Forensic Video
Forensic Video is the single domain tested by the IAI CFVE examination. It covers the technical and procedural knowledge needed to acquire, preserve, analyze, and present video evidence: analog and digital signal fundamentals, codecs and compression artifacts, DVR/NVR export, hashing and chain of custody, frame timing, measurement, photogrammetry, comparison, and courtroom reporting. Expect questions that test why a method is defensible, not just what button to press. A recurring theme is least-destructive acquisition followed by repeatable analysis.
Core rules
- Preserve the original bitstream before any playback or transcoding; hash at acquisition and again after transfer. Work from a write-blocked copy.
- Distinguish capture rate from playback rate. Interlaced 1080i29.97 carries 59.94 fields/s, not 59.94 frames/s; PAL is 25 frames/s (50 fields/s); NTSC 29.97 timecode may be drop-frame or non-drop; confirm which.
- Record the DVR clock offset against a trusted reference and state the uncertainty; never treat an on-screen timestamp as ground truth.
- Calibrate measurements with in-scene references and report units, method, and error. Use same make/model/firmware/lens/lighting for comparison when possible.
- Follow SWGDE best practices and Daubert/Frye admissibility principles: testability, peer review, known error rates, general acceptance.
Worked example
A 25 fps PAL camera records a vehicle crossing two painted marks 18.0 m apart. The vehicle’s rear bumper is at mark A on frame 120 and mark B on frame 165. Time = (165-120)/25 = 45/25 = 1.80 s. Speed = 18.0/1.80 = 10.0 m/s = 36.0 km/h. The examiner documents frame numbering, measurement endpoints, and uncertainty. If the DVR clock is 2 min fast, that affects timeline correlation, not the calculated speed.
Traps
Treating a player’s “30 fps” display as the capture rate; deinterlacing and reporting doubled frame counts; measuring from re-encoded frames; assuming square pixels; ignoring GOP artifacts; failing to document hash values, tool versions, and DVR export settings; and asserting a positive identification from a few pixels.