Evidence Handling, Recording Media, Chain of Custody, and Data Protection
Preserving evidence
CCTV footage is evidence the moment an incident occurs, even if no one has asked for it. Understand preservation: export the relevant clip promptly before overwrite, in a native format where possible, with a hash value to prove integrity, and with the system clock verified. Know that overwrite cycles, automatic deletion, and editing destroy evidential value.
Chain of custody
Chain of custody is the unbroken documented record of who handled the evidence, when, where, and why. Each transfer needs a signature, date, time, and purpose. Store media in a secure, access-controlled location. Understand continuity of evidence: gaps or undocumented handling allow the evidence to be challenged.
Recording media
Know the main media: DVR/NVR hard drives, exported USB or optical media, and cloud storage. Exports should be write-once where possible, labelled, and accompanied by a statement describing the export. Keep the original unaltered; work from copies.
Data protection
Footage of identifiable people is personal data in most regimes. Understand lawful basis, retention limits, subject access requests, disclosure to police, and security of storage. Release only to authorised recipients, log every disclosure, and never share clips informally.
Traps
- The convenience trap: "email the clip to the investigator" - email may strip metadata and is not a controlled transfer.
- The edit trap: trimming or enhancing footage before export.
- The gap trap: a signed log with a missing entry between two handlers.
Rule of thumb
Export early, export native, hash it, log it. If you can describe the evidence's journey from camera to court without a gap, the chain is sound.
Worked example
A police officer requests footage of a fight. Correct practice: identify the time window, export native files, record the hash, complete the custody form with the officer's details, retain a copy, and log the disclosure - not to send a phone recording of the screen.