David Spreadborough [link no longer available] has been a police officer in the UK for 23 years, a forensic video investigator for 10. In an interview, he shared with us some insights of forensic video investigation from across the pond.
In this interview we discuss:
Biggest ******* **** ********** *****
***** ** ******* ** ***** ** investigations ***** **** ******* *******. *** biggest ******** ** ****************** **** ********** ***** ***** * crime ** *** ********* ** **** that ********* ****** *** *****.**** ** *** ************* ** ************* ** *** ****** States.
“** *** ******* ***** ******** ********* system, ***** ** ******** ** ***** that ****** ** ******* ***** ********* systems. ****** ** **** ** **** all *** ******** **** **** ****** hold ***** ** ****,” ** ****.
*** ****, **’* **** ******* ******** a ******, ********, ********* *********** ******* video ********* ** **** *** ******* how **** ******, ** ***** ** extract *****. *** *** ****, * homicide, *** ******* **** *** *****.
** **** ***’* ****** *** *** to ******* ***** **** ** *** lab, ** ***** ************** * *** longer *** * *** **** ***********.
“** *** *** ** **** ** find *** *** *** ******** * storage ****** ** *** ******** *** made ** *** **** ***** ** to ******* *******, ** ** *** a ****** ** **** ******* ** Taiwan -- **’* **** ** ** to ** *** ******* *** **** out,” ** ****.
**** ***** **** *** *** **** easier, ** ****, ** ** *** manufacturers ******** **** **** *** *** enforcement ** *** *** ******* ** getting *****.
“******** ** **** ****** * *** format, **’** ****** ** ******** ******** the ** *** ***** ** *****. Companies ***’* *** **** *********** [*** to ******* *****] *** ***** *** they ******. * *** ************ ****** always **** * *** *********** ****** on ***** *******. **** ***** ** a ****** ****** ** * ******* problem,” ** ****.
**** ***** **** *** *************, ** ****, ** ** *** manufacturers **** ***** ** ************ *******.
Old ******* ****** ********
*** ******* ** ** *********, ************* says, *******, ** *** ***** ****, many ********* *** *** **** ****** functionality. “We ***** **** ****** ***** *********. They *** **** ** ** ***** old *** **** ***** ******** ** have ** ****** *** ****. *******, a *** ** ********* *** ******* the **** **** **** **** ** be **** ** *** *** ******** to *** ***********,” ** ****.
Forensic ************* *** **** ** ******* ***** ** ***** *****
“******* ** * *** ** ********* then ** ****. ******* **’* **** the ***** **** *** **** *********. We *** ******* *** ***** ****, but ** **** ***’* ******* *** index. ** **’* **** ** **** worth ** ******* **** ** ******* but ** **** **** **’** ******* at ******* *** ***** ** ****,” he ****. ** **** ***** **** empty ****** **** *** ******* ********* for ******* ** **** * **** sign.
Video **** ********** ******* *****But even without the video available, there are still times where ********* ***** **** ** *********** **** ** **********.
** **** ** *** ********* ***** video **** ***** ** ********** ******* the ****** *****: * ***** *** rule * ****** ** ** ****** on * ********** ***** ** **** have ******* *** ***** ******** ** times *** * ****.
“******* **** **** ******* ** *** times **** **** *** **** ***, the ***** ***** ***** **** ** the ***** ** ** ****** *******. It ***** *** *** **** **** playing *** ***** **** *** **** in *****,” ** ****.
******* ******** ** ** ** ******* has ***** ******** ***** ** * video ****** *** ******* ** ****, then *** ***** *** ********** ** an ******** ******.
Who ****** ****** *****?
* ***** *** ** ** *** preferred *** *** ***** ** ****** video ** ** *** ****** ********* to ** ** **********.
*** ***** ***** ******, ** **** as *** ****** ********* ***** **** they’re ***** *** ******* *********, ***** are ******* ** ******. *** ****** level *********, ************* **** ******* *** the ***** ********* **** ** ******* on ******* **** ****** **** ** or ** *** *** **** ******.
“*** **** ******* ****, **’** ******** go **** * ** ** ******** of *** **** *** ******* *** digital ********,” ** ****. **** ******** includes *********** *** ********** *** *** was ** **** ** *** ****** and *** ******** ******.
**** ********** ********** ***** *** *** including **** ***** ** *** ***** heads, ****-****** ******** *** *****. **** also **** *** *********** ** *** unit.
“*** ** *** ***** ****** * do [** * **** ********] ** see *** *** ** **. ****’* how * ***** ******* *’* ***** to ***** ** **** *** **** it **** **. *** ****** * drive **, *** **** ****** **’* going ** ***** ** *****.”
Power ** ***** *********
************* **** **** ** ******** ** the *.*., ** *** **, * warrant ***’* ******** ** ****** * video ************ ****** ** ****** ******* it ******** ******** ** * ***** under ********* *** ******** ******** ***, *** ** ** *****, **’* never *** ** *** **** *****. End ***** *** ****** ******* ** provide ***** ** ****. *** *** ones **** ****’* *** ** *********.
“** **** ******* *** **** **** we *** ** *********** **** ** seize ********* ** *** ******** ****’* left ******* ************. ** **’** ******* their **** *** * **** ****** of ****, **’** *** **** * new ***. ** **** *** ***** one ** *** * ****. **** of *** **** ** *** *** it **** ** ****,” ** ****. “Usually **** * ******* *** ****** to **** *** **** **’** ** putting ** * *** *** **** are ****.”
Cloud ******* * ****
********* *** **** ** ***** ********* *** ***-**** *******, *** ************* **** that ***** ****** **** *********** *** forensics *************. **'* ****** *** ************* to **** **** *** *** *** have ******** ****** ** *** ****.
A curiosity for me. If Law enforcement can seize recorders to analyze the video, what if the recorder is running on a virtual system and seizing the actual hardware may also mean loss to the company for other services run on the same hardware but different virtual machines.
Are image backups acceptable to law enforcement? That is to say, we prefer not to give you the whole computer due to its function but we can do an image for you.
We're talking about the UK. They use tube cameras and 8 tracks to record video there....
John wasn't too far off but we are getting there! The difference here is that we have had surveillance video for quite some time and rather than a lot of new IP HD networks, the majority are old analogue setups with a DVR replacing the VHS deck and multiplexer.
If I can't pull the DVR because the data is on a linked server, or similar, then we may have to use external storage and then conduct a number of validation tests to confirm that the copied data is intact.
In large exports, we conduct a staged download, with the most important first and work from there.
A recent problematic system was a tower PC where the entire stores tills, ordering and surveillance was on the PC. Luckily all data was stored on a seperate internal drive, but getting it meant turning off the entire store. copying over 2TB of data would have taken ages but a quick swap out took the time to drink a cup of coffee.
If image backups are done then some sort of copy verification should be completed to prove they are a bit for bit copy.
Very interesting article. thanks.
I would love to hear David's opinion as for how does he view the problem of searching the video content itself. I assume than searching hours of video in a manual manner can be a pain. Does he use any method for having his searches done more effectivly?
Ariel
Hi Ariel,
You are right - it's a complete pain in the .....
The logging and searching of video data could be split into three seperate incidents.
If an integrated system has the ability to log events in realtime such as movements, direction of travel, vehicle colours etc then this is great but, this has to be exported with the video data, and the ability to use the analytical data has to be possible away from the scene/system.
A lot of Systems / DVR's have analytical services included but its sometimes not possible to operate it and use the system on-site.
In the last point you have two common types.
The first is that the footage has to be reviewed to search for an event linked to an incident. That could be a person running from a scene or a vehicle driving past.
The period of time to search and the actual event captured is also commonly not known. It is always a manual task to identify the search parameters and then review that camera, logging events of note until that viewer hits the jackpot.
The most difficult ones are when there are unclear directions of travel and perhaps a large timescale. When that viewer finds the target vehicle / person captured by a stores front door camera at 0400hrs - it can be a real breakthrough and that one image can dictate the entire direction of an investigation.
The second is when there are many events. A common one is thefts by an employee etc. These can be very time consuming and are used to show a pattern of intent.
Other times are when someones actions and behavior changes. A person enters a store every morning at 0900hrs. Then after an incident, they dont show up. It all builds the picture but finding it all takes time.
Effective searching comes down to intelligence led parameters. These parameters are then changeable as further intel / evidence comes to light. Its common knowledge that in the first few hours after the London Bombings, the location parameters were the entire UK!
So, at the start of an investigation we may grab as much as possible but as certain incidnets are discovered, decisions are made that negate further work.
After saying all that though I have been involved in many cases, where weeks worth of footage has been painstakingly viewed but the 3 frames of video found have made it all worthwhile.
There are a few tools now available to ingest video, set certain parameters and then have a large amount automated. For specific sites and footage these are useful but for the majority they can be more of a hindrence. As the technology improves and those functions are built in to systems the situation will improve.
Hope that helps a little?
Hi David
Thanks for the comprehensive and insightful answer.
For your information, I am working for a technology company that develops some analytic tools to search specific events from recorded video. Obviously such tool cannot solve a crime immediatly, and still requires the decision making process of the investigator. However, we do believe that we can remendously help a video investigator in his search task.
I'd appreciate if you could contact me directly at af@agentvi.com so we can discuss this further.
Best regards
Ariel