The food court handbag: retrieval under time pressure
At a shopping mall in Ludhiana, a customer reports on Monday morning that her handbag was taken from the food court the previous Saturday at about 20:40. The mall runs 32 IP cameras into a 32-channel NVR fitted with four 4 TB drives, giving roughly 21 days of retention at the current average bitrate of 2 Mbps per camera. The complaint reaches you, the contracted CCTV auditor, on Wednesday, four days after the event. The facility manager wants 'the clip on a pen drive by this evening'. You find the NVR recording continuously at 1080p with no motion-based archiving, the shift operator has already played back and paused the relevant channel many times, and the export menu offers AVI, a proprietary .dav format and 'raw'. There is no write-once evidence server, no hash logging, and the guard who took the original complaint wrote the time as '8:30-ish' in a notebook.
1. Set out the retrieval and preservation steps you would take from the moment you reach the NVR, and explain why each one matters for the footage's later use.
Read the worked answer
Order of work, and the reason for each step
- Stop casual playback. Ask the operator to stop scrubbing the channel and note who used the console and when. On low-cost NVRs, repeated playback fills thumbnail caches and, on some models, a paused live view keeps a pre-event buffer cycling.
- Fix the clock reference. Photograph the NVR on-screen time beside a phone or network clock showing IST with seconds visible. Every timestamp in your report is worthless without this offset.
- Export the native stream first. Use the .dav or 'raw' option for 20:00–21:30 on the food-court channels plus the two adjacent cameras covering the approach - a theft is rarely on one camera. Transcode to AVI only as a working copy; a transcode can drop frames and strips metadata.
- Hash at the moment of export. Compute SHA-256 on the exported file on the machine that produced it, before renaming or copying, and write the value into the chain-of-custody form.
- Two masters. Write the export to two separate evidence drives or write-once discs, label both with case number, camera ID, start and end time, clock offset, exporter name and date, and store one off-site.
- Chain of custody from minute one. Log every transfer (who, when, why, signature). Reviewers work from a verified copy, never from the master.
- Reconcile the '8:30-ish' note. Convert the guard's rough statement into NVR time and flag the ambiguity in the report rather than silently deciding that 20:40 is correct.
2. Three hours of the requested window on two channels turn out to be overwritten. What do you record, what do you tell the facility manager, and what should the site change?
Read the worked answer
Verify before accepting the explanation. Check the earliest playable timestamp on every food-court channel, not just one, and read the NVR's overwrite/retention setting and actual drive capacity. If the earliest record is a rolling ~21 days across all channels, the loss is capacity-driven, not interference.
Show the arithmetic. 32 cameras × 2 Mbps ≈ 64 Mbps ≈ 8 MB/s ≈ 28.8 GB/hour ≈ 690 GB/day. Four 4 TB drives give about 16 TB raw, roughly 14–15 TB usable after formatting and index overhead, so ≈ 21 days. Putting that calculation in the report makes the loss credible and shows the site exactly what has to change.
Record it as a limitation, not a hole in your work. Entry: 'Footage 20:00–21:30 on channels 12–14 not available; earliest retained recording on those channels is 06:12 the following day; consistent with capacity-based overwrite; verified by [method] at [time].'
Tell the manager plainly that the clip may not exist, that the evening deadline cannot be met for that window, and that any later request for the same period will fail for the same reason.
Recommendations with numbers, not adjectives: extend retention for public areas to at least 30 days (≈22 TB usable), move low-traffic channels to event-based recording, add a recorder that supports write-once or ANR export for evidence, and run a monthly earliest-record check that is logged as part of the audit trail. Retention should be driven by the realistic complaint-and-investigation lag, not by the price of a drive.