UK Video Forensics Insights

David Spreadborough [link no longer available] has been a police officer in the UK for 23 years, a forensic video investigator for 10. In an interview, he shared with us some insights of forensic video investigation from across the pond.

In this interview we discuss:

• The Biggest Pain Point
• Missing Video
• And How They Know It's Been Erased

Biggest Problem When Collecting Video

About 90 percent of video in investigations comes from private cameras. The biggest obstacle UK authorities run into when collecting video after a crime is the variation in DVRs that different people are using. This is the same complaint of investigators in the United States.

“If you imagine every computer operating system, there is probably 10 times that amount of digital video recording systems. Trying to keep up with all the changing ways that people hold video is hard,” he said.

For them, it’s like putting together a puzzle, backward, reversing engineering digital video recorders to find out exactly how they record, in order to extract video. For one case, a homicide, the process took six weeks.

If they can’t figure out how to extract video data at the lab, it makes investigations a lot longer and a lot more complicated.

“We may not be able to find out who had designed a storage method or the engineer who made it may have moved on to another company, or it was a person in some factory in Taiwan -- it’s down to us to do the digging and find out,” he said.

What would make his job even easier, he says, is if DVR manufacturers provided easy ways for law enforcement to see the process of getting video.

“Whenever we come across a new format, we’ll create an analysis document the we can refer to again. Companies don’t put that information [how to extract video] out there and they should. A DVR manufacturer should always have a law enforcement button on their website. That would be a simple answer to a massive problem,” he said.

What would make his job even easier, he says, is if DVR manufacturers kept video in standardized formats.

Old Systems Create Problems

The problem is so prevalent, Spreadborough says, because, in the early days, many recorders did not have export functionality. “We still come across those regularly. They are nine or 10 years old and were never designed to have to export the data. However, a lot of companies are getting the idea that they need to be able to get the evidence to law enforcement,” he said.

Forensic Investigators Can Tell If Someone Tried to Erase Video

“Usually if a DVR is formatted then we know. Because it’s just the index that has been formatted. We can recover the video data, but we just can’t recover the index. So we’d have 20 days worth of footage from 16 cameras but no idea when we’re looking at because the index is gone,” he said. He also noted that empty drives that are somehow formatted for Windows is also a good sign.

Video Data Admissible Without Video

But even without the video available, there are still times where testimony about what it contained is just as admissible.

He told of two instances where video data would be admissible without the actual video: A judge can rule a person is an expert on a particular video if they have watched the video hundreds of times for a case.

“Because they have watched it ten times more than the jury has, the court takes their view of the video as an expert witness. It saves you the time from playing the video over and over in court,” he said.

Another instance is if an officer has taken detailed notes of a video before the footage is lost, then his notes are admissible as an accurate record.

Who Should Export Video?

I asked him if it was preferred for end users to export video or if the police preferred to do it themselves.

For lower level crimes, as long as the person exporting knows what they’re doing and exports correctly, there are usually no issues. For higher level incidents, investigators will usually ask the video forensics team to consult on whether they should pull it or if the end user should.

“For very serious jobs, we’ll actually go over a do an analysis of the site and recover the digital recorder,” he said. Site analysis includes documenting the conditions the DVR was in when it was seized and any possible damage.

They photograph everything about the DVR including tool marks on the screw heads, anti-tamper stickers and seals. They also note the temperature of the unit.

“One of the first things I do [on a site analysis] is see how hot it is. That’s how a gauge whether I’m going to power it down and take it with me. The hotter a drive is, the less likely it’s going to power up again.”

Power to Seize Equipment

Spreadborough says that in contrast to the U.S., in the UK, a warrant isn’t required to seized a video surveillance system if police suspect it contains evidence of a crime under the Police and Criminal Evidence Act, but in 10 years, he’s never had to use that power. End users are mostly willing to provide video or DVRs. And the ones that aren’t can be persuaded.

“We have swapped out DVRs that we put in temporarily when we seize equipment so the premises aren’t left without surveillance. If we’re keeping their unit for a long period of time, we’ll buy them a new one. We only buy about one or two a year. Most of the time we can get it back to them,” he said. “Usually when I explain the issues to them and that we’ll be putting in a new one they are fine.”

Cloud Storage a Pain

Companies may look to cloud recording for off-site storage, but Spreadborough says that makes things more complicated for forensics investigators. It's easier for investigators to just take the DVR and have physical access to the data.