Video Forensic Analysis and Tips

Today, evidence from video recordings plays an increasingly significant role in the criminal justice process. It’s an example of the newer forms of evidence that law enforcement officials take into consideration when presenting facts in court cases.

Video footage from in-car mounted cameras in police cars, security cameras used for businesses, institutions, stores, etc. – plus footage from private citizens – is often surfacing as evidence in legal situations. Perhaps you have convinced your department head or company to install a surveillance system to monitor security situations and possibly detect instances of crime. And perhaps the camera/recorder has captured footage that may be key to a convicting a perpetrator. Unfortunately, during the “discovery” stage of the case, the defendant’s attorney states that something happened to the video recording; there is a glitch. He announces that a forensics expert is now on his defense team to prove that your video has been falsified and/or inadmissible.

This brief article covers video forensic examination tips that may keep your recordings glitch-free. If you are involved in video recordings that can be used for legal evidence, this article may save you from having your evidence challenged in court.

As a Video Forensic Expert, I’m often hired by law enforcement officials, attorneys and corporations to report on the methodology used in videos cited as legal evidence. As part of my work, I review many resources, like police chase footage, hidden-camera coverage from workplaces, retail store surveillance footage, and so on. The question I’m most often asked is to respond to is: “Was this video recording edited or altered in any way?”

To respond to this, forensic experts must gather scientific clues to answer the following questions:

• What do we know about this recording to be true (within a reasonable degree of professional certainty)?
• On what type of equipment was the video recording made?
• Is the original recording of the video available for examination?
• Is the original recording equipment that made the tape also available for examination?

While extensive technology is certainly involved in the video recording process, and this article cannot begin to address it fully, here are theories/procedures regarding examination which provide an overview of how forensic experts may need to examine and identify video anomalies.

Anomalies are abnormalities, deviations or “breaks” in the recording process as evidenced on the physical tape or digital video file. These aberrations can impact the legitimacy of a video (digital or analogue) as a piece of legal evidence.

Digital Video
When a videotape recorder or digital video recorder (DVR)/video camera records to videotape or DVR, the recording process creates a very structured format of code and information that is embedded on the tape or hard drive to create pictures and sound and signals. (Note, all videotape, except ¾” format video, travels from the left spool to the right spool when the machine is in the “Record,” “Playback” or “Fast Forward” modes. DVR recordings store video signal on hard drives using proprietary codecs or code and compression).

Digital video requires a different forensic process than analogue. Instead of recording the video image on tape, digital video is recorded on computer hard drives or digital video recorders (DVR).

Video systems that record digital video have several variable settings like frame rate and recycle time. If you look at the video below, you will better understand the importance of frame rate and forensic examination. Some officials and owners of digital video systems choose a lower frame rate to save on hard drive storage space. This makes it difficult for the forensic examiner to authenticate and identify events in question on the video recording. It is more efficient and effective for closed circuit television (CCTV) owners or purchase additional hard drive storage instead of choose a low digital video frame rate.

There are also several manufactures of digital video CCTV systems making it necessary for the video forensic expert to review operators and installation manuals for each system. I have been certified by the Pelco Global Institure in digital video and understand the details of digital video systems and the processes necessary to investigate digital video surveillance footage.








Analogue Video
On analogue tape, at the bottom of the tape (running just parallel to the tape edge) is the control track, or recording signature. Just above the control track is the composite picture and audio signal. On hi-fi VHS video recorders, above the composite signal, there are the hi-fi tracks. These are the physical areas of the recorded tape that forensic experts look at to determine if glitches – or anomalies, as they are professionally termed – exist.

There are two types of anomalies: non-destructive and destructive. A non-destructive anomaly is any deviation from the normal events one would expect to see and hear when viewing a videotape. In other words, a non-destructive anomaly or glitch in the tape could be an edit, an indication of a record interrupt or an over-record (recording over a previously recorded tape or segment of the tape).

When examining a tape for anomalies, the forensic expert must take all things into consideration. For this reason, it’s strongly recommended that the examination start by determining the origin of the recording device. If the machine that made the recording is available, a test recording – or exemplar – should be made using blank, unrecorded (virgin) tape. The goal here is to gather information on the alleged machine signatures from the original recording device used – that is, signals from the control track and the stop and start signatures. This is done for comparison purposes and to identify facts that may exist about the anomaly.

Next the tape being examined – i.e., the evidence or the alleged video containing the in-question anomaly – is viewed in “Play” or “Fast Forward” mode to determine the number of deviations or anomalies. Each deviation is carefully noted and examined using test equipment that helps to determine the characteristic of the anomaly. Much like the medical profession uses testing to research and document the reason for an illness, diagnostic tests are also necessary for forensics professionals; testing will eliminate certain factors so that real facts can be isolated to conclude, to a reasonable degree of professional certainty, the source or cause of the anomaly.

Many times it is necessary to physically examine the tape at the actual spot where the anomaly exists. An expert will physically examine the videotape itself to accomplish this, applying a special, non-destructive liquid to the tape which then develops the digital information so it can be reviewed. (This is much like how a photograph is developed, applying developer chemicals to the film.) Once the tape is “developed,” the expert can continue with the physical examination processes.

For a jaunt back in history – yes, in the “olden” days when I began my career – video recording tape was not yet in plastic shells but rather on spools, making it fairly easy to physically review the tape; but it was also quite easy to damage the tape’s edges since the tape was a good deal more exposed to mishandling. Videotape edge damage is considered a “destructive anomaly.” This damage can be in the form of a crease, tape crinkle, the result of a liquid spilled on the tape, etc. Of course, this can still occur with today’s videotape, even in the protective shell or tape housing, but not as easily.

Also, back then, videotape was comparatively more expensive than it is now. Thus, videotape was quite often recycled and recorded over for economy’s sake. As you might imagine, anomalies were fairly prevalent in those years. In one respect, this was good for my skills development as a forensics expert since I had the opportunity to experience dozens and dozens of destructive anomaly situations during the late ‘70s, for instance. This permitted me to gain great insight into their cause and nature.

When videotape started to be enclosed in cassette-styled plastic housings as VCRs gained in popularity, it became a bit more difficult to physically examine tapes for anomalies. So the scientific community evolved accordingly and developed new ways of testing.

Once you understand the science of how video recording works, how recordings and devices can be distinguished from each other, you’ll have a better understanding of how to go about identifying anomalies. I encourage you to read up on today’s video technology to advance your knowledge.
(You may also wish to refer to another article, “Forensics: Video Authentication Process,” included on this website.) Meantime, for simple practice in identifying anomalies, try creating your own:

Take a tape that has been previously recorded over. Fast forward the tape to about 10 minutes in and record something new, getting about 30-40 seconds’ worth. Rewind the tape and review your “over-record” characteristics. Take note of how the over-record starts and how it ends. These “in and out” points are characteristic of the equipment on which you recorded the program.

Of course there are many other forensic aspects in the study of anomalies –examination of stop/start record “signatures,” record-interrupt distances on the tape, study of the audio and video tracks, control track examination, application of magnetic tape developing fluid to further detect anomaly conditions – to name key areas.

But getting back to what’s most likely your interest in uncovering reasons for an anomaly, this works down to two essential questions: Did it occur as a result of wishing to intentionally cover up something? How do we know it wasn’t an honest mistake? And finally: Can we recover the images and sounds of the previously recorded material?

The answer is no. Once original material has been recorded over, it’s gone forever. But, as mentioned, the machine control track, audio tracks, etc., can provide recording “signatures” that exist on the physical tape; these may contain the clues toward determining others certain “truths” about the over-record. Our article on “Video Authentication Process” provides added information on these points.

When dealing with a video recording device and tapes that may be needed to substantiate legal situations: Make sure your equipment is cleaned and well-maintained and do not use videotape that has been recorded on previously. Use a new tape.

With the main investment already made in video equipment, the slight cost and effort to maintain that equipment – and the nominal cost of fresh tape stock for all recordings – is well spent. Having a clear recording on new tape stock (which avoids pre-existent anomalies that would exist on recycled tape) is an inexpensive way to better ensure your videotape evidence is solid and will be less apt to be court-challenged for authenticity.

800-647-4281