The DVR That Was Seven Minutes Fast
You are investigating a slip-and-fall claim for an insurer. The claimant says she fell on a wet floor at a plaza on 14 March at about 10:40 a.m. The plaza's manager gives you access to the DVR, which holds 12 camera feeds and overwrites after 14 days. You export three hours of footage from the camera covering the entrance to a 32 GB USB drive using the DVR's own export function. You notice the DVR clock is 7 minutes fast. You take the USB to your office, copy the files to your personal laptop, use video-editing software to cut the clip down to the four relevant minutes, add a title saying 'Claimant fall - 14 March,' and email the edited clip to the adjuster. You return the USB to the plaza manager because it is his property. Two months later, the insurer asks for the original. The DVR has overwritten the footage.
1. Identify the evidence-handling errors in this scenario and explain what you should have done to preserve the footage.
Read the worked answer
Several serious errors. You returned the only USB export to the plaza manager, did not keep the native files as exported, copied to a personal laptop, edited the footage, and added a title. That breaks continuity and makes it hard to prove the clip is an accurate copy. The DVR overwrote the source, so the original is gone. The correct approach is to export using the DVR's function, create a working copy immediately, keep the original export untouched on a write-once or hash-verified medium, record hash values, date and time, operator, equipment, and a chain-of-custody log. Do not edit the original; make a derivative clip and keep both. If returning the USB, first make and document a forensic copy. Never use a personal laptop as the only storage.
2. How should you document and explain the 7-minute clock offset?
Read the worked answer
Document the offset by comparing the DVR clock with a reliable time source, such as network time on a phone, and photograph the DVR clock and settings. Record the offset in your notes and in the exhibit log. When presenting a clip, state that the DVR was 7 minutes fast and give corrected times, but do not alter the native timestamps. Keep the unedited export and a hash. If you make a demonstrative clip, label it as a derivative and explain exactly what was removed and why. The court will want to know the process, not just the edited result.
3. What should you say in court when asked why the original footage is unavailable and whether the edited clip is reliable?
Read the worked answer
In testimony, do not claim the edited clip is the original. Explain the export, the offset, the copying, and the edit. Produce your notes and chain-of-custody log. If the original is unavailable because of your handling, concede that and explain what you did. The insurer may need to notify the other side. An edited clip can still be used if a foundation is laid, but the missing original may affect its weight. Your credibility depends on full disclosure, not on defending the indefensible.