Help With Criminal Case Needed - DVR Sporadically Losing Footage?

IPVMU Certified

Has anyone dealt with sporadic losses of video at various times on multiple cameras? I am working a Murder case and the homeowner’s Swann 1450 system caught the alleged suspect entering and leaving the home. All 8 cameras lost various lengths of video at different times. Some loss occurred while in infrared mode and some during full daylight. The system was set for continuous recording as far as I can tell. (A capacitor degraded on the original recorder and I had to buy a new one to view the video, but everything leads me to believe it was not set for motion). The hard drive failed, but was successfully cloned by a reputable company. Any ideas or experiences are greatly appreciated.

-Dennis

Reactions:

(1)

Undisclosed End User #1

I remember a presentation by the Mid-states NATIA chapter at their conference about similar missing frames, either last year or the year before. If you are LE reach out to NATIA and ask them to post the question on their forums and/or reach out to their members. Website: https://www.natia.org/

Reactions:

(1)

Dennis Eaton

In reply to Undisclosed End User #1

IPVMU Certified

Thanks for the lead. I'll do it now and post an update.

-Dennis

Reactions:

Sean Chang

Rasilient Systems

This is recording gaps. We typically see it in large deployments with many cameras. Yes, they are random. I am surprised to see it happens even in 8 cameras environment.

The recording gaps are normally due to drive performance. For 8 cameras, the drive needs to move to at least 8 locations to write to 8 files concurrently. If there is file system fragmentation, there are more locations to travel. The drive head movement is mechanical, and the latency can be too large. To a point, the only way for VMS to catch up is to drop the video.

The fact that you have a bad drive further indicates it is drive related.

Reactions:

(1)

(3)

Dennis Eaton

IPVMU Certified

In reply to Sean Chang

Thanks Sean. Would this issue occur with an analog system or just networked systems?

Reactions:

Undisclosed #2

I would think that storage drive throughput limitations would not be dependent on the physical delivery method of the data (RG59 vs CAT5).

Reactions:

(1)

Dennis Eaton

In reply to Undisclosed #2

IPVMU Certified

Thanks for the input. That makes sense.

Reactions:

Sean Chang

Rasilient Systems

From your description, it seems to be related to the drive. So, the drive problem could happen to both analog and IP.

Reactions:

(1)

Dennis Eaton

IPVMU Certified

In reply to Sean Chang

Thanks Sean. I need to be able to explain possible reasons for the loss of video when it gets challenged. I appreciate the information.

Reactions:

Sean Chang

Rasilient Systems

Dennis, glad I can help. There is an "infrastructure-side" of the video quality that people normally are not aware. The server/storage can drop video and the IP network can drop. It is more often than people think.

When something like this happens, someone, like you, needs to explain. In some cases, the video cannot be accepted in court.

This is our specialty. We have this term "forensic-grade video."

If you are interested in finding out similar cases, we have white paper (http://rasilient.com/forensic-video-surveillance-best-practices-white-paper/) and Youtube video.

Reactions:

(2)

Dennis Eaton

IPVMU Certified

That’s great! Our team will be looking at it today.

Reactions:

Luis Carmona

•Jul 03, 2018

Geutebruck USA • IPVMU Certified

The drive may have been "successfully" cloned, but you need to get more specifics from them on what their definition of success was. Did they encounter errors on the disk that could not be read, success meaning they were able to get only what was to be gotten? And of course the gaps could have already been there before the clone.

Reactions:

(1)

Dennis Eaton

•Jul 03, 2018

IPVMU Certified

Thank you Luis. Would errors on the disk confirm the drive malfunction? I'll call Kroll today and ask what they encountered.

Reactions:

Luis Carmona

•Jul 03, 2018

Geutebruck USA • IPVMU Certified

Errors on the disk means problems on the disk surface like bad sectors where the surface becomes unusable for data. If data was sitting on the sector when it went bad, then the data is gone and could explain your video gaps. It doesn't discount other possibilities like Sean pointed out also being a factor, but it would point to a pretty likely contributor.

Reactions:

Dennis Eaton

IPVMU Certified

Update:

While preparing for court I spotted a pattern on an excel spreadsheet which documented the “gaps” in our video footage. I noticed that the cameras all recorded continuously from around 4:30 pm until 6:15 am even though they were set to record on motion. I reviewed the footage and realized that digital noise caused the cameras to record continuously as the sun went down. As the sun came up and the AGC shut off, the cameras began to work properly, causing the few “gaps” cited by the defense team. There are a few very important events missing from the footage that I know occurred, although they were not recorded, i.e., the suspect opening the gate at the end of the driveway before leaving. I believe that the distance is too far away from the cameras and did not contain enough pixels to activate the motion-based recording. Is anyone aware of any documentation as to what the pixel threshold was for these types of systems was? The system was sold by Swann in 2013. How many pixels need to change to activate the system, etc?? I probably will not be able to recreate the scene to run independent tests before court, so I am looking for documentation to support my hypothesis that the gaps are due to motion-based recording and a few false negatives caused by images that were too small to activate recording. Any help is appreciated!

Reactions:

(2)

Undisclosed #3

IPVMU Certified

How many pixels need to change to activate the system, etc??

that might be tough to figure out as typically there is a sensitivity and area configuration that determines what should be considered motion on. given channel.

here is the screen from the swan dvr manual:

here is what they mention about how it works

here is the actual manual.

any chance you can fix that cap and fire up the old dvr to see what the settings were?

Reactions:

(1)

Dennis Eaton

In reply to Undisclosed #3

IPVMU Certified

That is very helpful, because I can point out how many variables are at play when determining why the video either did or did not record. I finally got the original unit working yesterday, so I was able to pull up the settings. The unit recorded almost continually, so we believed that the unit had been set to continuously record and that the hard drive had failed. Only after we realized that noise was the issue, were we able to get the unit working and confirm that the unit had been set to record on motion. I wasn't aware that there was a sensitivity setting on the system, so that will be my first order of business. The second will be to read the entire manual. Thanks for the help!

Reactions:

John Honovich

IPVM

I reviewed the footage and realized that digital noise caused the cameras to record continuously as the sun went down. As the sun came up and the AGC shut off, the cameras began to work properly, causing the few “gaps” cited by the defense team. ... I believe that the distance is too far away from the cameras and did not contain enough pixels to activate the motion-based recording.

That strikes me as being technically accurate.

Is anyone aware of any documentation as to what the pixel threshold was for these types of systems was? The system was sold by Swann in 2013. How many pixels need to change to activate the system, etc??

Even for a system today rarely is their explicit documentation that explains the number of pixels or other specific technical requirement needed to trigger motion detection.

You might suggest hiring a forensic video expert to testify that this is a normal behavior of such systems. I don't know who's who in that space but Grant Fredericks name comes up periodically in that field.

Reactions:

(1)

Dennis Eaton

In reply to John Honovich

IPVMU Certified

Thank you for the lead. I will reach out to him early next week. My only other thought was to attempt to recreate the scene and test for distance, but there are a lot of variables which could render the test unreliable.

Reactions:

Brian Karas

Pelican Zero

I am not sure you could re-create an outdoor scene like that accurately.

What are you trying to solve for? If you want to demonstrate how various settings could cause the same basic event to be either seen as motion, or not, then that would be pretty straight-forward to do.

If you are trying to show that settings X,Y,Z that existed in the recorder at the time of the event were the conclusive reason for the recording gap, that would be much harder to do.

In either case, if at all possible, I would recommend using the exact same camera as the one that was installed at the property to get the most accurate representation of how THAT camera would capture the lighting, and motion, of the scene.

Reactions:

Dennis Eaton

IPVMU Certified

In reply to Brian Karas

The original assertion was that law enforcement somehow erased sections on the hard drive. I believe we have adequately disproved that possibility. I'm just looking to show that motion-based recording does not occur simply because motion exists within the scene. I had a similar situation where a drive-by shooting occurred last year. The camera recorded continuously for hours due to a nearby branch blowing in the wind. As luck would have it, the wind stopped for 3 minutes just as the vehicle approached the victim and the recording stopped. Even though the vehicle and the victim were moving in the scene, they did not occupy a significant amount of the total pixels due to their distance from the camera. Unfortunately, the wind started blowing again right after the shooting occurred and no relevant footage was captured. I understand the concept, but I need to present it as a probability as opposed to a possibility. Hiring an expert witness is the ideal situation, but we only uncovered the fact that this was a recording issue as opposed to a hard drive failure yesterday.

Reactions:

Brian Karas

Pelican Zero

Gotcha. That seems like it would be very easy to demonstrate for a laymen's explanation.

Reactions:

John Honovich

IPVM

attempt to recreate the scene and test for distance, but there are a lot of variables which could render the test unreliable.

It's a understandable thought but I agree about the various variables being an issue. That's why I think having a video forensic expert testify that this is normal operation for systems would help.

Reactions:

(1)

Undisclosed Integrator #4

In reply to John Honovich

You may also be able to roughly approximate the scene for the purpose of motion detection triggers by pointing the camera at fixed image or screen - manipulating parts of the image to determine roughly how big an object needs to be for a given sensitivity level.

This kind of bench test is pretty simplified and may not directly translate to reality.

Reactions:

Dennis Eaton

In reply to Undisclosed Integrator #4

IPVMU Certified

Would the amount of ambient light impact the results or is recording simply triggered by the changes in a certain percentage of the scene? How closely do I need to recreate the lighting to ensure that the test is reliable? I know that complete darkness will mask much movement from cheap camera systems, but I can’t see subtle differences having much effect one way or the other.

Reactions:

Undisclosed #3

IPVMU Certified

How closely do I need to recreate the lighting to ensure that the test is reliable?

another approach assuming you have the original footage, and the original dvr (or a reconstituted original), you could try pointing the camera at a screen replaying old video segments.

adjust the camera so that it gets only the playback video. adjust settings on the monitor, like brightness/contrast (not the camera), until the live video matches, as closely as possible the recorded video.

of course the live video will be inferior to the recorded video to a degree, but maybe it would help you see the threshold in the actual scenes in question.

Reactions:

(1)

Undisclosed Integrator #5