Video Scene Magazine

Questions in the interview room

2011-06-24T10:46:00.002-04:00

When something’s a big deal, it’s natural to talk about it. Like the handling of evidence, or making what you get from witnesses or suspects stick. So why is it that something that combines all of these elements and commonly becomes the centerpiece of a case is problem prone?

We’re talking about interview room recording. But the real question is: Why isn’t hardly anyone else?

A poorly setup interview room recorder is like a ticking time bomb, waiting to explode on your most important case. The high-profile one, involving a child. The one that’s recently gained national media attention.

Your people will be taking the stand soon, and you know they have no explanation for that critical, unrecorded section of the interrogation. That moment just before the suspect says "I did it.” Sure, everyone has plenty of notes, you have a signed confession. But you know the coming challenge: "Isn't it convenient that the recorder cut out just before the confession. During those minutes my client was coerced." We all know that’s what the defense will argue.

Maybe one reason it’s not a hot topic is technology has supposedly already stepped in to offer a sure-fire cure. Digital – it’s supposed to be better, cutting edge, but all you seem to get from digital is headaches. Sure fire becomes a misfire, right in front of the national media.

WHY CAN'T DIGITAL DELIVER?

Digital’s promise has always been one of heightened quality. Remember when you started buying your favorite music on digital CD disc? Digital was touted as better. And so it is with video. DVDs, DV, HDTV, DTV. It's all better, right? But when it comes to video, digital can be tricky. In many ways, digital video can be better, but in other ways, it may shoot you in the foot. And that’s the case with digital video-recording systems, including interview room systems.

Many agencies have used consumer or prosumer DVD recorders, and others have used DVRs aimed at the CCTV market as interview room recording systems. Many of these systems have served up uncertainty and unreliability. One nightmare is an unreliable system missing portions of the video recording in high-profile cases. These situations can leave an agency with no explanation. Under oath, they are forced to reveal that the equipment they specifically purchased and installed to record interviews did not do its most basic purpose in life – record the interview.

A recurring theme is a department spending a large sum of money to equip multiple interview rooms with a full-featured recording system. Networking, view-the-interview from any office and so on. Only to have the complexity overtake the main function of the device. These interview room systems can't seem to talk and chew gum at the same time. So then the department gets frustrated and purchases dirt-cheap DVD recorders, which are reliable only if used properly. There are too many buttons that can render a recording useless. The DVD recorders end up with sticky note warnings, "Do not press the blue button!" Tape covering various buttons. So, they have a system that is unreliable in a different way -- too hard to use -- with a risk of fouling the evidence because a wrong button has been pressed.

It’s a huge issue, a dark undercurrent to the daily operations of any agency. And any cure has to deliver two things: ease of use and reliability. Let us know what you think.

Why verify?

2011-02-28T16:22:00.008-05:00

The importance of verifying digital video evidence before leaving the scene.

The characters and crimes in this story are fictitious, but the DVR is real. Everything the DVR does is real, as are all the photos.

March 17, 1840 hours: A criminal robs a convenience store.

March 17, 1930 hours: Detective Murphy arrives on scene. He learns the perpetrator was armed with just a stick, but still took away a good amount of cash.

Murphy interviews Julie, the store's attendant. After interviewing Julie, he asks about the store's video surveillance system. Julie points to a door. "It's in the office. It's locked," she says, wiping tears. "You'll have to call the owner." Then she points to a phone number taped to the cash register.

"Thank you," Detecitve Murphy replies, stepping toward the office door as he pulls out his phone. Through a small window of the door he sees his objective: the digital video recorder.

March 17, 2020 hours: The store owner arrives and introduces himself as George Gupta. George explains that he's fed up with robberies in his stores and he'll do anything to help. He goes through the menus of the DVR and finds an option to copy the video to the CD/DVD drive in the DVR. Detective Murphy asks George for a ten-minute video surrounding the two minutes of the robbery.

George takes a blank CD-R from a desk drawer and puts it into the DVR. The copy starts at 0%. About fifteen minutes later the copy finishes.

Detective Murphy once learned a hard lesson: Technology is nowhere near perfect. A DVR can burn a bad CD or not burn the CD at all. So Murphy always checks the CD to see if it has anything on it. He takes the CD out of the DVR and flips it over. He tilts it in different directions. At just the right angle he sees that the CD has information burned on it. Murphy thanks George and leaves.

A week later... March 24, 1610 hours: There's been another robbery, this time a shooting involved. And a dead victim.

March 24, 1640 hours: The Lieutenant in charge comes looking for insight. "Murphy, we think this recent homicide may be connected to the robbery you're working from last week. We need to take a look at the video you got."

"Give me a few minutes to pull it up Lieutenant. I've been busy with other cases and haven't had a chance to look at it yet."

Murphy throws the CD into his computer and opens the Windows file explorer. Blank. He closes the window and opens it again. Blank. Again. Crap. What's going on?

Murphy walks the CD over to his long-time crime-fighting cohort, Detective Williams. "Williams, see if this CD has files on it."

"You're computer's better than mine," Williams says.

"Just check it for me."

They stare at Williams' computer screen. Blank. No files.

"Crap, I'm in trouble," Murphy says and he explains the situation to Williams. "You're going to have to go get another copy of the video," Williams says.

March 24, 1700 hours: Murphy calls the store owner, George.

"Mr. Gupta, this is Detective Murphy. I was at one of your stores last week and got a copy of video after a robbery. We had a look at the video CD you burned for me and didn't see any files on it. I'd like to come back over get another copy. Can you meet me?"

"The DVR only holds a week of video," George responded over the phone. "What day was that robbery?"

Murphy looked at the CD. "It was the 17th, Wednesday."

"Today is Wednesday," said George. "I remember the robbery was in the evening do you know what time?"

"Six-forty," Murphy answered.

"It's four-forty. We only have about two hours to get the video," said George.

"Can you meet us ASAP, George?"

"Yes."

"Thanks," Detective Murphy signed off.

This time Murphy prepares by grabbing the department's video evidence recovery kit. It's loaded with all types of collection media and a laptop so Murphy can verify the evidence at the scene.

March 24, 1735 hours: Murphy arrives on scene. George has already setup the copy process for the video. Murphy opens his recovery kit.

Murphy takes out an CD-R labeled for evidence. "Let's try again," Murphy says. "Maybe it just didn't burn right last time."

The DVR seems to write fine -- 100%. This time Murphy puts the CD into the laptop right away to check the files.

No files. Again. Man this is getting old.

March 24, 1800 hours: Murphy feels tense. Fighting technology is almost harder than fighting criminals.

"What now?" George asks. "We only have about forty minutes left until it erases."

"Let's try the format option we saw," Murphy says.

George navigates to the menu with the format option and tries to format the CD. The screen displays a foul-spelled message: "FORMATT CD-R MEDIAE WAIT". Then another message from the screen: "FAIL".

How could it fail? From the catacombs of Murphy's mind comes an insight. He recalls from a video recovery training class, if one type of disc doesn't work try another.

March 24, 1810 hours: Murphy grabs a CD-RW and they set up the copy. "INSERT A COMPATIBLE MEDIA," the DVR tells them.

March 24, 1815 hours: "Fine," Murphy says. "How about DVDs?" Murphy loads a DVD disc. George starts the copy. The response: "DVD-R IS NOT SUPPORTED".

Only fifteen minutes left to get the copy... March 24, 1820 hours: Murphy looks at the last type of disc in the kit: DVD-RW. George presses the eject button. Murphy lays the DVD on the tray. "Please," he mutters. George starts the copy. Murphy shifts his weight, staring intently at the screen.

The screen flickers. "COPYING( 0%)" But Murphy knows not to get too excited. It could be creating a blank again.

March 24, 1835 hours: The copy finishes.

Murphy moves the disc from the DVR to the laptop. He clicks and opens the Windows file explorer.

"Yes!" Murphy bursts out. "Yes! Thank you. Thank you. We got it."

March 24, 1840 hours: As the video of the crime is overwritten on the DVR, Murphy verifies the evidence on the laptop. The quality of the video evidence is good. He copies the files to the laptop's hard drive and burns a backup DVD of the evidence. George offers a drink. Murphy thanks him and walks to the convenience store's wall of coolers.

Learn about StarWitness video evidence recovery tools at StarWitnessFieldAgent.com.

Situation forensic science

2011-02-14T15:14:00.005-05:00

“The adoption of technology by police agencies has been a type of 'black box' -- police have accepted such technologies, but have generally not assessed or evaluated them. They bring in new equipment or new technologies because they work in theory, but know little about how to use such technologies so that they work best."

That's how two Harvard scholars, David Weisburd and Peter Neyroud, explained the relationship of police and science in their article "Police Science: Toward a New Paradigm".

The article makes it sound almost like law enforcement pillages science for the stuff they like (such as new technology), but aren't really taking a close look at effectiveness. These scholars are not just antagonists, though: they seek a working relationship with law enforcement. They point to ways that science might help with decisions on the effectiveness of new methods, tools and technologies under a movement labeled ‘evidence-based policing’. Evidence in this case refers not to criminal evidence but evidence or scientific proof that the tools, techniques and even policies of policing yield positive results.

At the core of evidence-based policing is the idea that law enforcement should seek scientific evidence to determine what policing methods work. Putting things to test and measuring results can help answer questions such as: "Do new weapons make policing safer or more effective? Will DNA testing be cost-effective for the average police agency? Can automobile vehicle locator systems be used to increase the value of police patrol?"

Almost a two ago, the National Research Council of the National Academies released a congressionally mandated report on forensics: Strengthening Forensic Science in the United States: A Path Forward. The report, commonly referred to as the NAS Report, took a look at the scientific evidence behind a number of areas in forensic science. It has inspired intense debate by citing serious deficiencies in the nation's forensic science system, and by calling for major reforms and new research. The report describes concerns about the application of science across a wide spectrum of areas, such as forensic odontology, biological-evidence analysis, hair-evidence analysis, document-evidence analysis, fiber-evidence analysis and friction-ridge analysis (including footwear, tire impression, tool mark, palm and fingerprint analysis). The report asserts that law enforcement has been too willing to rely on experts while not making critical examinations of the scientific evidence behind these various areas of forensic analysis.

Fingerprints are a good example. On one hand, The Fingerprint Sourcebook says prints have "served all governments worldwide during the past 100 years to provide accurate identification of criminals. No two fingerprints have ever been found alike in many billions of human and automated computer comparisons. Fingerprints are the very basis for criminal history foundation at every police agency on earth." The book cites much research in support of this assertion. Yet the NAS Report points to recent research that "experienced [fingerprint] examiners do not necessarily agree with even their own past conclusions when the examination is presented in a different context some time later."

Thomas Bohan, director of Portland, Maine-based consultants MTC Forensics and a past president of the American Academy of Forensic Sciences, points to a weakness in logic of fingerprint-identification validity in the article "Forensic Science braces for change": "The FBI fingerprint division for years has asserted that fingerprint identification has been validated by a hundred years of jury trials. They just don't get it."

Both Bohan and the NAS Report point to DNA as the best model for validation. Bohan describes DNA identification as being "delivered full-blown to the forensic labs after years of validation in university laboratories."

The International Association of Chiefs of Police agrees with the need for validation of fingerprints. In a response to the NAS Report, the IACP published "Forensic Science: a critical concern for police chiefs". In this article, the IACP endorses the need to "validate the scientific basis of some forensic disciplines--especially pattern evidence disciplines such as fingerprint identification."

While the IACP supports several points of the NAS Report, it raises strong concerns and directly opposes some assertions. The NAS Report favors the idea that science should be performed by scientific institutes. Not just the research of forensic science but the analysis of evidence, as well. The report recommends that crime laboratories be independent of law enforcement agencies. The IACP "strongly opposes the report's recommendation that crime laboratories and other forensic services should be removed from law enforcement agencies." They raise concerns that "the report was developed without input from law enforcement practitioners." And they "strongly believe that all research and other initiatives designed to study and enhance the delivery of forensic sciences must include the participation of law enforcement practitioners."

The ideas in the NAS Report are beginning to take root, though. Councilman Phil Mendelson recently introduced a bill to the Washington D.C. Council to create a forensic department independent from the police. Mayor Vince Gray has endorsed the plan. The mayor's Safety Deputy, Paul Quander, describes the need for an independent lab to The Examiner: "Anyone accused of committing a crime facing scientific evidence should be assured that methods of analysis have undergone the scrutiny of scientific peer review and are independent from any real or perceived conflicts of interest."

Regardless of your opinion on the role of science in policing, you can't ignore the NAS Report. All sides are taking stock in its conclusions. Paul B. Kennedy, an attorney in Houston, tweeted as PaulBKennedy while attending a National Association of Criminal Defense Lawyers' seminar in 2010:

(1 of 3) "Don't be afraid to take on the state's forensics expert."

(2 of 3) "'...the interpretation of forensic evidence is not infallible.' --NAS"

(3 of 3) "The current forensic science is NOT based on science. Its just forensics."

The common ground

With all the debate, there is one thing everyone seems to agree on. Money. Forensics is under-funded as it is currently operating. If the future becomes focused on change, even more resources will be required. Science will come at a cost.

The same scholars criticizing law enforcement for not effectively examining science acknowledge this. "Medical research in the United States receives more than $28 billion a year in government funding (National Institutes of Health, 2008)... ...Research on dental care in the United States has a federal budget of more than $389 million per year (National Institute of Dental and Craniofacial Research, 2007). Education research received $167 million in the United States in 2009 (U.S. Department of Education, 2009). However, the National Institute of Justice (NIJ), the primary U.S. funder of research in criminal justice, had a total budget of only $48 million in fiscal year 2009 and a budget for research and evaluation (in which its policing division is located) of only $13.7 million."

The IACP endorsed the creation of an entity to establish standards and best practices but also called for that institution to "serve as a funding source for forensic science services". Agreeing with the NAS Report's idea to have an accreditation and certification for forensic sciences, the IACP points out the realities: "the IACP is strongly opposed to proposals that would institute 'mandatory' accreditation/certification requirements in the absence of secure, sustainable, and stable federal assistance funding." Without funding, a mandatory accreditation would bring our nation’s evidence-analysis system to a grinding halt.

Dr. David Hassell, FBI Laboratory Director, described the gap between basic research and its application in solving crimes to nature news as the "valley of death" because "nobody wants to pay for it, nobody really wants to do it". "That gap needs to be filled by thorough testing of new techniques before they are released to crime labs," says Hassell who is a chemist with a background in this sort of validation.

Even Washington D.C. with its commitment to implementing an independent lab sees the financial challenges. Safety Deputy Quander says, "Given our current fiscal pressures, we may not be able to immediately expand the lab into new services."

Have an opinion on this matter? Want to get involved? Email me at samb@signalscape.com.

Forensic video greatest hits re-release

2011-01-27T16:02:00.003-05:00

Our list of free forensic video software tools and websites.

In May of last year we published our first list of free software downloads and references to help boost your video-forensic capabilities and know-how. Today we're re-releasing our list with some new hits.

The Basics

SWGIT Best Practices for Forensic Video Analysis is a PDF document of best practices. The full PDF file is hosted at the International Association for Identification.

Best Practices for the Retrieval of Video Evidence from Digital CCTV Systems is a small waterproof flipbook developed by a number of law enforcement agencies: FBI, NYPD, LAPD, Secret Service to name a few. The book can be ordered through the Technical Support Working Group, or you can download a PDF of the book from the Technical Support Working Group.

GSpot tells you what codec you need to open that AVI file, which Windows Media Player is refusing to open. The technical name for it is codec appliance software application. Don't google gspot. Just get the download directly from headbands.com.

fourcc.org is a great website for finding a video CODEC once you know which one you need. Just find out the FourCC (or four-character code) of your video file using a codec appliance such as GSpot and plug it into fourcc.org's search box at fourcc.org.

Next Steps

StarWitness Weekly offers weekly emails with the latest news in forensic video and stories of video evidence being used to catch criminals. Check it out at starwitnessweekly.com

When you get a proprietary video file as evidence the file extension may give you some insight on how what player you need to play the file. There are a number of sites that provide information on file extensions: File-Extensions.org claims to be "the source for file extensions information". You can access the site at file-extensions.org. Fileinfo.com declares itself as "the file extensions resource". Head over to fileinfo.com to search some file extensions. filext.com -- A free online resource by Uniblue -- is another website of file extension information. You can find the site at filext.com.

Media-Geek is an online forensic multimedia community that is a great source for finding proprietary players and codecs you may need. Check out the full site at media-geek.com. (You'll need to register and get a password to access the downloads area of the site.)

In addition to Gspot there are several other codec appliance applications available for free: Download AFREECODEC VT at www.afreecodecvt.com, MediaInfo at mediainfo.sourceforge.net, AVICodec at avicodec.duby.info and VideoInspector at kcsoftwares.com.

Deep Cuts

The FBI recently put together a video titled Caught on Camera: Best Practices for CCTV Systems. The video comes off as a Hollywood production with narration by Annie Wersching, co-star of the TV show 24. But it deals with the realities of CCTV. It shows how the proper setup and installation of CCTV systems helps solve crimes. Watch the video on the FBI's website.

There are a number of video players that forensic video analysts use: You can find Virtual Dub at virtualdub.sourceforge.net, GOM Media Player at gomlab.com and AVIedit at am-soft.ru.

An image tool can be a great help when working with video. IrfanView is an image viewer you can use in place of Windows default image viewer. One thing it enables you to do is open two image files at once for side-by-side comparison. Download it at irfanview.com.

If you really want to get deep into video files there is AVISynth, a script-based non-linear video editor, available at avisynth.org and NFI Defraser, a forensic analysis application for detecting partial or full multimedia files, available at sourceforge.net.

And finally, the NAS Report - National Academy of Sciences: Strengthening Forensic Science in The United States reviews various areas of forensics including: fingerprint, DNA, tire tracks, shoeprints, bloodstain, and firearms to name a few. The report includes some information on digital and multimedia forensic analysis as an "emerging forensic science" but does not specifically address video evidence. It does, however, make recommendations for strengthening our nation's forensic science practices. You can read the report at the books.nap.edu website.

Sponsored by StarWitness.com -- free software demo 888-685-2100

Forensic video vigilante

2011-01-25T14:32:00.004-05:00

We've certainly seen the gamut of law enforcement using social media and the web to release pictures and video of suspects from video evidence. But victims using these techniques is a newer twist. Social media puts the power of broadcasting into the hands of anyone. And one victim, Jimmy Minh Do, decided to use it.

"There's cameras everywhere and there's social media everywhere now, too", he says.

He got the video surveillance of his car being vandalized in the parking garage where he lives through his home owners' association. He then posted it on Facebook with the message: "On Saturday at 3:30 AM four guys wrecked my place, my elevator, and kicked a bunch of cars in my garage. They were mad they weren't let into my place. I was asleep at the time and have no idea who they are. Please help me identify them." The criminals vandalized three cars in all including Do's and another victim's.

After posting the surveillance footage, Do received tips via text and e-mail. People identified some of the suspects in the video as Colorado University football players. Do sent the information and surveillance video to the Denver Police Department.

Three of the suspects were confirmed to be Colorado University football players as reported by The Denver Post. Do updated his Facebook page stating that the four criminals agreed to pay damages and he wasn't pursuing charges.

Colorado's 9 News coverage of the story...

Sponsored by StarWitness.com -- free software demo 888-685-2100

Video trail

2011-01-10T16:27:00.009-05:00

Sponsored by StarWitness.com -- free software demo 888-685-2100

John Wheeler, a former presidential aide, left a trail of video evidence in the days before his death. Wheeler's body was found the morning of December 30, 2010 when a garbage truck emptied at the end of its route. Authorities have labeled his death a murder and are investigating. Five main events lead up to the time of his death. Based upon video evidence of the last event he was known to be alive around 8:30 p.m. of the evening prior to his body being found. Police released surveillance video from another of the five events and the locations of two of the other events are known to have video surveillance systems. Following is a list of video evidence of the events.

(The Washington Post has created a map of the events: link to map.)

December 28, 2010

Wheeler is believed to have been on an Amtrak train returning from Washington to Wilmington, DE on December 28, 2010.

December 29, 2010

Wheeler is seen near his home at Happy Harry's Pharmacy in New Castle, DE at about 6 p.m on December 29, 2010. Happy Harry's Pharmacy has a video surveillance system but there is no confirmed report that police have collected the video evidence. The Deleware Online reported: "The Happy Harry's drugstore in New Castle also has video surveillance at its pharmacy counter, and was cooperating with police..."

About an hour later on the evening of December 29th, Wheeler shows up at the HyPark parking garage in Wilmington, DE. Police released surveillance video showing Wheeler at the parking garage. Reports from interviews with the parking attendant indicate Wheeler was disheveled, disoriented and claiming he was robbed. He shows up on the video surveillance at around 6:42 p.m., according to the video surveillance clock. He's carrying one of his shoes.

December 30, 2010

"'About 3:30 p.m. Thursday, John P. Wheeler III, 66, was seen in Wilmington in the area of 10th and Orange streets by a member of the public', said Newark police spokesman Lt. Mark Farrall." The Newark police could not say how they "verified that Wheeler was at the intersection", but according to an article in the Deleware Online: "there is a video surveillance camera mounted at the corner of the DuPont Building overlooking the street crossing".

Later that day, around 8:30 p.m. in the evening, video evidence shows Wheeler inside the Nemours Building located at the intersection of 10th and Orange streets. Police issued a statement indicating that Wheeler appears confused on the video. This was the last time Wheeler was known to be alive.

DVR fail

2011-01-06T16:49:00.055-05:00

Sponsored by StarWitness.com -- free software demo 888-685-2100

An old DVR in a Chinese restaurant -- chugging along. When you try to open the CD drive to collect the video evidence, you realize it's glued shut with grease. Crimes commonly occur in these not-so-clean places. And many occur in places where DVRs fair better: banks, hotels, retail stores and grocery stores. Even in these clean places, though, DVRs fail. Like when a grocery store’s DVR has a hard drive bite the dust before the police can get out to the scene to do the collection.

In a recent online discussion, one security sales professional states that after two years there is a 50% chance that a DVR will either need replacing or a require repairs so expensive that it will usually justify a replacement. He points to environment as a big factor. He claims DVR manufacturers offer warranties but commonly deny the warranty claims citing power surges, dust damage or liquid damage. This causes customers to replace the DVR rather than pay for repairs. Simple things such as using a power-surge protector and placing the DVR in a clean area can help extend the life of a DVR.

During the same online discussion, a number of representatives of CCTV manufacturers recount knowledge of older DVRs in the field, hundreds in fact, some up to seven years old. 2004, in other words. NASA's Spirit and Opportunity spacecrafts landed on Mars, Facebook was founded, a jet reached the speed record of Mach 9.6 and the world's tallest bridge was opened in France. That all sounds cutting edge. But consider the most popular computer operating system: Windows XP, two years old at the time. Windows Vista wasn't released for another three years, in 2007. DVRs three-to-seven years old were manufactured during the days of Windows XP, meaning they assume whomever collects the evidence and later plays back the video is using this software. If you're wondering what that means when you're running a newer version of Windows, such as Windows 7, have a look at the Video Scene Magazine article "Playing proprietary videos with Windows 7".

You get what you pay for

A number of security professionals agree that PC-based DVRs generally fail sooner than embedded DVRs. This is due to PC-based DVRs having more moving parts. Open a simpler embedded DVR and you won't find many parts. The main components include: a main circuit board, a hard drive and possibly optical drive, a power supply and I/O for devices and users.

A low-quality DVR may be more susceptible to failures of the main circuit board. But, according to online discussions, the parts of an average-quality or better DVR are inclined to fail in the following order: first the hard drive; second a button, switch or display; third the power supply and finally the main circuit board.

In today's world computer hard-drive failures seem common. And are commonly followed by, "You did backup all of our pictures didn't you?" Studies on hard-drive reliability give us some insights on what causes the failures. Things like drive age, drive size and temperature are factors. One study by Google found drive failure rates in the first year of operation to be 1.7%, in the second year 8% and in the third year 8.6%. But age isn't always bad. One study found some older drive models to be more reliable because they were sturdier, also known as, "they just don't make them like they used to.” Typically, larger hard drives have more moving parts, making them more susceptible to failure. Another factor is temperature. When a hard drive runs at a higher temperature it's more likely to fail. To appeal to users who want to use hard drives for a greater than average number of years, hard-drive manufacturers offer enterprise-class drives. A DVR that uses enterprise-class drives and has a case designed with proper airflow should be much less prone to hard drive failure.

The future of DVR fail

Failure is not the only thing driving sales of new DVRs. New features also prompt users toward a purchasing a new unit. Just like businesses wanted to get rid of the VCRs in their CCTV setups when DVRs came out, they now want to move to networked DVRs for benefits such as remote monitoring. One security professional says, "The original non-networked embedded DVR... only place left for it is on the Island of Misfit Toys... nobody wants it anymore, but it still works fine."

Interestingly, networked DVR units are experiencing a high rate of returns due to complexity. If the user can't troubleshoot networking issues, which may not be caused by the DVR, they think the DVR itself is not working properly. Some manufacturers don't yet have technical support that can properly troubleshoot a networking issue with a user, so the DVR ends up being returned to the manufacturer.

When it comes to video evidence, we must focus on the past, present and future. Equipment from the past still hits our desks -- many of us still getting VHS tapes. At the same time, we're seeing new DVRs that have only one or two data ports, some with minimal buttons. It's a continual challenge for law enforcement to be ready to deal with any type of video evidence collection and forensic video analysis, but the preparation pays off.

Milestone for video evidence

2011-01-05T15:53:00.005-05:00

Sponsored by StarWitness.com -- free software demo 888-685-2100

Video evidence has hit a new milestone in pop culture: a "top ten list". The Houston Press published a list of top ten celebrities burned by video evidence over the past decade. It includes the home video of David Hasselhoff rolling around drunk on the floor, a jail confession from Tom Sizemore and more. The last two items on the list are Tiger Woods' voice mail begging, "take your name off your phone, just have it as a number" and the recording of Mel Gibson losing it, which are, as we all know, technically audio evidence.

Check out the full list at Top ten celebrities this decade who crashed and burned with video evidence.

Digital in-car camera standards

2011-01-05T15:53:00.004-05:00

Sponsored by StarWitness.com -- free software demo 888-685-2100

The DOJ is currently seeking comments on proposed standards for digital video cameras for police vehicles. They're interested in feedback on things such as the testing of the cameras and rules of evidence.

The official name of the program is the Vehicular Digital Multimedia Evidence Recording System (VDMERS) Standard for Law Enforcement.

Here's a link to an article on governmentvideo.com: Police Vehicle Digital Camera Standards Proposed

Link to the announcement on the Federal Register: Vehicular Digital Multimedia Evidence...

Deliberate with digital evidence

2010-12-22T15:43:00.011-05:00

Sponsored by StarWitness.com -- free software demo 888-685-2100

A recent appeal in Indiana claimed the court should provide the jury with the ability to examine digital evidence during deliberations. The digital evidence in the case included three CD-ROMs containing a series of digital photos. In the appeal the plaintiff, Paul Arlton, a patient who received eye surgery from the defendant, claimed that the digital format of images of his retina would have aided the jury during deliberations. He claimed that the digital images provided more detail than the smaller, printed copies, which were the only form of the evidence available to the jury during deliberations.

The Court of Appeals of Indiana agreed.

The opinion from the Court of Appeals of Indiana opinion states that the "jury should not have been precluded from accessing the digital exhibits". The opinion addresses some of the practical issues with giving the jury access to the digital format of the evidence, for example, potential unintended issues with giving the jury access to a computer to view the images. The jury could misuse the computer to access extraneous information. The opinion suggests that evidence be transformed into a medium that is accessible without a computer or provide the jury with a 'clean' computer that contains no other information and no access to the Internet.

If this ruling stands for other cases and all types of digital evidence it brings up some good questions for digital video evidence.

Full opinion from Court of Appeals of Indiana

Be advised: video presents the facts

2010-12-20T13:54:00.032-05:00

Sponsored by StarWitness.com -- free software demo 888-685-2100

Video evidence can be a great storyteller. A storyteller of the truth, revealing the scene exactly as it occurred. One such visual truth telling benefited the prosecution when video evidence revealed missing pieces in the story of a case involving drug possession with intent to distribute. The video evidence became "the most important evidence the government presented to the jury" according to the opinion on the case's appeal; US v. Jose Santos Morin, US Court of Appeals for the Fifth Circuit, No. 09-40702. At the same time, in this case, along with acknowledgement of the importance of the video evidence, the opinion offers some cautions on the analysis and interpretation of that video evidence.

On January 20, 2009 at the Falfurrias, Texas U.S. Border Patrol checkpoint a trained canine nose raises concerns outside a white trailer pulled by a red tractor-truck. After a secondary inspection by drug dogs the driver of the tractor, Jose Santos Morin, consents to a search. A U.S. Border Patrol Agent opens the rear of the trailer. His canine partner enters, jumping onto stacks of produce boxes. Inside the boxes layers of cabbage leaves wilt in their attempt to hide large black bundles. Bundles containing a harvest from a different plant. The trailer contains 284 bundles in all: a total of 9,146 pounds of marijuana with an estimated street value of $7.3m.

Morin claims to have no idea how it got there. The passenger, Juan Manuel Hernandez, presents a bill of lading to Border Patrol Agents. The bill of lading states they're hauling cabbage from ISPE produce warehouse to Houston, Texas.

The DEA investigates

DEA Agents Suzanne Minnick and Xavier Bedoya arrive and interview Morin about the sequence of events leading to his arrest. In his statements to the agents, Morin claims Hernandez recruits him to drive a tractor pulling a trailer loaded with cabbage on the evening prior to his arrival at the checkpoint. He claims their route was from Mission, Texas to Houston. Morin says a friend calls a cab to pick him up and bring him to a Jack in the Box restaurant for the rendezvous with Hernandez. He claims Hernandez arrives later, around 12 a.m., driving the tractor pulling the trailer. From there they head straight to Falfurris, Texas stopping only for gas in Encino where Morin takes over the driving.

The DEA agents find a receipt in Hernandez's wallet from the evening of the departure. It's from a place neither Morin nor Hernandez mention in their interviews: a Stripes convenience store in Mission. This is where video evidence enters the picture. Agents Minnick and Bedoya obtain video from the Stripes store -- 16 cameras worth, 30 minutes before and 30 minutes after the time listed on the receipt. Analysis of the video evidence launches the agents on a path to the truth.

The video shows a tale of a tractor-trailer switch-off. Around 10 p.m. on January 19, 2009 a tractor pulling a white trailer, similar to the trailer Morin was pulling when arrested, backs away from the gas pump area and parks. Soon after, a second tractor, a red one similar to the one Morin was driving when arrested, arrives and pulls up to a pump.

The first tractor detaches its trailer and pulls to a different pump. Then the red tractor backs up and connects to the white trailer. Agent testimony also notes the video importantly shows that during this trailer switch a person "who appeared to be Morin inside the store" is making purchases.

When things go to trial Morin's story changes. He admits being at the store during the time of the video and testifies with his new story.

Morin's new story

Morin testifies that on the evening before his arrest Hernandez picks Morin up at his house and drives him to the Stripes store in the red tractor -- the same tractor Morin was driving when he was arrested. Morin testifies that there is no trailer attached when Hernandez picks him up. At the Stripes store they fuel the tractor, still without trailer, and Morin heads inside to get food and drinks. When he comes out of the store he runs into an acquaintance. The acquaintance drives him to his house because he wants to say goodbye to his family and he later meets up with Hernandez to drive with him.

But the court didn't buy it and with the video and other evidence Morin is convicted. The value of interest in the video evidence doesn't end there. We have something else to learn.

Morin's appeal

Morin appeals his conviction with one of his objections challenging Agent Minnick's testimony regarding the surveillance video from the Stripes convenience store. Morin claims that Minnick crosses a critical line in her analysis of the video evidence. He claims she uses the video to make an impermissible comparison between a drug profile and himself. In the appeal's corresponding opinion, the judges offer some explanation of crossing this line. They explain that evidence should present only facts, thus, testifying to a defendant's state of mind rather than the facts is not allowed. Describing behavior common to the drug-trafficking trade is allowed. Explaining what a defendant was thinking is not allowed. Here's an example from a different case: an agent testified that a "defendant 'must have known he was carrying drugs' because he falsified the log book"; Ramirez Velasquez, 2003.

In Morin's case the appeal opinion indicates that Minnick did transition from giving background testimony about how drug organizations work to describing her "theory" of the surveillance video from the Stripes convenience store. The judges ruled that Minnick was entitled to provide a summary of the video testimony and her expert opinion of it (under federal rule of evidence 1006). But she should not have offered the opinion that based on her interpretation, "after everyone met at the pumps at the Stripes station, Morin and Hernandez backed up the 'already loaded' trailer that had been delivered to the Stripes station and attached that trailer to Hernandez's tractor."

Amid their ruling that Minnick crossed a line at one point in her testimony, the judges point to numerous witnesses presented by the prosecution. They herald the video evidence as the most important evidence the government presents to the jury. They acknowledge Morin admitted being at the store during the time of the video. They point to numerous facts all showing that Morin's story can't be corroborated. Employees of the produce warehouse testified that the bill of lading was forged. An employee of the Stripes convenience store testified regarding the receipt and security cameras. The owner of the cab company that Morin claimed picked him up testified that none of his drivers had any record of a passenger in the area of Morin's address on that evening. Morin wouldn't provide correct contact information for either the friend he claimed took him home from the Stripes store or the friend he claimed called the cab for him.

The judges explain that the jury was well entitled to infer from the video that Morin was present when the trailer containing the marijuana was attached. The jury was also entitled to consider the suspicious circumstance of picking up a supposed load of produce at a gas station and to consider all the other evidence. In the end the judgement of conviction was affirmed. The opinion states, given the volume of the evidence produced by the government "we are persuaded that Morin has failed to demonstrate a reasonable probability that trial would have had a different outcome".

This opinion does, however, leave those testifying to video evidence to consider how careful they must be in presenting the facts and not extending to "theories" or opinion on what is going on in the minds of those in the video. Presenting video evidence means presenting only the facts shown by that video evidence.

CODEC H-E-Double-Hockey-Sticks

2010-12-10T16:39:00.003-05:00

We didn't say it, Wikipedia did. Wikipedia's article on Windows' DirectShow contains a section titled after the place you might sometimes feel you've been sent: CODEC hell.

DirectShow is Microsoft Windows' underlying multimedia framework. Windows calls on DirectShow to do things like play video and audio. Most people assume computers now play any type of video or audio right out of the box. However we deal with so many types of video we know that's not the case.

We recently had a call from someone new to the world of video evidence. They understood AVI to be a standard video format. It's not. That's right. If you didn't realize it, AVI is a standard file container not a standard video file format.

Here is the shake down on AVI.

Being a standard file container means that an AVI file can be opened by any program that works with the AVI format. Let's use Windows Media Player. WMP opens an AVI and looks at the video contained in the file to determine its type of compression. If can play that type of video: it does. And if it can't? It throws you a not-at-all-useful error message.

How do we cope? We need CODECS, the cure all for opening a compressed video file. Once Windows Media Player determines the type of video in the AVI file it then looks for the matching CODEC on your computer. You can think of CODECS as keys that allow your computer to unlock various types of compressed video. Each type of compressed video requires its own key. And just like my key ring is different from your key ring so is each computer's key ring of CODECS. My computer may have different CODECS than your computer, which explains why the AVI file the detective claimed wouldn't play (on his computer) played with no problems on your StarWitness computer. There are more CODECS loaded onto our StarWitness systems than the typical office computer.

No matter how cool, new, high-tech or video-enabled your computer is, you'll still run into a video you can't play. You'll know you don't have the right CODEC when you get that not-at-all-useful error message from Windows Media Player. What to do? Get a CODEC Appliance. (It's a fancy name for free software. One CODEC Appliance is GSpot. Once again, I didn't say it, or name, it in this case.) When you open an AVI file in GSpot you'll get the name of the CODEC. Then you can google to find a free download. Once you install the downloaded CODEC, the video should play.

Should doesn't mean always will.

CODEC woes don't always end with a simple install and download. If you work with CODECS long enough you'll see some "strange behaviors". (Not just your own strange behaviors: strange behaviors of your computer.) These could be a video opening in one program, such as Windows Media Player, but not opening in another, such as importing into Freezeframe. Or reinstalling a video CODEC, which you know had previously worked fine on your system, and discovering it is haywire the second time around. Even the experienced, technically savvy and computer nerdiest among us just want CODECS to go away sometimes. Many times these deeper CODEC issues involve something so dear to Windows' heart: the Windows Registry. If you end up stuck with a serious CODEC issue you may need help repairing your Windows Registry. Give us a call 1-877-674-3031.

And now you have background knowledge for understanding Wikipedia's explaination of CODEC hell, or at least you should enjoy the fact that "nuclear arms race" is used in the description.

"Codec hell (a term derived from DLL hell) is when multiple DirectShow filters conflict for performing the same task. A large number of companies now develop codecs in the form of DirectShow filters, resulting in the presence of several filters that can decode the same media type. This issue is further exacerbated by DirectShow's merit system, where filter implementations end up competing with one another by registering themselves with increasingly elevated priority.

"Microsoft's Ted Youmans explained that '[DirectShow] was based on the merit system, with the idea being that, using a combination of the filter’s merit and how specific the media type/sub type is, one could reasonably pick the right codec every time. It wasn't really designed for a competing merit nuclear arms race.'

"A tool to help in the troubleshooting of "codec hell" issues usually referenced is the GSpot Codec Information Appliance, which can be useful in determining what codec is used to render video files in AVI and other containers. GraphEdit can also help understanding the sequence of filters that DirectShow is using to render the media file. Codec hell can be resolved by manually building filter graphs, using a media player that supports ignoring or overriding filter merits, or by using a filter manager that changes filter merits in the Windows Registry."

There is hope. Some market surveys paint a picture of a future with fewer compression standards in use by the surveillance industry. But for now we have to deal with all of them odd-balls as many as they are.

Video evidence everywhere

2010-12-10T16:29:00.000-05:00

"The advent of video-in-your pocket camcorders and cellphones, and the proliferation of surveillance camers, mean that events that once would have gone unrecorded are preserved for posterity--and, inevitably for trial."

An article recently published by the New York Times discusses the prevailance of video evidence. It explains the effect of video evidence on juries and rulings, as well as offers some predictions.

In the article, Professor Cassell, a former federal judge now teaching at the University of Utah, anticipates that in the future video evidence may need masking of parts of frames to ensure that the video has “'a laserlike focus on probative parts of the tape and exclusion of irrelevant parts of the tape.'”

Link to the New York Times article: "With Video Everywhere, Stark Evidence Is on Trial"

Need funding for forensic equipment?

2010-12-07T16:51:00.002-05:00

(Sponsored by StarWitness.com -- free software demo 888-685-2100)

There's a good article in the November Law Enforcement Technology that discusses how to apply for grants to purchase forensic equipment. They cite two grant programs that we know have been successful in securing funding for forensic video equipment: Paul Coverdell Forensic Science Improvement Grants Program and the Edward Byrne Memorial Justice Assistance Grant (JAG) program.

Link to the Law Enforcement Technology article: "Funds for Forensics"

Link to more information on the JAG grant program (estimate due date June 2011): JAG Grants at policegrantshelp.com

Link to more information on the Coverdell grant program (estimate due date May 2011): Paul Coverdell grants at policegrantshelp.com

Caught in the act by phone app

2010-12-07T16:50:00.002-05:00

(Sponsored by StarWitness.com -- free software demo 888-685-2100)

One man's video surveillance system e-mailed him a photograph showing a someone's head peeking around the corner of his backyard. He checked the live video feed though his phone's app and saw "two guys rummaging around." He called the police and put one technology-driven-citizen-activism case on the books.

Here's a link to then entire article at MercuryNews.com: San Jose man uses surveillance app on iPhone...

TV show airs on the side of reality

2010-12-07T16:49:00.002-05:00

(Sponsored by StarWitness.com -- free software demo 888-685-2100)

Every fictitious TV show we've seen exaggerates what can be done with video evidence. Castle got it right in one scene. "In the real world zoom and enhance can only get us so far."

Mistaken identity based on video evidence

2010-12-03T12:17:00.001-05:00

Wrong man arrested because he looked like the mask the criminal wore in the video evidence.

Here's the link: The white robber who carried out six raids...

Playing proprietary videos with Windows 7

2010-12-03T10:05:00.003-05:00

There's a murder at a local restaurant. During the investigation you discover there a digital video surveillance system. The restaurant installed the surveillance system in 2003, and it's been recording since. You recover the video footage by working with the restaurant owner to burn a CD from the video system. The owner tells you that the CD contains the video file and the proprietary software player that plays the video. When you try to view the video on your new computer you get an error message when you try to install the player. Why?

Your new computer is running Windows 7. The proprietary video player on the CD was created in 2002 prior to being installed at the restaurant. Windows 7 didn't exist in 2002. Thus, the video player software was not developed or tested for newer versions of Windows.

With Windows XP becoming extinct we decided to take a closer look at Windows 7 and proprietary video players. We tested 33 proprietary video players for installation and video playback under Windows 7. We also evaluated the ability and reliability of screen recording, a step necessary to proceed with a full analysis of the video.

We were able to install and run 31 of the 33 proprietary video players on Windows 7 without even putting on our thinking caps.

Great news. But that left some players requiring more than just click and play.

Here’s an example. When installing the Image Vault Player v8.6.0 on Windows 7 we got the following error message:

The version of this file is not compatible with the version of Windows you're running. Check your computer's system information to see whether you need an x86 (32-bit) or x64 (64-bit) version of the program, and then contact the software publisher.

What to do? (Hint: We didn't check our computer's system information or contact the software publisher.)

Go XP Mode

Windows XP Mode is Windows 7's answer to making older applications compatible. Windows XP Mode is new. It's based upon Microsoft’s Virtual PC technology. Windows XP Mode is essentially a copy of Windows XP 32-bit running on a virtual computer within Windows 7.

A legacy software application installed to Windows 7 in Windows XP Mode is available to run from the Desktop or Start Menu as if it is a Windows 7 application. The leggacy application looks and acts just like it is a Windows 7 application, but behind the scenes it is hosted in a virtual machine. This is done automatically by Windows 7 without anyone creating, maintaining, or starting up a virtual environment. (For the record, Windows XP Mode is not the only way to create a Virtual PC. You could use Windows Virtual PC, VMWare Player or Oracle VirtualBox.)

Run as administrator

Here’s another situation. When we tested the Sungjin video player it installed fine under Windows 7 but gave an error when we attempted to open the video to play it

The video could not be opened as a limited user. We ran the player using Run as administrator.

In Windows XP and prior versions of Windows all users were, by default, administrators on the system. This gave them the power to do anything they needed to do to their computer. This also gave many software applications and web sites the power to do anything they wanted to do to the system including installing malware such as Trojan horses and viruses. (Oops!)

To keep these problems at bay Microsoft recommended that Windows XP users create non-administrator accounts for their daily usage and use administrator accounts with discretion. Unfortunately, many software applications still required access to the administrator resources and would not run properly, which meant everyone just ran as administrator disregarding Microsoft's recomendations. The security vulnerability remained at large.

Windows 7 has a new security model called User Access Control where applications are not allowed to run with administrator privileges. In order for the user to run a software application that requires administrative privileges, such as our legacy proprietary video player application, Windows 7 provides a Run as administrator capability. As with any program that attempts to access privileged resources, the user is prompted for administrator account credentials.

Windows XP Mode and Run as Administrator resolved the installation and playing issues with the Image Vault Player and the Sungjin video players. In the case of two other players the roadblock occurred when attempting to screen record the videos.

Old screen-recording tricks die hard

If you know anything about screen recording -- the process of capturing the video from the screen as it plays in the proprietary player -- you know it's important for performing a thorough forensic video analysis. And you likely know there are some tricks to ensuring good results with some players. The tricks aim to prevent black screen recordings where you record the video and when you play it back all you see is blank video.

In the Windows XP world, the two tricks of disabeling hardware acceleration and locking the video card overlay surfaces would clear up the issue. Both of these force the proprietary video player to perform software rendering, which then allows the screen recorder to capture the video, rather than just a blank view.

The March Networks DVRPlayer v4.1 and McdPlayer (by an unknown manufacturer) are examples of players that install and run fine under Windows 7 but when screen recorded the result is a black screen. These players write directly to the video card, which makes it difficult for screen capture applications to capture their output.

Windows XP allows the user to disable writes directly to the video card, forcing applications to use software rendering, but most Windows 7 drivers do not support this feature. The workaround is Windows XP Mode. Windows XP Mode does not support hardware acceleration, thus, players are forced into software rendering mode and the screen recorder application is able to capture. Fortunately, both of these players support software rendering and were therefore screen-recordable with Windows XP Mode. If they didn't we might have been stuck. None of the 33 players we tested fell under this condition but there could be a player out there that isn't screen-recordable with Windows XP Mode.

If all else fails get a newer player

One obvious remedy is to use a newer version of the player software. A new version of the player released after the advent of Windows 7 should work.

An example is the Intellex Player version 2.2. We successfully installed this player on Windows 7, but it crashed when we tried to run it. We found the Intellex Player version 3.1. It installed and played video fine under Windows 7, and we were able to screen record the video with no problems.

Manufacturer websites and media-geek.com are good sources for downloading an up-to-date player.

Overall, things look promising for proprietary players and Windows 7. There are still some headaches, as there are with many things in transition. But there are some good solutions as well.

NOTE: We ran all tests using Windows 7 Professional 64 bit on a Dell Precision T3400 with 4GB of RAM and tested screen recording using StarWitness FreezeFrame.

How sharp is your eye?

2010-05-28T10:47:00.001-04:00

Can you spot them?

Any little detail could be case-breaking evidence. So peel your eyes and take a look at the two images to the right. There are SEVEN differences. Scroll down for answers...

Answers : backpack buckle, backpack strap, reflection in sunglasses, hair, dot on tie, sock,leaf.

Survey Says...

2010-05-28T10:32:00.003-04:00

Video Scene Magazine Survey:

Video Scene Magazine recently conducted a survey to find out how agencies work with video, and what tools they use. 75% of respondents indicated that they worked with video evidence and completed all the questions of the survey.

Your agency location by US Region

Of the people to responded to the survey, the majority of the responses were from the Southwest at 31% followed closely by the West at 29%.

Your title or rank

This was a free range question, so the results were pretty varied. The titles ranged anywhere from Detective to AV Specialist to Loss Prevention Manager. The majority of the surveyed were Detectives at 22% followed by Sergeants at 15%.

Number of full-time sworn officers in your agency.

82% of those who responded to the survey work in a department of 500 or less full time sworn officers. The remaining 19% ranged from 501 sworn officers to 11,000 sworn officers.

Population served by your agency

This was another free answer question, which gave us results ranging from 210 to 303,000,000. The majority of those surveyed fall in the 10,000 to 100,000 at 35%.

What department do you work in?

Of those who worked with video evidence the majority are Detectives at 41%, followed by those working in a Video Forensics department at 28% and in Technical Support at 21%.

How many years have you worked with video evidence?

40% of the surveyed who work with video evidence have worked in the field for 5-10 years. 36% have worked with video evidence for 1-5 years.

Have you presented video evidence in court?

54% of the surveyed who answered ‘yes’ to question eight have presented video evidence in court. 46% have not.

What type of video do you work with most?

92% of those who answered yes to question eight work mostly with digital video. 8% work mostly with analog video.

List any trade magazines you use to find information on video evidence:

36% refer to trade magazines. Here are a few of the magazines mentioned by our surveyors:

Video Scene Magazine
Evidence Technology Magazine
Forensics Magazine
Government Video
Law Enforcement Technology
DFI News
Video Technology and Applications
Digital Video
NATIA Trade Publications
Police Magazine
9-1-1 Magazine
American Police Beat
Adobe Photoshop Magazines
Law Officer
Information Week
Emergency Management
AV Technology
Security Magazine
ProAV
Wired
LEVA emails
Forensic Forum
Photonics Spectrum

List any websites you frequent to find information on video evidence:

53% do not frequent websites for information. 47% do go to the web for information. Here are some of the sites they visit:

www.media-geek.com
www.leva.org
www.google.com (Google searches)
www.dfinews.com
www.fourcc.org
FVA List
www.resvid.com
www.iai.org
www.videoscenemagazine.com
www.signalscape.com
www.adobe.com
www.apple.com
www.evidencemagazine.com
www.forensicmag.com
www.oceansystems.com
www.salientstills.com
forensicphotoshop.blogspot.com
www.imagingofevidence.com/blog/
www.starwitnessinfo.com

How many videos do you work in an average week?

67% work less than 5 videos per week. Most of the surveyed work 0-10 videos per week, very few work more than 10 videos a week.

Does your agency have equipment dedicated to video evidence collection/recover, analysis or enhancement?

82% do have dedicated equipment. 18% do not have dedicated equipment.

Does your agency have equipment specifically for working video in the field, for example a digital video evidence collection kit?

49% do have field equipment, 49% do not and 3% were not sure whether they do or not.

How many years has your agency worked with video evidence?

TOOLBOX: Technical Tips and Info

2010-05-28T10:22:00.001-04:00

Free Software Downloads and Reference Sites That Will Boost Your Video-Forensic Capabilities and Know-How.

Many steps and obstacles may sit between gathering video evidence at a crime scene and using it as a tool in the courtroom. How do you keep the evidence viable for the courtroom? How do you deal with possibly obscure digital file formats? Where do you look for answers when you hit a doorstop? To help knock out some of these obstacles, we’ve put together a list of useful free video software and reference websites.

Best Practices reference

The following links are best practice reference guides for
analyzing forensic video and retrieving video evidence from
CCTV systems.

SWGIT Best Practices for Forensic Video Analysis

Best Practices for the Retrieval of Video Evidence
from Digital CCTV Systems

Image Viewing Software

IrfanView: This freeware application will allow you to view and edit still
images on your system.

Codec Application Software

The following freeware applications will help you establish what codecs are required to play a media file, as well as identifying whether the codecs are present on your system. They will also point out problems associated with the codecs and the media files.

GSpot

AFREECODEC VT

MediaInfo

AVICodec

VideoInspector

Video Playback Application

This video playback and editing software application is geared towards processing AVI files. It can also read MPEG-1 files and handle sets of BPM images. It’s available as a free download.

Virtual Dub

File Extension Source

These sites are searchable file extension databases containing information about thousands of file extensions. Entries contain the file format, a description of the file and the programs that can open the file.

filext.com

fileinfo.com

Miscellaneous Video Tools

List of links to various video software tools, including decrypters, screen capture programs, video editors, video players and much more.

videohelp.com

fourcc.org: source for video CODEC and format information.

media-geek.com: A forensic multimedia community containing a variety of downloads and links as well as forensic video news, blogs and forums. This is a great place to go to ask questions about or read up on video forensics. It is also a great place to download proprietary players and codecs (click downloads from the menu).

The Switch to Digital: A New Kind of Collection

2010-05-28T10:01:00.005-04:00

The video surveillance industry is undergoing a dramatic change with the move from analog video tape systems to digital video recorders, or DVRs. The new technology has delivered real benefits to businesses of all sizes, but has created a new set of challenges for law enforcement.

Consider an example. A small business owner buys a four camera DVR surveillance system for under $500, and installs it himself in his store to replace his old analog tape system. He no longer has to bother with rewinding and swapping tapes, or worry about whether reused tapes are degrading the quality of his video. He can customize recording settings like frame rate and resolution that were not configurable at all on his old system. He may even be able to access and manage the system remotely from his home computer. When the day comes that his store is robbed, the business owner calls the police and waits for their arrival, ready to see his surveillance investment pay off.

Things aren’t so simple for the law enforcement personnel who arrive to collect evidence of the robbery. To begin with, they have never encountered this DVR model before. With the help of the business owner and the DVR instruction manual, they are able to play back the camera views from the time frame of the robbery. The investigators are glad to find a reasonably good view of the suspect from one camera. (Fortunately, the DVR was configured to record video at the highest quality setting.)

How should the video evidence be collected? Before, a VHS tape could be popped out of the surveillance system and carried away. But on a DVR, the video evidence is stored on a hard drive that is built into the system. This particular system does have a built-in DVD burner, and luckier still, the business owner happens to have a blank disc on hand. The investigators figure out how to burn the video to a DVD, and return to the station to play the disc, only to find the player doesn’t recognize it. After all that trouble, the investigators are not sure whether they collected any usable evidence at all.

The difficulties faced by the investigators in our example are real. There are presently over a thousand companies offering digital video surveillance and closed circuit television systems, meaning that unfamiliar systems are less the exception than the rule for investigators in the field. Where one system may feature a DVD burner for collecting video, another may have a flash card slot, and the next just an Ethernet port or analog NTSC video connection. And the absence of standards for DVR technology has produced a bewildering variety of video formats, many specific to the manufacturers that record them. This can make it difficult to verify a collected video, and difficult to share it with others who may need to view it.

Most DVR systems feature more than one option for collecting video, but they don’t always give the same results. That is why it’s important to make practical decisions ensuring you collect the best quality evidence available, whatever the scenario. This includes knowing what you should have in hand before leaving the scene, what collection methods and formats are available and how they compare, and what should be considered when verifying the evidence you collect.

Original Evidence and Working Copies

The choices you make in the field at the point of evidence collection start with one basic question - what do you need to have in hand when you leave the scene? You are likely to have several immediate demands for any video evidence you collect. For example, the video has to be submitted as sealed evidence, you’ll want to keep a copy on hand as you work the case, and you may need to quickly distribute the video to colleagues or media outlets. Each version of the collected video has a different purpose, and so there are different requirements for collecting and managing them.

The version of the collected video to be sealed, documented, and stored as part of standard evidence handling procedures is referred to as original evidence. This video should be collected as close as possible to the original source, and stored on an archival-quality permanent medium. Because the medium is not meant to be reused, affordable write-once media types like CD-R, DVD-R, and DVD+R are typically used for original evidence. The goal is to leave the scene with verified original evidence (or a verified transport media copy) in hand.

Any other copy of the video is referred to as a working copy. A working copy can be made from the original evidence at the scene or back in the office or lab. In those cases where video must be collected to a transport medium, such as a flash drive, it must be written to an archival format as original evidence as soon as possible.

Digital Video Evidence Collection

In simplest terms, the collection of digital video evidence from a surveillance DVR is about collecting data from the computer files on the DVR to computer files that can be carried away from the scene. Ideally, the collected video should be the same format as the video data stored on the DVR, but this isn’t always the case. So it is important to understand how video is stored on a DVR, what evidence formats may be collected from it, and what those formats imply about the quality of the collected evidence.

As it records, a DVR compresses video data to save disk space. Using a program called a codec, it encodes each frame of the video into fewer bytes by approximating similar regions both within and between frames. Some detail is lost in the process, but the smaller file size lets the DVR store a much longer surveillance history than would otherwise be possible. (The unfortunate trade-off is that a user may set compression levels so high that the recorded video is very blurry.)

The way a particular DVR encodes video during recording is called the native format of the DVR. In many cases, the DVR manufacturer uses a proprietary encoding as its native format. This means that the video is not interoperable with other systems, but can only be played back on the DVR itself, or using playback software provided by the manufacturer.

One way to collect video evidence from a DVR is to export it directly as a digital video file. The exported video may be in the native format of the DVR, or it may be recompressed using a standard encoding to allow playback on other systems. The distinction is important, because a recompressed video will lose some of the detail of the native format. The problem is that most DVR players (and instruction manuals) don’t make it clear what format is exported, so it becomes another unknown in the video evidence investigation.

Proprietary Format

A proprietary format is a good indicator that an exported video file was created in its native format, without being recompressed. An exported video likely has a proprietary format when at least one of the following is true:

Playback software is exported with the video (look in the same folder as the exported video data for an installer called setup.exe or a file with an .msi extension, or a readytorun player application ending in .exe)
The exported video data doesn’t have a common video file extension (like .avi, .mpg, .mov, etc.)

An exported video in proprietary format is likely to preserve date, time, and camera information originally recorded with the video. A disadvantage of proprietary format video is that it may not be verifiable at the scene, if the required proprietary player software is not exported with it. Standard Format An exported video likely has a standard format if both of the following are true:

The video data is exported as a single file
The exported video file has a common video extension (like .avi, .mpg, .mov, etc.)

Since many DVRs use a proprietary encoding for their native format, it stands to reason that an exported video in standard format may have been recompressed. Be aware that a higher-quality collection format may be available, and consider an alternate collection method if the collected video seems of lower quality than the original as seen on the DVR. Also note that a standard format exported video may lose date, time, and camera information recorded with the original video. Collecting NTSC Video Instead of exporting video directly to a file, sometimes video can be captured as it is played back. The captured video is recorded as an uncompressed video file to avoid unnecessary loss of detail in the collected evidence. A very high quality collection is therefore possible, depending on the specific capture method used. However, an uncompressed capture also produces a very large video file. For example, each minute of NTSC color video requires about a gigabyte of storage. Large files like this can be a challenge to share and to store as original evidence. There is also the possibility that the video data can’t be written to storage quickly enough to keep pace with the capture. When this happens, frames may be dropped from the captured video, which reduces the value of the collection as evidence. Finally, a video capture records exactly what you see as you watch it, so date, time, and camera information can only be captured as an on-screen overlay, obscuring regions of the video evidence. Collecting Image Files Sometimes, a DVR allows individual still image files to be exported, usually in JPEG or bitmap format. Still images are of limited use compared to video, but they can be helpful as quick review copies, or when no video collection option exists. Note that a bitmap file has an uncompressed image format, and preserves more detail than a JPEG-compressed version of the same resolution image. Collection Methods There are several different methods for collecting video evidence from DVRs likely to be encountered in the field. It is important to understand the advantages and disadvantages of each, as well as the video format collected by each one. This information will help in choosing the best option when a DVR supports more than one collection method (as many do). The collection methods are presented here by interface, since physical inspection is often the simplest way to determine the capabilities of a DVR. Removable Media Drive Some DVRs feature an internal drive for exporting digital video directly to removable media. Whether a tray for optical media or a slot for flash media or a floppy disk, an internal drive is easily identified as a collection option, though it may require additional inspection or investigation to determine which specific media types are supported. A video exported in this manner will have a proprietary or standard compressed format. A DVR with an optical drive can export video evidence to optical media, which may include CD, DVD, and Blu-Ray discs. The use of write-once media is recommended for evidence collection. Because optical media are associated with high-capacity storage, DVRs often support native format video collection by this method. Optical also has the advantage of being an original evidence medium, so the same physical evidence collected from the DVR can be submitted without any need for a transport medium copy. Optical discs may be used to collect long videos, though an export may be limited to a single disc. (In this case, a longer video may be exported as a set of shorter clips.) A DVR with a flash media slot can export video to one or more types of removable flash media. Flash memory cards are available in capacities of 16 GB and beyond, and can be a good option for collecting long videos. However, some DVRs may not support higher capacity cards. Though a flash memory card may be used as original evidence if needed, its relatively high cost makes it better suited as a transport medium, meaning that an extra copy step is necessary to create original evidence. Some older DVRs feature a floppy disk drive for exporting still images or very short video clips to a 3.5” floppy disk. A video clip exported to a floppy is likely to be highly compressed, due to the very limited capacity of the storage medium. A floppy disk may be used as original evidence, but if repeated disks must be collected from the same DVR, it may be more convenient to use the disk as a transport medium, and burn the collected files on an optical disc for original evidence. Computer Data Port (USB or Firewire) A USB or FireWire data port on a DVR may serve a variety of purposes, not all related to the collection of video evidence. On some systems it may be for attaching a removable media drive or hard drive to export video. On others it may be used to extend the storage available on the system for recording video. It might be used to connect an input device like a mouse or keyboard or as a maintenance port for system updates. And on a computer-based DVR it might just be a generic port. The use of a DVR’s USB or FireWire port may therefore require investigation of its purpose. The instruction manual for the DVR is the best resource for making this determination. If the instruction manual is not available, a label near the port and the options in the DVR’s on-screen menu may provide clues to using the port as intended. If the DVR can export video to a removable media drive connected to the port, the same advantages and disadvantages apply as collecting from the same type of internal media drive. For example, exporting video to an external flash memory card reader or USB thumb drive is equivalent to using an internal flash media drive. It may also be possible to export video to a USB or FireWire external hard drive. The high storage capacity of a hard drive makes it the best collection option for very long videos. A hard drive serves as a transport medium for video collection. It requires an extra step to create original evidence. Video exported from a computer data port to a removable media drive or hard drive will be in either proprietary or standard compressed format. Analog Video Output If a DVR displays video on a separate television screen or computer monitor, it may be possible to capture the display signal as evidence. The quality of the captured evidence will depend on what type of cable connects the DVR to its display and what type of signal is required as input for the capture device. Analog video capture may be inconvenient for longer videos since the video must be recorded while it plays and because the method captures an uncompressed video file. It also requires an extra step to create original evidence from the collected video, which is typically captured to a hard drive transport medium. Analog television S-Video and composite (RCA) connectors may be familiar from older consumer televisions and VCRs. A DVR may also output a composite television signal to a BNC connector, which is easily converted to RCA with an adapter. S-Video is a better quality analog source than a composite video signal. Computer monitors use different signals and connectors from analog television equipment. The most common computer monitors use VGA or DVI-I connections. A VGA connection transfers red, green and blue analog signals to the monitor over separate conductors bundled in a single cable. A DVI-I connector allows color information to be transferred digitally from computer memory to a digital display, but also provides analog color signals for backward compatibility with analog VGA displays through an adapter. Some VGA and DVI-I signals can be converted to S-video or composite television signals through a scan converter. However, this process reduces image resolution and signal quality and may not work with higher resolution display signals. If a DVR provides both computer and television signal outputs, the S-Video or composite television output will result in better capture quality than a scan-converted source. Network Connection Like a USB port, an Ethernet network port may serve one of several purposes on a DVR. Some DVRs can be networked to allow remote operation from another computer. Some can connect to network-attached storage to extend the recorded video capacity of the DVR. Some newer DVRs can use network cameras (in addition to analog cameras), and use the Ethernet connection for receiving video to record. As with USB and FireWire ports, an Ethernet port may just be a generic port on a computer-based DVR. Once again, some investigation may be necessary to determine the purpose of the port on the device. When a DVR is connected to a computer network through its Ethernet port, it may be possible for a computer on the network to collect video from it remotely. If a computer is already set up for the remote operation of the DVR, this is simply a matter of running the DVR management software on the networked computer and performing a collection as if the computer were the DVR. In most cases, the DVR management software will allow the video to be exported as either a proprietary or standard format compressed video. If the video can be played back but not exported, a capture may be performed on the computer monitor display port, producing an uncompressed video file. Verifying Collected Video Collected video evidence should be verified to confirm that a quality recording of the scene of interest was actually gathered. By verifying video evidence at the scene, the investigator has the opportunity to repeat a collection if needed. Waiting until later to verify the evidence may require a return trip to the point of collection, where the scene of interest may have been overwritten by the surveillance system. Video evidence can be verified by answering four easy questions. If any question is answered NO, another collection is usually indicated. Conclusion With so many varieties of DVR-based surveillance systems, there is no easy recipe for collecting video evidence that is right for every situation. By understanding the collection methods available on most DVRs and the types of video each method creates, you’ll be prepared to collect and verify the best available video evidence every time.

CSI: Durham

2010-05-28T09:33:00.012-04:00

VSM Exclusive Interview

A look at new uses for video forensics–-through the eyes of a Durham expert.

Technology is always evolving. Making the tools we use to fight crime more precise, more intense and more effective. But criminals are also evolving along disturbingly parallel lines as they try to outwit law enforcement.

Someone who has a unique view on this dynamic is Durham, NC CSI Officer Marilyn Coble. Unique in that she’s on the front lines in a city that’s viewed by outsiders almost like a coin–one side shiny (academics and medicine), the other scarred (crime). But also unique because her resume is dotted with experience which only forms a straight line when viewed in retrospect, from how perfectly it’s positioned her to do what she does today. Computer graphic design. Lab work. Crime scene investigations. And now, video forensics.

We sat down with Officer Coble to get her take on ways to use video to help solve crimes, even when the criminals are getting savvier about being ‘caught in the act.’

“Criminals know they’re probably being filmed now. They wear hats, keep their faces covered,” she says. “We’ve got to stay one step ahead of them.”

A Reliable Witness

“Witnesses, they’re usually upset, everything is a blur to them. They only remember seeing a gun.”

She’s talking about the recent daytime robbery of a fastfood restaurant near downtown Durham. There were people inside at the time–employees, some customers–but their recollections were typically hazy, blurred by the intensity and fear of the moment.

But one witness she’s found never flinches or flip-flops incidents. The surveillance camera. It’s going to answer all of the questions you have.

“So my first question when I get on the scene is ‘do you have surveillance?’”

She entered the crime scene as a member of the CSI team, but upon learning there’s a camera, quickly started gathering video for processing. The footage crystallized the entire robbery. Viewing it, she could see what areas to secure, and what areas to ignore. It served as a guide to their entire investigation.

“I saw they only touched this drawer and this drawer. They didn’t mess with the storeroom, didn’t go in the back, so we didn’t have to try to get prints there. We knew by looking at the weapon there would be no casings found. All that saves me time.”

The video worked almost like a play-by-play. She could scroll through it, pointing out specific spots to look for fingerprints or other clues. Her team focused on the counter and kitchen areas, and quickly found shoeprints on the countertop where the suspects climbed over. Three distinct shoe patterns were uncovered. The footage also gave the Durham Police a sense of the assailants’ heights, weights, race and what kind of weapon was used.

“So even though these guys had their faces covered, had gloves on, we had enough to start searching for them. Video gave us that.”

Two of the suspects are still being pursued, but one arrest has been made. The suspect’s account of the crime was corroborated by the forensic evidence gathered at the scene.

Crime Leads to Other Crimes

“Most of the times, these break-ins go unsolved. But in this case, he was taking stolen items and trying to use them. We weren’t able to get fingerprints or witnesses, but we could use the surveillance.”

Her next story details a much quieter showdown between criminal and storeowner.

The scene: a convenience store where one customer is acting oddly as he tries to pay with a credit card.

“The clerk noticed the guy was acting nervous, swaying back and forth, so he felt something was wrong.”

The card is declined, and the clerk’s suspicion rises. As the man leaves the store, the employee gets the plate information of the suspect’s car. Then he calls the police.

Once again, the camera caught the entire exchange, so when officers tracked the plate to an address, they were able to describe the suspect to the person living there.

“It made the detective’s job easier, when describing the suspect. When she heard the description, though, she said 'that sounds like my daughter’s boyfriend.'”

Officer Coble hadn’t done much to the photo in terms of forensics, just brightened the contrast and sharpened the blur. But it was enough for officers to get a clear sense of who they were looking for, and with the plate ID, where to go to look for him.

A different crime that had no such leads, though, was a series of car break-ins in a nearby neighborhood. Not a single witness. No fingerprints. Victims of the crime, however, had reported certain property stolen. Various electronic items, wallets. And several credit cards.

“So when we compared the numbers of the stolen cards to the numbers on his declined card, we knew there was a connection between the two crimes.”

They told the suspect they could link him to these car breakins, hoping that the pressure and fear of being arrested would soften the criminal. It did. He confessed to all the crimes, and eventually pled out.

The Hat Bandit

In the summer of 2008, three males took to robbing fastfood chains. The thieves worked in tandem, one acting as a lookout, one brandishing a weapon while the third robbed the cash registers.

Each wore bandanas and dark clothing, so facial features are out of the question. Latent fingerprint evidence at each scene proved useless. But one suspect was wearing an unusual, skull-and-crossbones cap. He wore it at every robbery, which was captured on surveillance video at three of the scenes.

Officer Coble downloaded stills from the digital surveillance cameras onto a CD. She scanned them, hoping for a clear shot of the ‘Hat Bandit’ as he came to be known. One store in particular had a few sharp images of the suspect. She frame-by-frame picked the best angles from the raw footage.

“For this case, actually, I had to adjust the contrast because of natural light coming from the drive-through. So typically I’m just adjusting brightness levels.”

She circulated the polished stills along with footage in Windows Media, standard operating procedure in today’s video-saturated world. She can often get this evidence to detectives within a few hours.

“When the detectives were able to see it, they were able to say ‘oh, that’s it, that’s him, no doubt. It really brought everything together.”

Soon after, the detectives pursued and pulled over a vehicle IDed by witnesses after another robbery. The driver was wearing a skull-and-crossbones hat. The arresting detective realized the link to the stills, and brought up the fact that they had plenty of shots of the cap on tape.

“At that point, he confessed. He gave names, too.”

The suspects are now serving time. It is unknown what hats they wear in jail.

Remote Control

2010-05-26T15:37:00.002-04:00

Everything You Ever Wanted To Know About Remote File Storage...

Coming soon to location near you: IP-Surveillance that can really cause a snag in your attempts to recover digital video evidence. IP-Surveillance, often called IP-based video surveillance or network video, uses a wired or wireless network to transport digital video, audio, and other data. While IP-Surveillance can provide a host of benefits to the owner with an “install it and forget it” mentality, for the investigator that needs to recover video evidence it can be more challenging than a recovery from a standard embedded digital video recorder.

The Internet is a global connection of networks that provides data connectivity between computers. The IP in IPSurveillance stands for Internet Protocol which is the addressing system for computers on the Internet. Cameras used in IP-Surveillance connect directly to a network and allow for the video captured by these cameras to be monitored and recorded from anywhere. While there is an option to store the video captured by these surveillance systems to a hard drive at the same physical location, many owners are opting to take advantage of off-site storage solutions.

The total cost of installing an IP-Surveillance system can be less than a standard digital video recorder installation. According to Axis Communications, a leading network video solution provider, using the existing network infrastructure decreases the cost of ownership. System costs are also lower because cameras used for IP-Surveillance use industry standards for encoding and can be accessed by a variety of on-site or off-site management applications.

Hosted Video as a Service (HVaaS) is a form of managed services for video surveillance applications. Managed services are the practice of transferring day-to-day related management responsibility to a service provider. For our IP-Surveillance solution, the service provider offers a webbased application that manages networks cameras and stores the video data in a remote location. This service includes the ability to view the video data on any internetconnected computer in the world. According to byRemote, Inc., a leading provider of off-site video hosting and IP camera management solutions, HVaaS is ideal for small business or residential customers who do not have the time, resources or space available to have a recording device at their location. Service not only includes off-site storage of video data but may also include technical support should a camera stop communicating with the off-site storage service.

Recovering video data for investigations from an IP-Surveillance system can be a challenge. Many owners may have forgotten how to access the video for playback or what service provider to contact. While these issues may be the same for a standard digital video recorder, with IPSurveillance there is no system to work with. According to Erik Tufteland, Forensic Multimedia Analyst from the Las Vegas Metropolitan Police Department, “I was able to discern that I was dealing with an IP based system from the fact that there existed no local storage, and research/consulting
of the brief manual of the surveillance cameras had no mention of any local playback or local export functions.” After a physical search for equipment and some pointed questions to the owner, Erik received an answer:

“I was directed by the owner to a website IP address and was provided a username and password. My only option was to log into the system, which then allowed me to view video from that specific business.”

For recovering video data, an analyst needs to include a variety of options in their recovery kit. When challenged by an IP-Surveillance system an analyst should have the ability to access the Internet and the means to capture the video data. Consider the following options for recovering video data from an IP-Surveillance system:

It is possible the owner of the system will know how to view the cameras. In that case you should be able to access their IP-Surveillance system from any internet-capable computer by going to the service provider’s website and entering a user name and password. John Flinn of the Fairfax County Police Department, Special Investigations Unit, Forensic Audio and Video Section says “I try to access the video evidence in several different ways. In my recovery kit I have a laptop so at the scene I can use the network to access the system.”

Using the website controls attempt to play back the video that was captured of the incident. Make sure your browser has ActiveX controls enabled as well as Java installed. These components are often used for displaying video over the Internet.

Look for an option to download the video data for each camera for a particular time period. Options that yield a proprietary file format will typically need a proprietary viewer. If downloading a standard file format look to change the compressor to an uncompressed or least compressed option.

Attempt to make contact with the service provider to determine options for receiving video data via a CD or DVD. If you need to make an official request for the video data make sure you request video with a padded time period and from all the cameras views available.

If you can play back the video from a web browser but can find no means to download video data, consider using a scan converter to capture the video as it plays back. A scan converter is a
technique for changing the vertical/horizontal scan frequency of a signal. In this application, the computer display would be converted to an analog video signal. Capturing this converted video signal using an uncompressed capture device would be best. Other methods of recording a video signal (DVD recorder, miniDV, DV25 capture devices) compress the video data further and will further degrade the quality of the image.

IP-Surveillance systems are becoming a more popular choice for installation as the benefits for ownership increase. The total cost of ownership is often less for a network camera system and managed service providers offering HVaaS offer a compelling argument for an owner to relinquish storage of their video data. When recovering video data for investigative purposes remember the video data may be located in an off-site location. Determine how the owner plays back and watches their cameras at the facility and decide on what you need to recover that video data: internet access, website and access information, a scan converter, and a capture device.

From the Editor

2010-05-26T15:32:00.001-04:00

Welcome to Video Scene Magazine, Volume 3 There is a new video in the world of forensic video. It’s not what you’re thinking. It’s not a multiplexed VHS tape from the scene of the crime. It’s not a digital video that took three hours to recover from a DVR. It’s not even a cell phone video from a bystander who witnessed it all. It’s exactly what you wouldn’t expect. It is cool. A cool video about forensic video. All those CSI watchers out there know forensic video is cool, don’t you agree? And when you watch this video you feel like you are watching an episode of a TV show: the video stars Annie Wersching from FOX’s popular TV show 24. In fact it feels much like an episode of CSI until that is… reality sets in. Why reality? Because this video is aimed at clearing up some misconceptions about forensic video. The video, titled “Caught on Camera”, speaks mainly to those who own video surveillance systems -- such as business owners. It also gives lots of great advice to be used by installers of video surveillance systems and law enforcement. The video provides a little over 21 minutes of education on how video surveillance can provide information in the fight against crime. It covers topics such as video resolution, camera position, lighting, image detail, CCTV site plans, video formats, best practices for video evidence collection and much more. Who is behind this video? The FBI Forensic Audio, Video and Image Analysis Unit or FAVIAU to all you acronym junkies. With this video FAVIAU aims to help the community of forensic video and law enforcement. It’s well produced, comes from a respected source and it’s cool. The next time you’re online check it out. You can find the video on the FBI’s YouTube channel at www.youtube.com/FBIDOTGOV Or just search YouTube for “FBI caught on camera”.

2010-03-02T09:56:00.011-05:00

Table of Contents Spring 2009

2009-04-09T10:04:00.000-04:00

Letter From the Editor - Participate in our first Video Scene Magazine survey

YouCrime.com

A look at how social and video sharing sites are helping police catch criminals.

By Jessica Kalendra

Desert Heat

Detective Patrick Smith talks to us about his video forensics lab at the Arizona Department of Public Safety.

Your Day in Court

Things to know and remember when presenting your case in court.

By Michael Elliott

To Save and Protect

Tips on handling video evidence before you take it to court.

By Jessica Kalendra

You solve it puzzle

How sharp is your eye

Contributors

From the Editor

2009-04-09T08:47:00.000-04:00

Welcome to Video Scene Magazine, Volume 2

Recent economic conditions seem to be delivering a double blow to law enforcement: an increase in crime coupled with a decrease in budget resources to fight that crime.

According to an August, 2008 survey of 124 cities reported by the United States Conference of Mayors, more than 4 in 10 cities have seen an increase in crime as a result of our economic downturn. The report also points out the resource and budget battles that agencies are currently tackling.

It’s a catch-22 for law enforcement: catch more criminals without consuming more resources.

These conditions have heated up the hunt for cheaper and smarter ways to fight crime. Our question follows: does video offer a smarter more efficient way to catch criminals? There are a number of studies that examine the effectiveness of CCTV as used by municipalities. However, there exists no study to date on the effectiveness of video evidence regarding apprehension and prosecution of criminal suspects. One thing we do know is that the presence of video evidence is ever increasing. In part due to rise in shared and recorded video. Video seems to be everywhere - its on video surveillance DVRs, cell phones, PDAs, computers, the internet, home entertainment equipment, and many more. That’s why video is mentioned in 9 of 29 sections of the National Institute of Justice’s Special Report on Investigative Use of Technology: Devices, Tools and Techniques.

We’ve all heard video evidence success stories, whether from our peers or in the press. Video evidence has led to countless confessions and convictions. As reported in the Fresno Bee, a recent homicide investigation provides us with one positive outcome. A video surveillance system captured two individuals while shooting a young man. The suspects originally pleaded self-defense, but after being told about the video evidence, they confessed to the crime.

Video evidence certainly seems to be a good place to look to improve crime catching–from the idiots posting videos on the internet of themselves committing crimes to all the video from the rising number of video surveillance installations on public and private property.

But still the question remains: exactly how good is video evidence in the fight against crime?

This issue of our magazine provides several articles that give more insight into how video evidence is making out in the fight against crime. In addition, we’ve developed a survey that will give us all some additional insight. Please participate in the survey at VideoSceneMagazineSurvey.com. We’ll publish the results in our next issue. Let’s all learn something from each other. It may help us find ways to improve how we use video evidence to fight crime.

YouCrime.com

2009-04-09T08:40:00.002-04:00

A look at how social and video sharing sites are becoming critical tools for police.

It’s no secret that video evidence has had a huge impact on the Law Enforcement community in the past couple of decades. Digital and Analog video recordings captured from surveillance systems at the scene of the crime have revolutionized the way police approach evidence collection. But it seems that there’s a new way of finding and using video evidence, one that has become more and more popular over that past few years with the increased popularity of online networking.

In early 2005, YouTube.com was launched, allowing users to upload, view and share video clips on the Internet. YouTube quickly grew to a reported 65,000 video uploads per day by July of 2006 and paved the way for similar video sharing sites such as Liveleak and Google Video. The public jumped at the chance to post videos with content ranging from clips of television shows to personal videos of themselves and friends. It didn’t take long for the Law Enforcement community to see the value of people posting videos of their actions–particularly when these actions are in some cases self incriminating. And especially considering that many people don’t realize they can and will be held accountable for what they do in these posted videos.

In addition to the rise of video posting sites, there is the ever-growing popularity of social networking sites such as Facebook and MySpace. Facebook especially has been gaining momentum over the years (150 million active users worldwide to date). A Facebook account allows the user to enter personal information about themselves, post and create picture albums, upload or link videos and create a social network. Ultimately, Facebook enables people from all over the planet to communicate, connect and share videos quickly and easily.

Recent news reports illustrate how online video posting and social networking have been useful tools for Law Enforcement officers to help solve crimes around the world.

Police use posted videos

The most obvious way police have utilized video posting and social networking is by allowing Internet users to incriminate themselves. There have been multiple cases of Police officers finding videos of crimes posted on YouTube or Facebook and tracing it back to and charging the poster.

For example, in March 2008, in a suburb near New York City, three Ossining High School students attacked an 18 year old in a church parking lot. One of the students recorded the attack on his cell phone, including imagery of his friends punching, kicking and cutting the victim with a pocketknife. The assailants then posted the clip, about a minute in length, on YouTube for anyone to see.

While interviewing students at Ossining High on an unrelated case, the police were informed of the video. The clip ultimately led to the arrest of the assailants on charges of first-degree gang assault. Without the incriminating video being circulated on YouTube, authorities would have had a more difficult job ahead.

Another example of using online networking was more recently presented in Indiana, PA right after the 2009 Super Bowl. The streets of the town were flooded after the game with 2000 rioters celebrating the Steelers’ victory. Several fires were reported and Philadelphia Street was temporarily shut down. During the riots, police were consumed with controlling the crowd and R were not able to make arrests on crimes being committed in the area. But the following week, a police officer in a neighboring town found YouTube videos and pictures on Facebook of two men setting fire to a couch during the riots. Using information on the user’s Facebook page, Indiana Police were able to identify the two men and ultimately file arson charges against them.

Police post videos

In New Zealand, police are using online social networking and video posting to their advantage in a different way. Instead of looking to the Internet to find incriminating videos, Queenstown police has taken advantage of the Facebook social network to circulate evidence by creating a user group titled “Queenstown Police”. They’ve posted multiple pictures and videos of local crimes in an attempt to get the public’s help in finding suspects, and have so far had at least one success.

In early January 2009, a young man attempted to break into a safe in a local tavern. During the robbery, the suspect apparently got hot, removing a balaclava he was using to cover his face for relief. A hidden security camera got a shot of this. Police then took the footage, including screenshots of the suspect’s face, and posted them on their Facebook group. The public was soon able to help authorities identify the suspect, ultimately leading to his arrest.

Though Queenstown’s use of Facebook may seem unique, their success could inspire others to start using social networking to help find criminals.

Concerned citizens post crimes

Police aren’t the only ones hoping to find value in YouTube and Facebook in the fight against crime. Citizens are trying to help the authorities by filming and posting crimes they’ve witnessed.

In fact, last Spring a woman living near downtown Seattle attempted to use YouTube to get the attention of local authorities. From her third-floor balcony, the woman was witnessing a number of crimes–drug use, prostitution and fighting, just to name a few. Though she attempted to report the crimes to the police, they were not responding. So she decided to take matters into her own hands, recording the criminal activities happening all around her. She then posted the videos on YouTube, giving them names like “Bums smoking crack in the afternoon” and “Crackhead makes a pipe out of a can while wearing a sombrero”.

The videos caught the attention of a local Seattle news blog, multiple TV stations and newspapers including the Seattle Times. The police were made aware of the videos–and many Seattle citizens were made aware of the potential value of posting videos online.

Security systems. Cell phones. Video cameras. There are more and more ways that every action around us can be captured on video. And Law Enforcement and private citizens alike are learning that simply posting this footage online can be a huge step toward solving a crime.

Desert Heat

2009-04-09T08:39:00.004-04:00

Another VSM Exclusive Interview

“Sorry about the cold.”

Detective Patrick Smith mock shivers as he sits down at his desk. The morning was unseasonably chilly, even for February, in a state known for its year-round arid warmth. But Arizona has also recently become known for something else–crime. Gang violence, home invasions, kidnapping, drugs, and, of course, the constant pain of illegal border crossing. As crime has intensified in this state, so has the Arizona State Police Department’s ability to fight it.

The agency is equipped with its own computer forensics department and training facility. Since its inception, this unique department has grown into a space for statewide officers to bring their cases, stay a week or two while they work, getting help from experts on site. It’s an ideal combination for uncovering buried data in a suspect’s hardware and software.

And, as it turns out, an inspiring model for video forensics, too. Just ask Detective Smith.

“I got going in 1998 doing computer forensics. I took what I learned there, started doing video. I had a VCR and knew Photoshop. I’d take frames, clean them up as best I could. Word got out about this, I guess, and people started coming to me for help.”

Visiting officers make a point to stop by Smith’s area, dropping off evidence or checking on current cases. He’s become the go-to guy for video forensics in the state, his desk the central hub for all things digital.

Now he handles from 20 to 40 cases a month. And unlike most state or local tech officers, he’s able to turn evidence around remarkably fast. Often, right at the scene of the crime.

“I’m pulling stills, and I can put it out to the media from there. Just a face sometimes, but it gives us a chance for immediate response from the public.”

In fact, in some cases, they’ve nabbed a guy before he’s even made his getaway.

He’s able to turn evidence around remarkably fast. Often, right at the scene of the crime.

“It was a robbery case. Convenience store. Some people saw the image on TV, called in saying ‘he’s at the bus stop!’”

Detective Smith’s bemused intensity as he relates this story hints at how unusual that arrest was, but the truth is most of the time they’re able to at least get a solid lead within three to four days of releasing the image.

That’s how it’s been for the last few years. In that time, his technology has evolved and improved. But even after a decade of examining evidence, he still has the ability to be surprised at some of the stranger aspects of the criminal mind.

“This one guy broke into a bar, “he explains. “The footage we got shows him just watching TV for awhile. His legs propped up, just chilling out. Then he gets up, sets the place on fire and leaves.”

Or a Phoenix store robbery that shows you can’t trust anyone by how they look.

“An elderly gentleman came into an insurance office, asked the lady there for directions. She helped him, he left. Then the man came back a few moments later and stole her cell phone and car. Two different cameras got the whole thing. Voice, all of it.”

Or the time Glendale Police called him to a scene.

“It was a home invasion that went bad. Three people dead. But a few houses down someone had a security camera, so we got a shot of the suspect’s car as he drove by.”

And that’s how video forensic work operates today. A camera, either at the scene or nearby, catches a shot of something, records it on a DVR or videotape. Detective Smith quickly turns the footage around, cleans it up, gets approval from his superior (often right there at the scene) and, when appropriate, releases it to the media.

It’s a constant tension, though–trying to get an image out quickly, but also being mindful of issues of liability and privacy. The latter is one of the reasons he’s wary of utilizing something like YouTube to expose footage to the general public.

“One agency approached us, but it’s hard for us to release footage that way. So much we’d have to edit out, so much we’d have to cover. If the subject was arrested and released, but that footage is still up there, he could be re-tagged.”

The detective shakes his head. “Very bad…local agencies trust us to only release the right stuff. Our policies and procedures are pretty strict, we make sure anything inappropriate is blurred out.”

Because timing is so critical–and because Arizona’s a pretty big state–Smith has endeavored to teach local agencies how to handle the basic elements of video forensics.

“If they’ll invest in a system, I’ll teach them enough to get them going. Any sophisticated enhancement, they can still come to us.”

This spreading out of expertise, even at an introductory level, has helped ease Patrick’s caseload while quickening the turnaround time for a case in places like Peoria or Phoenix (where the local agency can release the footage themselves).

Smith plans to use the computer forensics department as a model for his department’s future growth–so that this station becomes a centralized area where officers and analysts can come and work on video evidence, too. A bigger, highly equipped staff will be on hand, along with all the necessary technologies, to assist as needed.

“Speed is the main thing. Five years from now, every crime will be recorded on video. All our agencies will need someone who can get to their local crime scenes and have an image out to the media in 15 minutes. Our office here will need a ramped-up set of equipment so we can deal with all the evidence coming in. Tie into it from wherever they are and help output it quickly from DVRs or whatever the technology is then.”

“Speed is the main thing. Five years from now, every crime will be recorded on video."

He points to a collection of badges near his desk, a glimmering row of stars amidst his landscape of computers, monitors and scanners. Each badge bears an insignia of a local agency.

“I feel like I’m part of all of them, and help them however I can.”

THE LOWDOWN ON PATRICK’S FAST TURNAROUND.
Detective Smith is able to clean up and release footage at the scene of a crime using his unique recovery kit. Designed to handle a variety of archival methods, his kit can procure removable media like CDs, DVDs, USB drives and flash media. It contains a laptop computer, DVD writer, flash media reader and scan converter. Using a laptop that also incorporates forensic video analysis software helps Patrick verify the video evidence right at the scene and provides enhanced images at the time of recovery.

Your Day in Court

2009-04-09T08:38:00.002-04:00

As an investigator or officer, court day is the grand finale of your investigation. The opportunity to show off your good works. Court day has finally arrived. You have been called to the witness stand.

Courtroom testimony is a critical law enforcement tool needed to conduct investigations, enforce the nation’s laws, protect its citizens and maintain national security.

Accordingly, the ability to develop the skill set necessary to deliver timely, accurate and truthful testimony is vital to the success of these investigations. Without proper training and re-training, federal, state, and local law enforcement experts will continue to struggle in developing the necessary acumen to become a successful witness. No magazine article can take the place of that very important training. But we can discuss, as a reminder, some of the techniques and tips as they relate to Trial Preparation, Direct Examination and Cross Examination necessary to maintain an appropriate level witness fear and to seek “success instead of survival” in courtroom testimony.

Trial Preparation

An exhaustive review of trial preparation in any media would be voluminous. However we can focus on a few key requisites that may be of particular value to you. Proper trial preparation is clearly essential to the success of any investigation. Some of the key elements are: Report Writing, Pre-Trial Preparation, Evidence Handling and preparing one’s self as a Technical or Expert Witness.

Report Writing

Investigative reports are the cornerstone of any investigation. “The quality of the report will reflect directly on the officer’s value as an investigator, and therefore will always directly affect his credibility as a courtroom witness. It is, in short, the written record by which the quality of the investigator’s work is judged; it can compliment or damage the effect of their testimony.”

Sometimes lawyers will have their law clerks read reports backwards to check for typographical errors. Get in the habit of reading your report. Read. Read. Read… then read again. It is your report, know what it says.

Know the law as it applies to this investigation, specifically “as it applies to the use of the investigative report during testimony.” 2 Cases are won and lost on the little known facts of the investigation. Know dates, times, names, places and events. Remember you are the storyteller, so it is imperative you get the details right. Study the case file to include other officers’ reports. Finally, study the notes you used to write your report (peruse the details, don’t just glance at it the night before).

Pre-Trial Preparation

“Many investigators group case division into two main categories: the investigation and the trial. The thinking is that the investigator has done his job when the arrest is made and evidence is secured. From that point on, the case belongs to the prosecutor. . . Nothing could be further from the truth! The prosecutor. . . requires a joint effort from the beginning of the investigation to the trial verdict.”

Demand the prosecutor’s time. During pre-trial preparation, you must review your investigative reports, notes and evidence with the prosecutor. You are not rehearsing testimony–simply preparing for trial.

The need for pre-trail preparation is critical to the investigation, yet often disregarded. Don’t let this happen to you, “demand the prosecutor’s time.”

Evidence Handling

It is the nature of the human mind to “remember more of what they see than what they hear.” 2 Most of us are more visual and tactile than auditory in our ability to recall specific details of an event. Therefore, “except for the unlikely confession of a defendant or eyewitness identifications, nothing compares to the presentation of evidence,” 2 which can be seen, heard and touched. Remember, “what you tell them is testimony, what you show them are exhibits.”

Collection of evidence is vital. The who, what, when, where, victim’s assistance, equipment, investigative resources, exhibit list are decisive during trial.

Understand the theory of evidence admission at trial. This is to include the preservation of evidence including chain of custody; categories of evidence like direct and/or circumstantial; demonstrative evidence including the advantage thereof; scientific evidence such as that provided by expert witnesses and scientific evidence like photographs, videos, maps, models, diagrams and exhibits. 2

Exhibits are very powerful as evidence and it is your responsibility, along with the prosecutor, to present this evidence in a meaningful and impactful manner.

Direct Examination

Direct examination begins. This is by far the most crucial part of your job. The amount of hours you have spent on an investigation, interviewing witnesses, participating in surveillance, reading your reports, reviewing your notes are all for naught if you fail in the courtroom. It all comes down to this day, your moment to present the facts of the investigation as you know them in a court of law. You are not to concern yourself with “guilt” or “non-guilt. Your job is to tell the truth and present the facts to the judge and/or jury. It is worth repeating, “This is a crucial part of the case.” 3

“Direct examination is the questioning of a witness by a party who called him or her, in a trial in a court of law. Direct examination is usually performed to elicit evidence in support of facts which will satisfy a required element of a party’s claim or defense.” 3 For an officer or investigator this is usually the easy part. Remember, you are to provide the facts of the case, not your opinions. That is reserved for an Expert Witness. The prosecuting attorney under direct examination “is generally prohibited from asking leading questions.” 3 At this point in time, you should have had access to the prosecuting attorney and prepared your testimony. When this line of questioning is over, you may feel pretty good about yourself. A good prosecutor can make their investigators look extremely competent and prepared on the witness stand. You know the questions to be asked, you have prepared yourself through study. What could go wrong? Right!

Cross Examination

You are still seated at the witness stand. It is now the turn of the defense counsel to ask you some questions.“In law, cross-examination is the interrogation of a witness called by one’s opponent. It is preceded by direct examination and may be followed by a redirect.” 4 “In the United States, the cross-examining attorney is typically not permitted to ask questions which do not pertain to the facts revealed in direct examination. This is called going beyond the scope of the direct examination. The main purposes of crossexamination are to elicit favorable facts from the witness, or to impeach the credibility of the testifying witness to
lessen the weight of unfavorable testimony.” 4

Are you ready? Are you prepared? Remember to be truthful. Let’s begin.

The defense counsel will rise from their chair. Usually they re-introduce themselves to the court and in many cases for the first time to the witness.

Then the defense counsel may ask questions like these:
How long have you been an investigator or examiner for the agency of which you are employed? And during that time frame you have a good work record isn’t that correct?
As a course of practice you don’t make any mistakes in your investigations or examinations, isn’t that correct?
With regard to this investigation that you are here today, it is your sworn testimony that you haven’t made any mistakes, have you?
Is it possible that you overlooked something in your investigation or examination?
Since it is possible that you overlooked something, it would be possible that the thing you overlooked could have been very important, isn’t that correct?
Is it possible that if you had discovered that important piece of evidence or item of information, it could have led you’re investigation in a different direction?
Since it is possible that your investigation or examination could have gone in a different direction, then of course it must be possible that the new direction could have led you to a different result or person, isn’t that correct? 5

Have you ever found yourself in this situation? We all have. Most officers, examiners and investigators fail to take advantage of or don’t receive appropriate training on the proper methods of providing courtroom testimony. This is a systemic problem facing law enforcement today. Those citizens who are impaneled as jury members naturally assume that you are properly trained in all aspects of law enforcement investigations and/or the associated laboratory and forensics disciplines. Furthermore, that you are properly trained in providing testimony and you do so on a weekly or semi-periodic basis. It is the very lack of experience that creates anxiety when you are called to testify. 5

Technical or Expert Witness

“Technical or expert testimony is any testimony of expert scientific, engineering, economic or other specialized nature used to assist the court and the lawyers in a lawsuit or prosecution. An expert witness is a person who is a specialist in a subject, often technical, who may present his/her expert opinion without having been a witness to any occurrence relating to the lawsuit or criminal case. It is an exception to the rule against giving an opinion in trial, provided that the expert is qualified by evidence of his/her expertise, training and special knowledge. If the expertise is challenged, the attorney for the party calling the “expert” must make a showing of the necessary background through questions in court, and the trial judge has discretion to qualify the witness or rule he/she is not an expert, or is an expert on limited subjects.” 6

As a technical or expert witness, avoid the overuse of jargon. Some technical terms may be common knowledge in the work place but need explanation in the courtroom.

Acronyms are especially difficult for jurors to grasp and maintain any semblance of an accurate meaning. So it is probably best to stay away from them. If your testimony has to include acronyms, it is important that you repeat the meaning often enough that the jury will remember. It is your job to present the evidence in a meaningful and impressive manner. Take time to explain each acronym. Avoid the pitfall of thinking the jury will recall your testimony. Repeat and explain jargon and acronyms as frequently as possible. Take your time in answering questions. If a definition or explanation is needed, give one.

Never be universal in your comments. “These are statements that tell you something about an entire category. An example: All dogs are loyal. This statement relates two categories and tells you that everything in the category of dogs is also in the category of loyal things. You can consider this a universal statement because it tells you that loyalty is a universal quality of dogs.” 7 Anyone who has ever owned a dog knows that is not true.

Always remember to simplify your answers for digestion by the jury. “Make sure that you only answer the question you’re asked. Don’t ramble. Once you’ve answered the question, stop. Wait for the next question. It is usually a good idea to answer as many questions as possible with a yes or no answer. Be short, but be complete. If you’re asked to explain a certain answer, do so. Take as long as you need, but when you’re finished don’t go on to something else.” 9

There are many seminars specifically designed to address these matters. These training courses help alleviate the natural fear of speaking in public and reinforces a thought process to include organizational skills, how to be a better listener, how to speak with great diction, to be alert at all times – specifically to only answer the question as it is asked. It is not the intent of this article to address all the fine points of courtroom testimony but rather to offer an overview of the testimonial process. 5

Closing Statements

The burden of proof in a criminal trial is the obligation to prove allegations which are presented in a court of law. Under the Latin maxim necessitas probandi incumbit ei qui agit, the ordinary rule is that “the necessity of proof lies with he who complains.” 8

“The truth is very simple. You never get into trouble by telling the truth. Before you testify you will be sworn to tell the truth. Make sure that you do. If you have questions about certain areas of your testimony or if you’re worried about “how” to say something, ask your attorney. If you are concerned about whether to say “the cup is half full” or “the cup is half empty”, ask your attorney. Deciding how best to say something is not wrong if it is still the truth.” 9 Remember, no matter what – always tell the truth.

RULES OF EVIDENCE, ARTICLE VI. WITNESSES
Rule 603. Oath or Affirmation Before testifying, every witness shall be required to declare that he or she will testify truthfully, by oath or affirmation administered in a form calculated to awaken the conscience and impress his or her mind with the duty to do so.

To Save and Protect

2009-04-08T08:39:00.000-04:00

A step-by-step guide to handling video evidence from the crime scene to the courtroom.

TOOLBOX: Technical Tips and Info

Handling video evidence is a tricky business. Like any other piece of evidence, it is vitally important that it be handled correctly so that your results are credible in court. To that end, we’ve put together some tips and hints to make sure your video evidence puts criminals behind bars for good!

Retrieval – Master and Working Copies

A crime has been committed at a local gas station with a CCTV surveillance system. The system has recorded events that may be evidence to the crime. Now you must figure out how to retrieve and properly handle the video to ensure that, if it comes to it, the evidence will be credible in court.

The first step is to create a master copy of the video from the surveillance system recording. When it comes to the courtroom, this master copy is critical because it’s what the court will look to in confirming the integrity of images presented during a trial. So you must be sure to both create a master and document your steps while doing so. The master should be copied from the CCTV system in the native file format, regardless of the format. There are several ways to create the master copy from the CCTV system, but your ultimate goal is to have it on a Write Once, Read Many times or WORM media (such as a CD-R or a DVD±R). Once you have created the master, store it securely. Its only use will be in court to protect the integrity of images produced as evidence.

Next you will need to create a working copy. The working copy is what you will use in the investigation. Any enhancement of the video will be done to this copy only. It’s usually preferable to create the working copy in the native file format, but due to the large amount of proprietary CCTV formats out there, that won’t always be possible. If that’s the case, a format conversion will be necessary.

There are four main methods for format conversion:
Digital media with a proprietary file format. In this situation, direct conversion of the data is available by using functionality available from within the proprietary software that plays the video. Additional screen recording software is typically employed to complete the conversion process.
Digital media with a common file format. Some common file formats need conversion. This conversion can be performed by acquiring the correct video CODEC and employing it with a video player.
Output from an analog connection, such as a NTSC monitor output from a DVR, or connection via a VGA cable either from the DVR or from the replay PC.
Digital connections (such as network, USB or FireWire) typically provide either a proprietary or common file format. These formats can be converted via proprietary player or CODEC.

The end goal of each method is to create a video that can be easily played back and worked on without losing any data from the original format. Each of these options has benefits and limitations. It’s important to consider these as you work through a digital video retrieval.

With your master and working copy of the video, you are now ready to use your evidence to work the case. Here are a couple of things to keep in mind about the video:

Make sure the original recording of the crime is not erased without authorization. This may leave your evidence open to be challenged in court.

Try to store your media in a clean, dry environment and keep it away from strong magnetic fields, strong light and chemical contamination to prevent damaging the video.

Keep your DVDs and CDs in individual cases to prevent scratching and damaging them.

Make sure you define and label the master and working copies of the video.

Audit Log

One of the best tips we can provide you is: keep a detailed log of everything concerning the evidence. From the moment you come in contact with the video to the moment the evidence is disposed of or stored, be sure to log every action taken on the video. In fact, if not already in place, it’s a great idea to create a procedure that generates an audit log for every video. Some key details to include in the audit log are:

Details of the case.

Information about retrieving the evidence from the crime scene.

Details about the capture equipment used for retrieval.

Descriptions of the images captured.

Creation, storage and access to the master copy of the video.

Details on any analysis or clarification applied to the video.

Any copying of the master copy of the video.

Disposal details of the video and retention time of the video.

Keep in mind, when creating your audit log, make sure you have a date and time for every action in the log. Also, if you use software to enhance or process the video, check to see if the program creates an electronic log of the actions you take on the video. This may save you some time in creating your own audit log. Another helpful tool for creating an audit trail is having a Location, Equipment, and Incident Details Form to fill out while retrieving the video (see our example). Filling out a form like this at the crime scene will ensure that all of the pertinent information of the retrieval is accurately captured as soon as possible.

TOOLBOX: Terms

> CODEC – A CODEC is a program that encodes an audio or video stream for storage in a digital file, and decodes the same data for playback. Digital video created with a certain CODEC can not be played by or imported into a video player unless the decoder portion of the CODEC is installed.

> Component Video – Analog video output of a camera, videotape recorder, etc., consisting of three primary color signals: red, green, and blue (RGB).

> Composite Video – Encoded analog video signal that also includes horizontal and vertical synchronizing information. In the United States, Composite Video is standardized to the NTSC format.

> DCCTV – Digital Closed Circuit Television. A closed circuit television (or video) system that records digital video typically used in security applications.

> DVR – Digital Video Recorder. A DVR records video to a computer hard drive instead of analog tape. There are various types of DVRs. Surveillance systems are increasingly using DVRs.

> Embedded DVR – Digital video surveillance system that utilizes an operating system that boots from memory and not a hard drive. This system resembles an appliance or a self contained unit whose sole purpose is to act as a digital video surveillance system.

> PC-Based DVR - Digital video surveillance system that utilizes a full computer system. This system typically resembles a personal computer but has the ability to act as a digital video surveillance system.

> Proprietary Format Video – A digital video file that is formatted such that it is only usable by a proprietary playback software application.

> Proprietary Playback Software – Software from a DVR manufacturer that plays video files collected from that company’s DVR.

> S-Video – Separated Video. Industry standard for the way a signal is carried on the video cable. Utilizes a 4-pin mini plug connector. SVideo bypasses the comb filter in a device resulting in a better picture than Composite Video.

> Scan Converter – A device that converts output from a computer to standard television signals such as NTSC Composite or S-Video.

> Standard Format Video – A digital video file with a standard or common file format such as AVI, MPG, WMV, or MOV.

> Transport Medium – A medium or device that is temporarily used for data storage until data is transferred to permanent or archival storage.

> VGA – Video Graphics Array. Hardware video display standard of 640X480 pixels used for computers originally developed by IBM. Has been replaced by higher resolution standards.

Sample Location/Equipment/Indecent details form

You Solve it Puzzle

2009-04-07T19:55:00.000-04:00

How sharp is your eye?

Any little detail could be case-breaking evidence. So peel your eyes and take a look at the two images to the left. There are SIX differences. Can you spot them?

See the answer

Location/Equipment/Incedent Details Form

2009-04-06T20:33:00.000-04:00

Contributors

2009-04-06T09:49:00.001-04:00

Jessica Kalendra Jessica has spent the past four years working closely with the StarWitness development and sales team at Signalscape, Inc. Coming with a background in Marketing she quickly immersed in the community of law enforcement through StarWitness. Through her work at Signalscape she gained an understanding of the importance of video evidence in law enforcement. Her interest in the community has encouraged her to research and find new ways to help law enforcement solve crime using video. Michael Elliott With more than twenty-one years in the FBI, Mr. Elliott has held various positions including investigative experience as a Special Agent and Supervisory Special Agent Unit Chief. Currently, Mr. Elliott is Signalscape’s Director of National Intelligence Programs. He joined the company in 2007. Prior to joining Signalscape, Mr. Elliott was a Supervisory Special Agent serving as the Assistant Section Chief for the FBI’s Electronic Surveillance Technology Section. In this capacity, he provided leadership to the electronic surveillance operations and programs necessary to accomplish the FBI’s communications intercept (audio and data), video surveillance, and related data management missions. Mr. Elliott has extensive experience as a subject matter expert in the formulation and execution of legal and policy matters regarding court authorized electronic and physical surveillance. He also is certified as an expert witness with regard to law enforcement technology issues in U.S. Federal Court and represented the FBI on several law enforcement technical committees, intelligence community committees, Department of Justice technology review committees and foreign and domestic law enforcement working groups. Mr. Elliott holds a Bachelor of Science degree in Mechanical Engineering from the University of Tennessee and retired from the FBI in 2007.

Answers

2009-04-05T09:16:00.000-04:00

Previous Issues

2009-04-01T09:48:00.000-04:00

Summer 2008

Spring 2009

Table of Contents Summer/Fall 2008

2008-07-11T12:00:00.000-04:00

Letter from the Editor - Let us introduce ourselves

To Collect and to Serve

The limits and possibilities of digital evidence in law enforcement today - and beyond.

The Good, the Bad & the Blurry

A head-to-head comparison of analog and digital as they exist today. The results may surprise you. A must-read.

By Dorothy Stout

Direct to Video, an Interview

How did Hartsville, SC become a model of modern video forensics? Learn from the man himself, Lieutenant Brian Rudick.

Stay in Control

Do you start your analysis with a control? Should you? An insider's look at the pros and cons.

By Wayne R. Runion

Tool Box - Technical Tips and Info

Interoperability drive compliance and standard codecs are driving the ever changing video formats in the IP camera market.

By Steve Goodridge, Ph.D.

You Solve It Puzzle

How sharp is your eye?

Contributors

From the Editor

2008-07-11T11:58:00.000-04:00

Welcome to Video Scene Magazine

Video catches criminal acts everyday. One recent example, told to us by a Detective...The victim said he was cashing a check at the gas station. According to his story, soon after he left he was robbed at gunpoint. He indicated the two that robbed him were watching him in the gas station. We recovered the video from the station, isolated the two suspects and put a picture from the video on the news. Within a couple days, by way of tips, we had one suspect identified _ warrants signed _ and for the other suspect we had a nickname. While sitting on an area frequented by the identified suspect, we saw both suspects, wearing the same coats as in the video. After a short foot chase they were apprehended and both were later indicted for Aggravated Robbery.

Real stories like this are happening all over our nation and the world. Video is becoming the new way to catch criminals, and there is a lot of it out there. More and more video surveillance systems are set up everyday. But where does that video go? That video surveillance is now turning into video evidence and being leveraged to secure facilities and businesses, catch criminals and protect our homeland.

Much video is being used to do just that, but, sadly, some does go unused. It may be that a police department doesn’t have the proper tools. Or that a security office doesn’t know there is readily accessible (and sometimes free) software available to do some simple processing of the video. The time has come to educate the community of people who want to utilize video as a tool for law enforcement. With more knowledge, you’ll see that it’s not a gargantuan task to succeed at this with little in the way of a learning curve.

Experts agree and disagree as they do. Best practices are debated and refined. That’s natural and healthy, and we encourage that. Our purpose is to let you know what is going on out there. How are people helping their communities with video? Video Scene is our way of sharing knowledge. We hope you enjoy it in the years to come.

To Collect and to Serve

2008-07-11T11:56:00.000-04:00

The challenges–and possibilities–of digital evidence in law enforcement.

The average person is photographed or videoed 14 times on any given day. This includes those citizens who are a little shady, disreputable or downright criminal. Now that video evidence has reached this critical mass, it’s no surprise that footage is becoming an integral piece in our crime-solving puzzle. Yet with its ascension comes some interesting issues, especially when you’re talking about digital video.

Digital video is typically stored on a hard drive inside a DVR at the scene of a crime. Law enforcement can expect any number of experiences with this sort of foot-age–including ‘I can’t get the (expletive) video off of this DVR.’ The video ends up contributing nothing to the case. Or perhaps the video is collected from the DVR, but the quality is so poor that little can be discerned. Then there are the times where video solves a crime–and fast. Cases where no one saw anything–except for the video (watch a few episodes of CSI and you’ll get the impression this is what happens in every case).

But lets start with a frustrating example from the UK of the limitations of digital evidence.

A thief burglarized a man’s car in London. The incident took place during 1 of those 14 moments in his day in which the thief was being taped. In this case, by a neighbor’s home CCTV system. The footage went to the local police.

In most situations, evidence produced by a video surveillance system leads to new insights about a crime. Just how valuable these insights are may depend on how 'clear' that video happens to be.

But as it turned out, investigators had to suspend their search...due to lack of evidence. A spokesman for the police explained that the video footage had not led to any new insights because of the quality of the video. This sent the man, already understandably vehement about the crime, into another stratosphere of rage. “You can commit a crime and still get away with it de-spite being caught in the act,” he bemoaned.

But as anyone in law enforcement knows, being caught on tape may not equal being caught. In most situations, evidence produced by a video surveillance system leads to new insights about a crime. But just how valuable these insights are may depend on how ‘clear’ that video happens to be.

And what you’re able to get out of the video footage. Take, for instance, the new mother in Florida, who had been the victim of an unspeakable crime. Her one-day-old child was abducted from her hospital room by someone posing as a nurse. Just a few promises that the child was getting an eye exam and ‘poof,’ gone. In the sustained chaos and stress of a hospital environment, no one noticed.

Except, it turns out, for the video camera in the hallway. Analyzed footage revealed the suspect to be a woman, and showed her lurking around the halls hours before the actual crime. It also gave investigators an idea of how she got the child out of there unnoticed (in this case, a duffel bag). So while Florida police didn’t get an exact ID from the surveillance footage, they got enough clues to nab the woman (the local paper was also able to broadcast the footage on their website, allowing ordinary citizens to help with the case). Always review any video evidence at the scene of a crime to be sure to consider all the hints and tips in the footage below the obvious.

With all the possible outcomes and unknowns of today’s digital technology, you may feel a temptation to not even try to collect evidence. The hassles of transferring it off the DVR, the spotty quality issues that put our London man’s case into deep freeze, for example. But then consider the Florida mother, and where her case would be without that footage.

In the end, video footage is one piece of evidence. One element along with fingerprints and interviews and eyewitnesses in the pursuit of criminals. It provides tremendous opportunity to learn information about crimes. That’s what motivates each and every one of us to collect and analyze video evidence every day.

This article was adapted from a blog post. For more insights, updates and discussions, check out starwitnessweekly.com.

The Good, the Bad and the Blurry

2008-07-11T11:52:00.001-04:00

A Comprehensive Look at Analog and Digital

An armed robbery turns deadly when the perpetrator guns down a clerk. There were no living witnesses to the crime. Investigators search the scene for clues. Two different video surveillance systems are found covering the area of the crime: one inside the store and the other at the adjacent gas station. One video surveillance system is connected to an analog timelapse recorder. The other system is connected to a digital video recorder (DVR). One system provides evidence that is easy to recover and usable video images of the suspect. The other system...not so much. Which system, analog or digital, is causing the problems and why?

“The hard drive containing the video evidence is sometimes worthless without the DVR it came from. It would be like seeing a beautiful fingerprint at a crime scene but being unable to photograph or lift it for analysis."

Some people may be surprised to hear that the video surveillance system connected to the DVR is causing problems for law enforcement. Most information disseminated about digital technologies is that they are far superior to the older analog technologies. It’s digital, so it must be better. While that may be true for some technology, it is not necessarily true for the video surveillance marketplace. Propaganda from security manufacturers and installers tells a wild tale of image quality vastly superior to analog videotapes and features that make digital easier to use. From the perspective of law enforcement, nothing could be further from the truth.

One of the most important features for any video surveillance system is the ability to archive critical information onto removable media. The system needs a feature for the recovery of video evidence that can be submitted for analysis. On an analog system, the evidence is recorded to a videotape. This videotape is ejected from the timelapse VCR and submitted as evidence for analysis. Analog video surveillance systems incorporated this feature by default. Videotapes contained the evidence and their portability from system to evidence was simple.

On a digital system, the evidence is recorded to a hard drive. In comparison to an analog system the hard drive would be “ejected” from the system and submitted as evidence for analysis. Unfortunately, it’s not that easy. Some DVRs do utilize a removable hard drive enclosure in their design. This design makes it easy to “eject” the hard drive and submit it as evidence. One drawback of this design is the cost to replace the drive. If a videotape is seized as evidence, the cost to replace that videotape is around two dollars. The cost to replace the hard drive and its removable hard drive enclosure may cost $300
or more. The other drawback occurs when the hard drive is submitted as evidence. The data on the hard drive may be useless to the forensic video analyst. The hard drive containing the video evidence is sometimes worthless without the DVR it came from. It would be like seeing a beautiful fingerprint at a crime scene but being unable to photograph or lift it for analysis. Submitting a hard drive from a digital video surveillance system does not ensure that the evidence is in a format that can be used for analysis.

Not all of the DVRs use removable hard drive enclosures. To access the hard drive the system could be taken apart, screw by screw. Is it worth the effort to go this far in all cases? Consider also the size of the hard drive. Is it worth all the trouble to seize 500 Gigabytes of data that contain 30 days of information for a 15 minute crime? Is it worth all the trouble to seize 5 Terabytes of data that hold 365 days of information for a 15 minute crime? In some cases, the answer may be yes. In the vast majority of cases, the answer most definitely will be no. Removing the hard drive is not always the answer for recovery from digital video surveillance systems.

Knowing that replacing hard drives is expensive and those critical incidents needing to be archived may be short in duration, manufacturers of DVRs have incorporated alternative archival procedures. CD/DVD writers, USB connections, network connections, and flash media drives have all been included among others as methods for archiving video data from a DVR. Some of these methods may seem easy – a digital equivalent to “eject the videotape” from analog timelapse recorders. These alternative methods for recovering video evidence must be reviewed in terms of ease of use and image quality.

The ease of use issue also applies to the resulting video data that is archived from the DVR to the removable media. With each success of recovering the video evidence from a digital video surveillance system, comes the inevitable question: what does the video data need in order to play back? Just like the removable hard drive may need the DVR to play the video, the video data on a CD, DVD or any other media may need proprietary software in order to play back. Some DVRs may include this as part of the archiving package with the video data but many others do not. So the evidence we gather and bring back for analysis is useless without that player. Proprietary players are another hazard of the video recovery process.

The second factor with archival features is image quality. The archival feature may include the ability to provide video evidence as a standard file format. This may seem like an excellent choice. Video that is stored in a standard file format may be viewed from readily available players like Windows Media Player. The problem with these formats is that they often recompress the original data. A good comparison to this process would be to photocopy a document. The information is there but the quality is not the same. Having an archival feature that degrades the image quality is not an acceptable solution.

Video surveillance systems are quickly switching from analog videotape to digital video data. The illustration offered by the manufacture and designers of DVRs as being superior in quality and ease of use has yet to be realized. So what should law enforcement do? The answer is education, equipment, and standard operating procedures. With the strategy outlined below the recovery of video evidence from digital surveillance systems will be feasible. The resulting evidence will provide law enforcement with video information that can be used for investigative purposes and evidence in a court of law.

With analog video surveillance systems education was designed mostly for the forensic video analyst. This person was responsible for the enhancement of the video evidence for investigative purposes. The detective or crime scene analyst responsible for recovering the video evidence may or may not have received any training on this type of technology. From a recovery perspective analog video surveillance systems seemed very straightforward: recover the videotape and bring it to the forensic video analyst. It was the analyst who needed to know how to play it back, what tools were available for enhancing the evidence, and how to produce the derivative evidence that aided the investigation. Education was critical for providing these skills.

Now with digital video surveillance systems education must be provided to the person responsible for recovering the evidence and the forensic video analyst. The detective or crime scene analyst must have some understanding of computer technology and the design of DVRs. They must also be aware of the typical methods available for recovering video evidence as well as the pitfalls of each. With this education they will be able to look for the best evidence from a DVR and be able to make the right decisions in deciding what to keep as evidence. Education on surveillance systems should be available for each person who handles digital video evidence.

With analog videotapes, the most expensive purchase was for the forensic video analysis system to capture and enhance the video evidence. With today’s digital surveillance systems, money will also need to be invested in equipment for the recovery of video evidence.

Equipment is also a necessity for law enforcement in the pursuit of digital video evidence. With analog videotapes, the most expensive purchase was for the forensic
video analysis system to capture and enhance the video evidence. With today’s digital surveillance systems, money will also need to be invested in equipment for the recovery of video evidence. This recovery kit needs to be designed to handle a variety of archival methods. Not only should removable media like CDs, DVDs, USB drives and flash media be procured, but the kit should also contain a laptop computer, DVD writer, flash media reader, and scan converter among other key items.
Using a laptop that also incorporates forensic video analysis software will enable
the user to verify the video evidence at the scene and provide enhanced
images at the time of recovery. Recovering digital video evidence is best accomplished when the equipment necessary to do the job right is available.

Finally standard operating procedures (SOPs) should be developed for the recovery
of digital video evidence. SOPs provide the steps to be taken when faced with a particular event or operation. Designing SOPs provides a consistent manner in which to extract the video evidence. With digital surveillance systems, a thoroughly designed SOP can describe the methodology in extracting the video evidence. It can also describe at what point the technical level of the procedure escalates dictating when to call in the person with more advanced training. With a plan in place, everyone knows what is expected and how to make that expectation reality. The recovery of digital video evidence will be approached in a uniform manner
with SOPs.

Although digital video surveillance systems show remendous potential and are becoming the de facto standard, ease of use and image quality is still a concern when compared to its analog cousin. It was a fairly straightforward operation in analog systems to eject the videotape from the timelapse recorder, capture the evidence, and apply a variety of tools to enhance the evidence. The digital counterparts are far more complex. Each recorder has different control buttons, features, and menus. Digital evidence is harder to access and sometimes cannot be readily played. The image quality may have been compromised by the effects of compression. Digital video surveillance systems have a long way to go in order to be considered superior in usage and image quality.

Until digital systems can be streamlined in functionality, features, and ease of operation, law enforcement must prepare for the complexities involved with digital video surveillance systems. Education should be provided to any person who handles
digital video evidence. The ability to recover digital video evidence regardless
of the method can be ensured through the procurement of the proper equipment. Providing a uniform manner in which to approach and recover video evidence through SOPs is also necessary. It is mandatory for law enforcement to have the education, equipment, and SOPs to capture the best evidence regardless of system type.

So the next time an armed robbery turns deadly and a digital video surveillance
system is found, what will be the experience of the investigators at the scene?
Will they be frustrated with their lack of knowledge on how to get the video evidence? Will they lack the equipment necessary to recover the video evidence? Will they have systematic procedures to assist them in determining what needs to be done to get the video evidence? Or will they have the education, equipment, and SOPs in
place to ensure they walk away with video evidence in hand for enhancement and analysis purposes? Make the move to today – learn the technology, get the equipment,
and form a plan.

More on the quality of digital video

In a digital world, image quality is often measured in pixels. Typically the more pixels there are in an image, the higher the image quality. Analog timelapse videotape cassettes record an image equivalent to a digital image of 720 by 480 pixels. Most digital video surveillance systems utilize the same camera technology as analog systems. The video signal from the camera is converted to digital in the DVR and stored onto a hard drive. The digital system may capture an area of 720 by 480 pixels but typically we see picture sizes of 640 by 480 pixels or 320 by 240 pixels. By comparing pixels per image in a digital system to an analog system, the image quality may sometimes be only equal or lower.

The tale with image quality does not stop at pixels per image. Digital surveillance systems use a process called compression to reduce the overall file size of the data used to represent the video. Compression removes details within the image. The result is an image that is of lesser quality but with the same overall idea. The advantage of compression is that the overall file size is reduced. Therefore extended periods of time can be stored on a single hard drive. The disadvantage is that image quality is not maintained through this compression process. Compression degrades quality. For
that reason, image quality of digital video surveillance systems is not vastly superior to analog systems.

Direct to Video

2008-07-11T11:46:00.001-04:00

Hartsville, South Carolina may not be a metropolis by anyone’s standards. But when it comes to catching bad guys with video, its small brick police station on Main Street has become a central hub in the Southeast. And that’s primarily due to one officer.

Lieutenant Brian Rudick, a 13-year law enforcement veteran, started out analyzing footage a few years ago on a ‘cheap VCR-DVD combo, an old Sony time-lapse VCR and a TV.’

“I was just hoping to grab some screen shots. Anything to get a case going,” he explains. “The only other option at the time was sending it to the State Bureau. We had to drop it off at an evidence clerk, who is an hour away, and hope to get it back soon. But some cases are emergencies, so we needed something right here.”

It was around that time that videotaping hit what the industry calls ‘critical mass.’ In other words, every convenience store, bank, gas station and Wal-Mart started recording what their customers and employees were doing. More and more video started coming in, and started piling up.

“We were tagging video. Tons of it. Just putting it all in a box. It made me rethink how we were utilizing this evidence. We needed something beyond that.”

So Brian, who had hand-assembled his original ‘system’ (IE that VCR/DVD/TV combo), started looking into building a newer, more powerful one.

“But I quickly realized, with the legal issues and budget issues, that I needed a proprietary system. One built for this kind of thing.”

He started doing research, searching online and studying publications. He eventually selected StarWitness Video Pro.

That was 2005. Now Brian’s station boasts a state-ofthe-art video and audio system, including a server with a Terabyte of memory, a forensic video-enabled laptop, two monitors, hardware, a color printer and 5.1 surround-sound speakers.

But how did he go from an office stacked with videotapes and little way to process them to having one of the most sought-after forensics systems in the region?

It took some patience, classes, calls to Quantico and a few persuasive conversations with his Chief. But what it didn’t entail, at any point, was a single penny from him or his department.

“We got a Narcotics Grant, basically, through SLED (State Law Enforcement Division). That made it easier to convince Chief,” he says, laughing.

Once his agency secured the grant, it was just a matter of getting the necessary training. Like most officers of his generation, Ruddick had a basic knowledge of Windows and a facility with computers in general, but the training helped put him on a faster track.

“They were three-day classes. Simple explanations that gave me a big-idea perspective. Tech expertise on software–what filters do, how analog video is captured, deinterlacing. Just the background and the technical expertise
on the actual software.”

When he got back, Brian supplemented that training with “trial and error…learning the settings, seeing how it works. That’s where I got the most experience.”

And within two months of getting his system up and running, his expertise and new technology had resulted in an arrest.

“It was a forgery case, a bogus check. We had a real grainy, multiplexed shot of the suspect. When we cleaned it up, the case officer yelled ‘That’s Monterio!’ When we arrested the suspect, we brought along a nice, color 8X10 glossy. He confessed.”

Making His Case

Mastering the technology was just one dimension of his new tool, though.

“You had to show continuity of evidence for court cases. Show a judge the whole process. We took the entire system into his courtroom and explained to him what
some of the filters did. I did that once, and he hasn’t questioned any of it since.

“But we’ve had to educate people–defense attorneys, officers, the courts–what this technology can and cannot do. We call it the ‘CSI effect.’ It works for us and
against us.

“I tell my guys now, video is a tool. It’s not ‘plug my video in and I’m done.’ It’s a piece of evidence, just part of the case file. You never know what’s going to make
your case. So treat it like that. See what you can get out of it. It’s information…color of a vehicle, little details that can lead to a bigger picture when combined with other evidence.”

What people don’t know, though, can be a very valuable thing in some cases.

“Sometimes the bad guys don’t quite understand the limits. Which is a good thing. Sometimes you can only clean up an image so much. But I can throw that photo
down during an interview and tell them ‘I haven’t even started cleaning this up yet. Pretty soon, I’ll have it down to the pimples on your face.’ They usually fold.”

“We have an open-door policy. Detectives from all sorts of agencies bring us video. Even private industry. Our turnaround time is 24 hours. Sometimes, we can give it to them while they’re waiting. Usually before they leave we have a DVD or stills for them.”

Nowadays, the agency analyzes up 15 forensic cases a week (“depends on what the criminals decide to break into”). And Hartsville has become a true resource for
other agencies in the area.

What’s Next?

In the few years Officer Rudick has worked with video, he’s witnessed quite a few changes. So where’s he see this technology going in terms of helping law enforcement
in the future?

He sighs.

“It’s going to be interesting, with the FCC pushing us toward digital, which has its benefits and limitations now. I’m hoping that ICAP will support a particular standard
for a handful of recognized formats. We’ll need higher resolution, higher frame rates. That’s the challenge.”

He taps his desk and stares into the early morning sunlight, still considering the future of the technology that surrounds him.

“And circulation. Sharing the analyzed evidence, how that evolves, is exciting. Instead of just using stills to circulate to the press or in roll call. Depending on the type of case, I can see a higher level of connectivity making a huge difference for us. Remote access to businesses, schools, anywhere. So we can instantly download and circulate a bad guy’s photo or other evidence to every patrol car and officer in the area. And get the same kind of information back from those cars. That’s more than
just evidentiary. Even internal affairs issues could be resolved. That’s where I want to see it go.”

With so many cases–and a new promotion to Patrol Division Commander–under his belt, Rudick now has a simple, profound way to describe the power of using videos to capture criminals.

“I use the ‘light bulb in a dark room’ analogy. You go into a dark room, you can’t see anything until you reach over and turn the light switch on. You haven’t physically changed anything in the room. The data is in the image. We’re just bringing it out so you can see it.”

Be Like Brian
Lieutenant Rudick followed some easy, repeatable
steps to build and master his audio/video system.
His agency applied for and received:
• NARCOTICS GRANT through State Law Enforcement
Division (SLED) Counterdrug Technology Transfer
Program.
https://epgctac.com/
• Paul Coverdell Forensic Science Improvement Grant
Program through the National Institute of Justice
http://www.ojp.usdoj.gov/nij/topics/forensics/nfsia/
• Purchased StarWitness Video Pro and a state-of-theart
Audio System with grants.
www.starwitness.com
• Signed up for three-day Training Classes
18 www.starwitnessinfo.com/ForensicVideoTraining

Stay in Control

2008-07-11T11:40:00.000-04:00

A Practical Application for Forensic Audio and Video Examinations

By Wayne R. Runion

The term ‘control’ has long meant something specific and invaluable in the world of chemistry. But in the last few years, it’s come to mean something somewhat different – yet just as critical – to the world of forensic audio and video.

Random House Dictionary defines it as “to test or verify by parallel experiment or other standard of comparison.” Controls are widely used in the scientific community to verify results. One familiar example is the use of placebos in drug testing, in which placebos provide a point of reference or comparison for the experiment. But relative to forensic science, ASLCD considers control to mean “a standard of comparison for verifying or checking the finding of an experiment,” and requires a control conducted with each examination and the results documented (paragraph 1.4.2.8 of the ASCLD 2005 manual).

ASLCLD-LAB brought the issue of how controls were to be used in the Digital Evidence community to the attention of the Scientific Working Group on Digital Evidence (SWGDE), of which I am a former member. At the time, ASLCLD-LAB was incorporating the new forensic disciplines of Digital and Multimedia Evidence for accreditation. SWGDE found controls valuable for the forensic audio community and outlined a recommendation that controls be used in forensic audio in the SWGDE Best Practices for Forensic Audio:

“A control is a known audio test signal that is run through a system to ensure that the system produces the expected result. This gives an examiner confidence that the system will perform as expected when processing evidence. In forensic audio, the system is the complete signal path including playback, processing, and recording equipment, cables, and connectors. A control test should be run on the complete signal path before processing evidence.

The interval at which controls are run should be appropriate for the specific equipment used. Specifically, controls should be run:

Whenever a system configuration change occurs.

Regularly for equipment that experience wear.

When infrequently used equipment is put into service.

If a control test fails, evidence should not be run through the system until it behaves properly. When failure occurs:

Notify other examiners of the failure.

Troubleshoot the system to isolate the failed component. Recognize that the failure could be in a piece of equipment, a cable, a connector, or in an interconnection itself. Take the failed component out of service until it can be replaced, repaired or recalibrated, or it otherwise demonstrates reliable performance.” (chapter 4 version 1.0, January 31, 2008)

The Scientific Working Group on Imaging Technology (SWGIT) also outlines the importance of controls for forensic video examinations in their Best Practices For Video Analysis:

For tape based media
Prior to inserting videotape evidence into a playback device, ensure the equipment is functioning properly by inserting a non-evidentiary test tape of known signal and image quality. When playback of the evidentiary tape is less than optimal or signal dropouts occur, and the analyst suspects player idiosyncrasies as a potential factor, multiple players and/or recorders should be utilized to preview the tape. In some cases, this may necessitate retrieving the original recorder and/or camcorder unit. For example, head misalignment on the original recorder may produce a tape in which video playback is degraded or not viewable when played back on any unit other than the original recording device. Tracking adjustment may be necessary to optimize playback of the original video. (draft January 18, 2008)

In practice, a control is a known sample recording that contains audio and video (i.e. tone and color bars) of a known quality, played through the same equipment as the evidence recording. The control aids the examiner in determining if the equipment is functioning properly and all the connections are correct. My control contains known music and tones, color bars, black frames and the old movie countdown.

Maybe at this point you’re wondering if control is really important beyond being a necessary step for accreditation. Simply put, yes. A control actually serves several purposes. Use the same path or chain of equipment and cables that you intend on using for the analysis of your audio and video evidence. This will check that playback heads and cables are all in good working order and any intermediate devices (such as a compressor/limiter) are also not adversely affecting the audio or video.

For perspective, consider the dangers of not doing a control. Unintentional or accidental noises could be introduced on the digitized evidence tape. This might leave you with the mistaken impression that the signal was very noisy from the source, or just a really poor recording. You could be processing out noise that had accidentally been induced. Cables between the playback and the computer could be bad, or a dirty head or roller on an audio or video cassette player could grab and damage the tape. Running a control before performing an audio or video analysis not only provides information about the signal path, it also may save the evidence from harm.

Even if you are not in a laboratory environment and do not fall under accreditation standards, it is good practice to run a control before each and every examination. This will help ensure that your system and all intermediate devices are working properly, that no accidental noise has been added, and help prevent surprise damage to the evidence by dirty heads. Before you start processing evidence, run a control: it will help ensure that you begin with the best possible digital copy of your audio and video evidence recording, making your resulting products the best they can be.

TOOLBOx: Technical Tips and Info

2008-07-11T11:36:00.000-04:00

Video Format Trends in the IP Camera Market

Silicon and Demand for Interoperability Drive Compliance with Standard Codecs

by Steven Goodridge, Ph.D.

When connecting an analog security camera to an analog video recorder or monitor, one rarely considers whether the devices will work together. The NTSC and RS-170 analog video standards followed by hundreds of manufacturers virtually guarantee that if the products were purchased in the USA and the connectors fit, the video will come through intact. In the computer-driven digital video world, however, things never seem so certain. As standalone DVRs replaced tape-based VCRs for CCTV recording, a myriad of different proprietary video formats emerged. Now the future of video security is over IP, where every camera will digitize and compress the video remotely. What will this mean for the variety of video formats that video analysts will encounter?

The IP Camera Marketplace

Today over 1000 different models of IP video security cameras are advertised for sale by over 100 different manufacturer brands1. Many devices have specialty features such as pan-tilt movement, low light operation, and high resolution, each of which may be useful in a different part of a single security system installation. But systems integrators require that all of the cameras they install interoperate with the video software they deploy. The functionality of the network video recorder (NVR) software is of primary importance in a video security system installation. If a camera is sold bundled with NVR software, that software is typically weak on features and may only work with that manufacturer’s cameras. By comparison, enterprise-class NVR software is typically a third-party product that will work with many camera makes and models. As prices for IP cameras continue to drop (some are available for under $200) they have become commodity items, and those that do not interoperate with the leading NVR systems will see their deployment limited (in some cases, marketed only for private home use).

Popularity of Standard Codecs

Most camera manufacturers have pursued interoperability by using standard-compliant implementations of popular video codecs and network protocols. Over 60% of IP cameras on the market support the MPEG-4 (Part 2) or baseline H.263 (“MPEG-4 Short Header Mode”) video standards. Over 50% support some form of JPEG video transmission, and 18% support H.264. Only about 4% of devices on the market produce some other format
of video1. For maximum interoperability, many cameras support both JPEG transmission and one other, more bandwidth-effi cient codec. JPEG is a popular “lowest common denominator” video codec in IP cameras because support for decompressing JPEGs is built into virtually all web browsers.

Standard Solutions in Silicon

Another factor contributing to increased support for standard video codecs in IP cameras is the availability of ASIC components that implement high-performance standard codecs, such as IndigoVision’s IV8103 MPEG-4 chip and HiSilicon’s Hi3510 H.264 chip. ASIC technology allows computationally intense video compression operations to be performed with less power and at lower hardware cost per camera. The improved video quality, reduced data rate requirements, and lower cost of such ASIC-based cameras is driving older, programmable DSP-based camera designs into obsolescence.

Integration Challenges

NVR manufacturers pursue interoperability by testing their software on dif ferent cameras and augmenting their camera driver software as necessary. An NVR package may include hundreds of software drivers for different camera models. Besides decoding the video stream, NVR software must also be able to start and stop a video stream, and may provide other controls such as pan, tilt, and image characteristics. At present, many of these additional controls have proprietary implementations on each manufacturer’s brand of camera, which causes difficulty for NVR vendors and systems integrators. An NVR developer must obtain the communications protocol for each camera model from the manufacturer or develop their software to use the manufacturer’s proprietary software developers kit. This complexity led to a recent industry effort spearheaded by Axis, Bosch and Sony to standardize interfaces for network video products.

Fortunately, the syntax of video bitstream itself tends to vary much less from manufacturer to manufacturer because of the market-driven popularity of standard video codec implementations.

File Formats

Network video software such as an NVR may store video to a non-volatile file in a variety of ways. Typically, the video data will not be recompressed, as this would result in quality reduction and require significant processing resources, but the video data may be wrapped in either a proprietary or standard file container. Some NVR application requirements such as continuous recording, simultaneous recording/playback with time shift, multiplexing of many cameras, and storage of metadata may compel the use of a proprietary container file for surveillance data storage. However, most NVR systems allow the export of video clips to standard file formats. If the original recording was made using a standard video codec such as MPEG-4 Part 2 or H.264, it is technically feasible for the expor ted clip to be made using an appropriate standard file container (such as MP4) without recompression. Some NVR products allow optional reformatting and/or recompressing the video to a different codec when exporting a clip. Care should be taken to avoid such conversions where the quality of the exported clip is important.

The Future

At the time of this writing, many IP camera manufacturers (such as Axis Communications) have announced new product lines based exclusively on H.264 ASIC components. H.264 provides superior video compression efficiency and quality compared to other standard codecs, is used by many HD camcorders and is supported by Blu-ray disc players and many network-attached media extenders. This common codec provides the capability for both standard and high definition video to be transported from cameras to computers and consumer television components for archival and playback without any recompression artifacts. It is therefore likely that H.264 will gradually replace MPEG-4 Part 2 for IP video applications.

About the Author

Steven Goodridge, Ph.D., develops digital video surveillance and forensics technology at Signalscape, Inc. in Cary, North Carolina.

Contributors

2008-07-11T10:00:00.000-04:00

Dorothy Stout

Mrs. Stout, owner of Resolution Video Inc., has been involved in Forensic Video Analysis since 1998 with the U.S. Postal Inspection Service and the U.S. Department of Defense Computer Forensic Laboratory (DCFL). She has worked with the International Association of Chiefs of Police (IACP) and the Security Industry Association (SIA) as a forensic video/digital technical consultant. Qualifi ed as an expert, Dorothy has testifi ed in all levels of the United States Courts and continues to do so in civil and criminal cases involving video evidence. She teaches at the George Washington University and the British Columbia Institute of Technology. She is also an Adjunct Professor with the University of Indianapolis and was an instructor for the Law Enforcement Emergency Services Video Association (LEVA) Forensic Video Analysis and the Law classes. Mrs. Stout holds a Masters Degree in Forensic Science and a Bachelor Degree in Psychology.

Wayne R. Runion

Wayne is a retired Special Agent of the US Army CID Command. He has spent the last 15 years as a forensic examiner for the US Army Criminal Investigation laboratory, with the last seven specializing in audio, video and image analysis. His cases include examinations on the Tillman death investigation, Abu Ghraib prison, SGT Keith Maupin POW, Fort Bragg Sniper and LT Watada.

He is a member of the Law Enforcement and Emergency Services Video Association, National Technical Investigators Association, and was an active member of the Scientific Working Groups on Digital Evidence for seven years.

Steve Goodridge

Dr. Steven Goodridge develops digital video sur veillance and forensics technology at Signalscape, Inc. in Cary, NC. He has developed data analysis and decoding software to process video from hundreds of network video devices sold by scores of manufacturers. He also designs custom long-range, low-light, and high-resolution network video camera solutions for law enforcement and security applications. His other interests include digital video and image clarifi cation, video analytics, and audio processing. Dr. Goodridge
obtained his Ph.D. and M.S. degrees in electrical engineering at North Carolina State University and his B.S. degree at the University of New Hampshire.

You Solve It Puzzle

2008-07-10T17:01:00.001-04:00

How sharp is your eye?

Any little detail could be case-breaking evidence. So peel your eyes and take a look at the two images to the left. There are SIX differences. Can you spot them?