the help of the business owner and the DVR instruction manual, they are able to play back the camera views from the time frame of the robbery. The investigators are glad to find a reasonably good view of the suspect from one camera. (Fortunately, the DVR was configured to record video at the highest quality setting.)

How should the video evidence be collected? Before, a VHS tape could be popped out of the surveillance system and carried away. But on a DVR, the video evidence is stored on a hard drive that is built into the system. This particular system does have a built-in DVD burner, and luckier still, the business owner happens to have a blank disc on hand. The investigators figure out how to burn the video to a DVD, and return to the station to play the disc, only to find the player doesn’t recognize it. After all that trouble, the investigators are not sure whether they collected any usable evidence at all.

The difficulties faced by the investigators in our example are real. There are presently over a thousand companies offering digital video surveillance and closed circuit television systems, meaning that unfamiliar systems are less the exception than the rule for investigators in the field. Where one system may feature a DVD burner for collecting video, another may have a flash card slot, and the next just an Ethernet port or analog NTSC video connection. And the absence of standards for DVR technology has produced a bewildering variety of video formats, many specific to the manufacturers that record them. This can make it difficult to verify a collected video, and difficult to share it with others who may need to view it.

Most DVR systems feature more than one option for collecting video, but they don’t always give the same results. That is why it’s important to make practical decisions ensuring you collect the best quality evidence available, whatever the scenario. This includes knowing what you should have in hand before leaving the scene, what collection methods and formats are available and how they compare, and what should be considered when verifying the evidence you collect.

Original Evidence and Working Copies

The choices you make in the field at the point of evidence collection start with one basic question - what do you need to have in hand when you leave the scene? You are likely to have several immediate demands for any video evidence you collect. For example, the video has to be submitted as sealed evidence, you’ll want to keep a copy on hand as you work the case, and you may need to quickly distribute the video to colleagues or media outlets. Each version of the collected video has a different purpose, and so there are different requirements for collecting and managing them.

The version of the collected video to be sealed, documented, and stored as part of standard evidence handling procedures is referred to as original evidence. This video should be collected as close as possible to the original source, and stored on an archival-quality permanent medium. Because the medium is not meant to be reused, affordable write-once media types like CD-R, DVD-R, and DVD+R are typically used for original evidence. The goal is to leave the scene with verified original evidence (or a verified transport media copy) in hand.

Any other copy of the video is referred to as a working copy. A working copy can be made from the original evidence at the scene or back in the office or lab. In those cases where video must be collected to a transport medium, such as a flash drive, it must be written to an archival format as original evidence as soon as possible.

Digital Video Evidence Collection

In simplest terms, the collection of digital video evidence from a surveillance DVR is about collecting data from the computer files on the DVR to computer files that can be carried away from the scene. Ideally, the collected video should be the same format as the video data stored on the DVR, but this isn’t always the case. So it is important to understand how video is stored on a DVR, what evidence formats may be collected from it, and what those formats imply about the quality of the collected evidence.

As it records, a DVR compresses video data to save disk space. Using a program called a codec, it encodes each frame of the video into fewer bytes by approximating similar regions both within and between frames. Some detail is lost in the process, but the smaller file size lets the DVR store a much longer surveillance history than would otherwise be possible. (The unfortunate trade-off is that a user may set compression levels so high that the recorded video is very blurry.)

The way a particular DVR encodes video during recording is called the native format of the DVR. In many cases, the DVR manufacturer uses a proprietary encoding as its native format. This means that the video is not interoperable with other systems, but can only be played back on the DVR itself, or using playback software provided by the manufacturer.

One way to collect video evidence from a DVR is to export it directly as a digital video file. The exported video may be in the native format of the DVR, or it may be recompressed using a standard encoding to allow playback on other systems. The distinction is important, because a recompressed video will lose some of the detail of the native format. The problem is that most DVR players (and instruction manuals) don’t make it clear what format is exported, so it becomes another unknown in the video evidence investigation.

Proprietary Format

A proprietary format is a good indicator that an exported video file was created in its native format, without being recompressed. An exported video likely has a proprietary format when at least one of the following is true:

• Playback software is exported with the video (look in the same folder as the exported video data for an installer called setup.exe or a file with an .msi extension, or a readytorun player application ending in .exe)
  
• The exported video data doesn’t have a common video file extension (like .avi, .mpg, .mov, etc.)

An exported video in proprietary format is likely to preserve date, time, and camera information originally recorded with the video. A disadvantage of proprietary format video is that it may not be verifiable at the scene, if the required proprietary player software is not exported with it. Standard Format An exported video likely has a standard format if both of the following are true:

• The video data is exported as a single file
  
• The exported video file has a common video extension (like .avi, .mpg, .mov, etc.)

Since many DVRs use a proprietary encoding for their native format, it stands to reason that an exported video in standard format may have been recompressed. Be aware that a higher-quality collection format may be available, and consider an alternate collection method if the collected video seems of lower quality than the original as seen on the DVR. Also note that a standard format exported video may lose date, time, and camera information recorded with the original video. Collecting NTSC Video Instead of exporting video directly to a file, sometimes video can be captured as it is played back. The captured video is recorded as an uncompressed video file to avoid unnecessary loss of detail in the collected evidence. A very high quality collection is therefore possible, depending on the specific capture method used. However, an uncompressed capture also produces a very large video file. For example, each minute of NTSC color video requires about a gigabyte of storage. Large files like this can be a challenge to share and to store as original evidence. There is also the possibility that the video data can’t be written to storage quickly enough to keep pace with the capture. When this happens, frames may be dropped from the captured video, which reduces the value of the collection as evidence. Finally, a video capture records exactly what you see as you watch it, so date, time, and camera information can only be captured as an on-screen overlay, obscuring regions of the video evidence. Collecting Image Files Sometimes, a DVR allows individual still image files to be exported, usually in JPEG or bitmap format. Still images are of limited use compared to video, but they can be helpful as quick review copies, or when no video collection option exists. Note that a bitmap file has an uncompressed image format, and preserves more detail than a JPEG-compressed version of the same resolution image. Collection Methods There are several different methods for collecting video evidence from DVRs likely to be encountered in the field. It is important to understand the advantages and disadvantages of each, as well as the video format collected by each one. This information will help in choosing the best option when a DVR supports more than one collection method (as many do). The collection methods are presented here by interface, since physical inspection is often the simplest way to determine the capabilities of a DVR. Removable Media Drive Some DVRs feature an internal drive for exporting digital video directly to removable media. Whether a tray for optical media or a slot for flash media or a floppy disk, an internal drive is easily identified as a collection option, though it may require additional inspection or investigation to determine which specific media types are supported. A video exported in this manner will have a proprietary or standard compressed format. A DVR with an optical drive can export video evidence to optical media, which may include CD, DVD, and Blu-Ray discs. The use of write-once media is recommended for evidence collection. Because optical media are associated with high-capacity storage, DVRs often support native format video collection by this method. Optical also has the advantage of being an original evidence medium, so the same physical evidence collected from the DVR can be submitted without any need for a transport medium copy. Optical discs may be used to collect long videos, though an export may be limited to a single disc. (In this case, a longer video may be exported as a set of shorter clips.) A DVR with a flash media slot can export video to one or more types of removable flash media. Flash memory cards are available in capacities of 16 GB and beyond, and can be a good option for collecting long videos. However, some DVRs may not support higher capacity cards. Though a flash memory card may be used as original evidence if needed, its relatively high cost makes it better suited as a transport medium, meaning that an extra copy step is necessary to create original evidence. Some older DVRs feature a floppy disk drive for exporting still images or very short video clips to a 3.5” floppy disk. A video clip exported to a floppy is likely to be highly compressed, due to the very limited capacity of the storage medium. A floppy disk may be used as original evidence, but if repeated disks must be collected from the same DVR, it may be more convenient to use the disk as a transport medium, and burn the collected files on an optical disc for original evidence. Computer Data Port (USB or Firewire) A USB or FireWire data port on a DVR may serve a variety of purposes, not all related to the collection of video evidence. On some systems it may be for attaching a removable media drive or hard drive to export video. On others it may be used to extend the storage available on the system for recording video. It might be used to connect an input device like a mouse or keyboard or as a maintenance port for system updates. And on a computer-based DVR it might just be a generic port. The use of a DVR’s USB or FireWire port may therefore require investigation of its purpose. The instruction manual for the DVR is the best resource for making this determination. If the instruction manual is not available, a label near the port and the options in the DVR’s on-screen menu may provide clues to using the port as intended. If the DVR can export video to a removable media drive connected to the port, the same advantages and disadvantages apply as collecting from the same type of internal media drive. For example, exporting video to an external flash memory card reader or USB thumb drive is equivalent to using an internal flash media drive. It may also be possible to export video to a USB or FireWire external hard drive. The high storage capacity of a hard drive makes it the best collection option for very long videos. A hard drive serves as a transport medium for video collection. It requires an extra step to create original evidence. Video exported from a computer data port to a removable media drive or hard drive will be in either proprietary or standard compressed format. Analog Video Output If a DVR displays video on a separate television screen or computer monitor, it may be possible to capture the display signal as evidence. The quality of the captured evidence will depend on what type of cable connects the DVR to its display and what type of signal is required as input for the capture device. Analog video capture may be inconvenient for longer videos since the video must be recorded while it plays and because the method captures an uncompressed video file. It also requires an extra step to create original evidence from the collected video, which is typically captured to a hard drive transport medium. Analog television S-Video and composite (RCA) connectors may be familiar from older consumer televisions and VCRs. A DVR may also output a composite television signal to a BNC connector, which is easily converted to RCA with an adapter. S-Video is a better quality analog source than a composite video signal. Computer monitors use different signals and connectors from analog television equipment. The most common computer monitors use VGA or DVI-I connections. A VGA connection transfers red, green and blue analog signals to the monitor over separate conductors bundled in a single cable. A DVI-I connector allows color information to be transferred digitally from computer memory to a digital display, but also provides analog color signals for backward compatibility with analog VGA displays through an adapter. Some VGA and DVI-I signals can be converted to S-video or composite television signals through a scan converter. However, this process reduces image resolution and signal quality and may not work with higher resolution display signals. If a DVR provides both computer and television signal outputs, the S-Video or composite television output will result in better capture quality than a scan-converted source. Network Connection Like a USB port, an Ethernet network port may serve one of several purposes on a DVR. Some DVRs can be networked to allow remote operation from another computer. Some can connect to network-attached storage to extend the recorded video capacity of the DVR. Some newer DVRs can use network cameras (in addition to analog cameras), and use the Ethernet connection for receiving video to record. As with USB and FireWire ports, an Ethernet port may just be a generic port on a computer-based DVR. Once again, some investigation may be necessary to determine the purpose of the port on the device. When a DVR is connected to a computer network through its Ethernet port, it may be possible for a computer on the network to collect video from it remotely. If a computer is already set up for the remote operation of the DVR, this is simply a matter of running the DVR management software on the networked computer and performing a collection as if the computer were the DVR. In most cases, the DVR management software will allow the video to be exported as either a proprietary or standard format compressed video. If the video can be played back but not exported, a capture may be performed on the computer monitor display port, producing an uncompressed video file. Verifying Collected Video Collected video evidence should be verified to confirm that a quality recording of the scene of interest was actually gathered. By verifying video evidence at the scene, the investigator has the opportunity to repeat a collection if needed. Waiting until later to verify the evidence may require a return trip to the point of collection, where the scene of interest may have been overwritten by the surveillance system. Video evidence can be verified by answering four easy questions. If any question is answered NO, another collection is usually indicated. Conclusion With so many varieties of DVR-based surveillance systems, there is no easy recipe for collecting video evidence that is right for every situation. By understanding the collection methods available on most DVRs and the types of video each method creates, you’ll be prepared to collect and verify the best available video evidence every time.