Forensic Video Recovery

At the heart of digital forensics is the ability to recover data in a way that protects the original evidence. Today, video evidence is captured and contained on various devices, including digital video recorders (DVRs), mobile phones, personal cameras, home security systems, and body-worn cameras.

From private homes and vehicles to commercial businesses and government facilities, the use of video surveillance has never been more commonplace. The chances that an event critical to an investigation will be caught on video have increased exponentially. To have the highest opportunity for success, digital video footage must be collected and protected according to digital forensics best practices and industry standards.

Forensic Video Recovery Experts

Our experts have extensive experience, including expert testimony, regarding collecting, preserving, and analyzing digital video evidence. Even when a DVR unit looked to be damaged beyond repair through fire or water damage, we have successfully recovered the digital video.

Due to our comprehensive knowledge of forensic video data recovery processes and our specialized digital forensics expertise, our team has recovered video data in cases when others have failed.

Collecting and Protecting Digital Video Evidence

The digital video should be acquired and preserved based on the source of the video footage and how it originated. Collecting data from a digital video recorder is different than collecting video from the cloud or a mobile phone.

Digital Video Recorders

A digital video recorder (DVR) is a physical unit installed in a location that records video footage onto a hard drive contained inside the device. It is common for a DVR to record video footage for a certain amount of time and then begin overwriting itself with new video footage. Although digital forensics is heavily focused on data recovery, the overwriting of data with new data does, in fact, constitute true deletion.

Further, how the video is exported from the device is of paramount importance. If the video evidence is not exported in the most viable format and preserved correctly, or if the examiner does not perform the forensic examination properly, the evidence can be jeopardized. For example, if the video footage is exported in a low-quality format, and then the DVR overwrites the video footage of interest, the best evidence, high-quality video, can no longer be obtained.

An examiner performing forensic video recovery needs to thoroughly document their examination process so that another expert can duplicate the results. Without this documentation, it would be complicated, inefficient, or even impossible for another examiner to replicate the results, which would call the veracity of the evidence into question. Lack of proper documentation leaves evidence vulnerable to claims of spoliation, intentional, or unintentional, due to ineptitude.

To protect DVR evidence, our process includes:

• Creating a forensic image (which is simply a copy) of the hard drive inside the DVR to preserve the original evidence
• Cloning the data from the forensic image onto a new hard drive to use as a working copy
• Using forensic hardware and software, recovering and exporting the video footage from the copy in the highest possible quality available
• Documenting the process extensively to demonstrate that our examination produced the best evidence

Body-Worn Cameras

The video footage from body-worn cameras is contained in cloud-based applications and storage or at a physical location on a server or computer. In either instance, the video footage from these devices is usually contained inside proprietary software.

The benefit of these proprietary applications is that they usually have an audit log that cannot be modified or changed. However, it can be difficult to gain access to the video and these audit logs.

Having an understanding and familiarity with these systems is extremely beneficial during an examination. Our team of experts has first-hand knowledge of these devices and systems from wearing them while serving in law enforcement prior to joining Envista and/or through direct analysis and data acquisition while working on various cases.

Smart Home Surveillance Systems

Integrating smart home surveillance systems that connect to the cloud (remote storage) has revolutionized the consumer market for video surveillance systems. For a few hundred dollars or less, a home surveillance system can be installed by a layperson or homeowner in an afternoon. This video surveillance is usually of high definition quality with multiple recording cameras that can capture activity both at the home and on the street, the house next door, and more.

Further, since these are IoT devices, the video can exist and be collected from multiple locations, including a local computer, cell phone, or a cloud user account associated with the surveillance system. However, as with all forms of video surveillance, new or old, it is critical that the evidence be handled appropriately.

Depending on how the smart home surveillance system is installed and set up, it might only keep video footage for a short period of time before deleting it. When it becomes apparent that the recorded video could be of evidentiary value, it should be collected immediately by a qualified examiner. It also needs to be collected in a way that ensures the video is of the highest quality possible.