March Networks DVR Product Suite

Networked Digital Video Recorder

Storage and Retrieval Process

Demonstrating “Consistency of Evidence”

Revision 2

October 2000

 Note:

This document contains a description of the process that is followed when storing and retrieving recorded digital video from a DVR. This process is presented in the context for the admissibility of recorded digital video imagery in a court of law.

Digital video recording is quickly replacing analog methods for recording video. In particular, digital video recorders are being used in place of time-lapse VCRs in corporate security and transaction recording applications. This document proposes procedures to ensure the admissibility of digital video imagery captured with a March Networks DVR system when submitted in support of evidence in a court of law. Many of the recommendations in this document follow the U.S. Department of Justice, Federal Bureau of Investigations document, “Definitions and Guidelines for the Use of Imaging Technologies in the Criminal Justice System”.[i]

2         Digital Video Imagery

International criminal justice systems are more frequently seeing the use of digital video imaging in support of evidence, but its use remains somewhat controversial. Audiences familiar with “traditional” visual evidence such as analog videotapes and photographs have closely scrutinized the legal admissibility of digital files on computer media such as floppy disks, or CD-ROMs. For digital media and digital files, there is a dominant perception that manipulation of digital video imagery is a relatively easy process. This view stems from three main factors.

1)       Computers are becoming increasingly connected via corporate networks and the Internet to allow fast distribution and duplication of files.

2)       Computer users and software application tools are becoming more sophisticated.

3)       Significant publicity is given to the work of malicious “computer hackers”.

These factors can also affect chemically created visual evidence and cause greater speculation on their validity as well. The sophisticated software tools used to manipulate digital images can be used equally easily to alter film images and videotape footage where the changes are highly undetectable.

In order to prove that a digital video recording is a reliable representation of events, and counter-balance any questions on the validity of digital video imagery, standard operating procedures (SOPs) will be required. These will demonstrate that the chain of custody of the digital video imagery files has not been broken and that the files have been tampered with. With SOPs in place, and with an understanding of the basic functions of the DVR system, an organization can have confidence in the admissibility of digital video imagery captured with a DVR.

The next two sections of this document outline the technology-based elements of the DVR system that address the question of the validity of digital video imagery and recommended elements of  “Standard Operating Procedures” (SOPs) when preparing digital video image files for use in court.

3         Digital Video Recorded with the DVR

The following sections document the various mechanisms used by the March Networks DVR when capturing, digitizing, and storing video. Any expert witness called to attest the “trustworthiness” of a digital file created with a March Networks  DVR must be prepared to validate the following technological processes.

3.1        Video Storage

The March Networks DVR is a self-contained networked digital video recording device, which is capable of storing considerable amounts of digital video. The unit itself operates without the need for a keyboard, monitor, or mouse and the stored video is accessible only via a network connection using a compatible retrieval application. The unit does not participate in any of the domains typically used in a Windows NT environment and does not expose any of its internal resources to the network. This restricted accessibility ensures that only video that is captured at the DVR is stored on the internal hard drives. It would be extremely difficult, if not impossible, to delete recorded video from a DVR or to copy video that was captured at another location to the hard drives of the DVR.  To assist with the verification that the digital video file is a “trustworthy” representation, the video is stored in a compressed format with a date and a time associated with each frame.

3.2        Video Retrieval

Although the video can be retrieved over any network, only a user that is running the DVR Viewer or DVR Configuration Tool application can retrieve it. Since the recorded video has been stored digitally, the information retrieved is always “original copy”. Once retrieved, the recorded video can be copied any number of times and does not lose any integrity. The retrieved file is stored locally in an .AVI format containing H.263 compressed video. Anyone attempting to modify one of these files would require a high level of knowledge of both of these protocols and a significant period of time to make alterations. If it was suspected that modifications had taken place, the original recording could be retrieved again from the DVR in order to perform verification through file comparison.

3.3        Audit Trail

The March Networks DVR has a tamper-proof audit trail file that records every file retrieval transaction performed on a system. This file contains data of who accessed a particular DVR, when it was accessed and what camera recording was retrieved. This file cannot be deleted from the DVR system.

 

4         Recommended Standard Operating Procedures with the DVR Digital Video

4.1        Ensuring Continuity with Documented Procedures

The following elements are recommended as part of an organization’s Standard Operating Procedures (SOPs) used to ensure continuity of the recorded video that is retrieved from a DVR. These recommendations are based upon guidelines suggested in an article published in 1995 by Indiana lawyer, Richard Kammen and Indiana Crime Lab Institute executive director, Herbert Blitzer[ii], and in the Scientific Working Group on Imaging Technologies (SWGIT) Guidelines document[iii].

§         Archiving to Read-Only Media – following the retrieval process, the recorded video is stored as an archival reference copy on read-only media such as Write-Once Compact Disk Recordable (CDRs) for longer-term storage. This is a non-erasable media, allowing for additional data to be saved to the media and making it very difficult to remove or write over images already saved on the CDR. Many CDRs have engraved serial numbers on them, which prevents the possibility of falsified copies replacing an original.

§         Saving Time & Date Stamp Metadata with the Digital Image – as each image is retrieved and then stored onto CD, along with the image should be date and time stamp information that can be used to identify it.

§         Controlling Application Distribution – by controlling the distribution of the software application used for retrieving the recorded video from the DVR, the DVR Configuration Tool and the DVR Viewer, an institution can limit the number of copies of any digital video segment that will be made.

§         Controlling Chain of Custody of Image Records – in addition to controlling who can retrieve and save image records, file management procedures, such as determining access rights to different DVRs, and how archived CDRs are managed must be established.

§         Auditing the Retrieval Process – by having a senior representative present during the retrieval process, the validity of the data that was retrieved can be attested to by an individual other than the operator performing the retrieval.

§         Planning and Documenting Installation and Configuration – as the DVRs are deployed in the field, full documentation of the installation should be in place to allow the operator performing the retrieval full confidence in the scene source of the digital video. It is recommended that the “highest” level of video image resolution be used when recording to ensure the least amount of data lost in image compression.

§         Training of Personnel on Installation and System Use – all operators of the system must be trained on the installation of the entire system. Additionally operators must be trained on how to retrieve and save digital video files as the archival reference copy. If image processing is planned, full training on acceptable image processing techniques and documentation of processing must be in place.

4.2        Use of Technology Standards

In addition to following SOPs, an organization should work with a system that will be supported in the future even with technology advancements. By using standards-based systems rather than proprietary systems, an organization can protect itself and have its digital video files readable in the future.

5         Conclusion

In the overwhelming majority of cases, merely possessing and presenting video evidence is motivation enough to have cases settled out of court. In those cases that do continue to trial, a conclusive “consistency of evidence” argument can be made when SOPs as proposed in this document have been documented and followed. If required, verification of authenticity by experts knowledgeable on the technological processes of the DVR can serve to confirm accuracy and reliability of the video evidence.  Further means to authenticate digital video files through techniques such as watermarking remain non-standard without any legal precedence. As standards are established in these areas, March Networks will endeavor to develop Digital Video Recording systems that exceed customer requirements and adhere to industry standards.