Catalytic-Converter Video, a One-Hour Timestamp Gap, and a Redaction Request
A licensed agency is retained by a commercial landlord after 14 catalytic converters are stolen from a lot over six weeks. An investigator retrieves 11 hours of IP camera video from the property manager’s Windows PC. The manager exports clips to a USB drive, then emails them. The investigator also receives a 4-minute cellphone video from a tenant. The tenant’s phone shows 7:42 p.m.; the camera overlay shows 8:42 p.m.; the incident report says 8:10 p.m. The client wants a 45-second highlight clip with the tenant’s face blurred for a tenant meeting and wants the original USB returned because it contains other tenants’ plate numbers. The case will go to a criminal referral and a civil eviction. The tenant will not surrender her phone, but will let you copy the video.
1. Outline the steps you would take to preserve and authenticate the two video sources before editing anything.
Read the worked answer
Treat both sources as evidence, not media files. For the IP system, do not rely on the emailed clips; they may be compressed and stripped of metadata. Ask the property manager to preserve the original export and, if possible, make a forensic image of the relevant storage or obtain the native files with a written custodian affidavit. Record the system make/model, camera identifiers, time settings, export method, and the exact files selected. Compute a cryptographic hash-for example SHA-256-of each source file and of the working copy; store the source read-only and work only from copies. Log every transfer, who handled the drive, and when.
For the tenant’s phone, get written consent to copy, use a forensic extraction or copy the native file with its metadata, hash it, and document the phone model and time setting. If she will not surrender the phone, copy in her presence, photograph the screen, and get an affidavit. Do not edit, crop, or convert the originals.
2. How would you resolve the one-hour timestamp conflict, and what should the report say?
Read the worked answer
Do not silently “fix” the time. A one-hour offset commonly means the camera did not adjust for daylight saving time or is set to the wrong time zone, but it could also be a phone time error or a mistaken incident-report time. Establish the camera’s actual offset by comparing its overlay to an independent clock at a known event-an alarm activation, a POS receipt, a 911 call, or a carrier record-and document the comparison. Preserve the raw overlay and metadata.
In the report, present the recorded time, the independently established offset, and the normalized time, with the basis for the adjustment. If the offset cannot be verified, say so and avoid asserting an exact time. The incident report’s 8:10 p.m. is a human estimate and should not be treated as ground truth. The goal is transparency: a jury or defense counsel must be able to see exactly what was changed and why. Any derivative clip should carry a written note that the original overlay remains the primary record.
3. Respond to the client’s requests for a blurred highlight and return of the USB. What are the risks and conditions?
Read the worked answer
A 45-second highlight is a derivative, not the evidence. Create it from the hashed working copy, keep the full original untouched, and label the clip “redacted derivative for tenant meeting-not original evidence.” Blurring the tenant’s face is permissible for the meeting if the client has a legitimate privacy reason, but it must not obscure the event or mislead; preserve an unredacted copy and a log of the redaction method.
For the USB, determine who owns it. If the client owns the drive, the agency can return it after making a forensic copy and obtaining a signed receipt, but it should not return the only copy when a criminal referral and eviction are pending. Provide law enforcement a copy with a chain-of-custody form and keep the agency’s copy. The plate numbers are personal information, but they are also evidence; do not destroy or alter the original to remove them. Restrict access, log who viewed or copied the files, and advise the client that returning the drive does not erase the agency’s retention obligations or any litigation hold.