IAI CFVE cheat sheet

Forensic Video

• Chain of custody: document every transfer of the video file (hash, date/time, handler, purpose); a break in the chain can render the evidence inadmissible.

• Hash before and after every copy or conversion: MD5 or SHA-256 of the original file must match the working copy to prove integrity; record both values in the report.

• Native file first: always acquire the original file in its native format; avoid screen capture or re-encoding unless the native file is unavailable, and document why.

• Frame rate and time base: verify the actual frames per second (fps) and whether timestamps are absolute (real time) or relative (since recording start); DVR clocks may drift.

• Pixel aspect ratio: non-square pixels (common in DVR formats) must be corrected before measurement; otherwise horizontal and vertical measurements are distorted.

• Measurement validity: only measure in the original pixel space or after documented calibration; lens distortion and perspective require photogrammetric correction.

• Enhancement limits: interpolation (e.g., bicubic) adds no new information; state that enlargements are for display only and do not increase resolution.

• Export for court: use a lossless or visually lossless codec (e.g., H.264 with high bitrate or FFV1) and include the original file and a viewing guide; never provide only an edited clip.

• Authentication checklist: verify device clock, metadata, file header, and continuity; note any gaps, dropped frames, or re-encoding artifacts that could indicate tampering.