Punjab PSEB Sr. Sec. NSQF Private Security (CCTV Video Footage Auditor) cheat sheet

Camera types: fixed bullet/dome for a set field of view; PTZ (pan-tilt-zoom) for variable coverage; panoramic/fisheye for 180–360° coverage with software dewarping.

Resolution: 720p = 1280×720, 1080p = 1920×1080, 4K/UHD = 3840×2160; pixel density at the target (pixels per metre, ppm) matters more than total megapixels.

Identification thresholds commonly used: detect ≈ 25 px/m, recognise ≈ 125 px/m, identify ≈ 250 px/m measured on the subject's face or plate.

Frame rate: PAL region default 25 fps; 12–15 fps is common for storage economy; licence-plate and fast-action capture often needs 25–30 fps or higher.

Shutter speed controls motion blur: 1/50 s for general scenes, 1/250–1/1000 s for fast-moving subjects; faster shutter needs more light or gain.

Codecs: H.264 (AVC) and H.265 (HEVC) are dominant; H.265 typically cuts bitrate 30–50% at comparable quality but needs more CPU to decode.

GOP structure: I-frame is a complete picture; P- and B-frames are predicted. Frame-accurate export must begin on an I-frame or the decoder reconstructs from the preceding GOP.

IR illumination: 850 nm gives visible red glow; 940 nm is covert but shorter range. True day/night uses a removable IR-cut filter; WDR compensates for strong backlight.

Network basics: IP cameras use PoE (802.3af ≈ 15.4 W, 802.3at ≈ 25.5 W), ONVIF for interoperability, RTSP for streaming, and NTP for time sync across devices.

Chain of custody record fields: unique evidence ID, description, source device and channel, date/time of seizure, location, collector name and signature, and every transfer with date, time, purpose and signatures.

Write-block before acquisition: connect the source drive through a hardware/software write blocker so the original is never altered; hash the image and the original and record both values.

Hash algorithms for integrity: SHA-256 is the current default; MD5 is legacy and acceptable only alongside SHA-256. Record the hash at acquisition and re-verify before playback or export.

Export format decision rule: native proprietary format preserves the full player and metadata; open formats (MP4 with H.264, or image sequences) maximise portability; export both when possible.

Playback must use the manufacturer's proprietary player or the exact codec pack matching the firmware; a generic media player may silently drop frames or mis-time them.

Storage media types: NVR/DVR internal HDD (surveillance-grade, 24/7 rated), external USB, SD card in camera, and cloud VMS. Record the media serial number on the custody form.

Retention and overwrite: recorders overwrite oldest footage when the ring buffer fills; calculate retention days = total storage ÷ (bitrate × channels × 86400 ÷ 8).

Time offset check: compare the recorder clock with a trusted reference (NTP, mobile network time, known event) and record the measured offset in minutes and seconds.

Original media handling: anti-static bag, padded case, label without covering the manufacturer's label, store away from heat, strong magnets and moisture; log every opening of the sealed bag.

Review workflow: define the time window and channels, do a fast sweep at 4–16× to locate candidate events, then step frame-by-frame (1/25 s steps at 25 fps) around each candidate.

Event log entry fields: sequential log number, recorder/channel, date-time stamp as shown on screen, real-world time after offset correction, event type, persons/objects involved, and reviewer initials.

Record on-screen display (OSD) exactly as displayed; never overwrite the camera's timestamp. Show both camera time and corrected time whenever they differ.

Event categories used in security logs: intrusion, alarm activation, perimeter breach, theft, assault, fire/smoke, medical, equipment fault, tamper, and false alarm.

Frame-count method: elapsed time = frame number difference ÷ frame rate. At 25 fps each frame is 0.04 s; at 30 fps each frame is 0.0333 s.

Identification limits: state clearly whether the footage supports detection, recognition or identification; avoid naming a person from low-resolution or masked imagery.

Direction-of-travel and dwell-time analysis: count frames between entry and exit of a subject across a fixed reference line to compute speed and dwell time.

Negative findings matter: log the absence of an expected event, the exact search window, and the channels reviewed, so the report shows the scope of the review.

Corroboration: cross-check the video timeline against access-control logs, alarm panels, POS transactions or radio traffic; note agreements and discrepancies.

Copy, never work on the original: perform all review and enhancement on a verified working copy; keep the master exhibit sealed and hash-verified.

Enhancement rules: brightness, contrast and sharpening are acceptable if disclosed; do not add, remove or interpolate content, and never use generative fill or AI upscaling on evidential frames without explicit disclosure and authorisation.

Every derivative file carries a record: source exhibit ID, tool and version used, operator, date/time, settings applied, and the new file's hash.

Frame export: save as lossless PNG or TIFF for stills; avoid repeated JPEG re-encoding, which degrades quality with each save.

Metadata preservation: retain container metadata (creation time, device, GPS where present) and record it; do not strip it during conversion.

Exhibit labelling convention: unique case number plus exhibit number plus item (e.g. case/exhibit/media), with a description sheet attached to each physical and digital item.

Access control: store digital exhibits on access-restricted storage with an audit log; restrict viewing to named personnel and record each access.

Disclosure and redaction: blur or mask unrelated third parties only on a disclosed copy; keep an unredacted master for the investigating authority.

Transport and handover: use tamper-evident seals, signed handover receipts, and a courier record with tracking for off-site transfer.

Admissibility tests commonly applied: relevance, authenticity (integrity verified by hash and custody records), completeness (no unexplained gaps), reliability of the source, and lawful acquisition.

Best-evidence principle: produce the original or the verified forensic image; explain and document any reason only a copy is available.

Indian legal frame: Bharatiya Sakshya Adhiniyam, 2023 (successor to the Indian Evidence Act, 1872) governs electronic records; certificates for electronic evidence are required in the prescribed form.

Information Technology Act, 2000: sections on electronic records and data; section 66 covers computer-related offences; section 72A addresses disclosure of personal information in breach of a lawful contract.

Digital Personal Data Protection Act, 2023: personal data processing needs lawful purpose and consent or a specified legitimate use; security safeguards and breach reporting obligations apply.

CCTV notice: signage stating the purpose of surveillance, the operator's identity and contact, and the areas covered should be placed before entry to monitored zones.

Proportionality and minimisation: cameras should not cover private areas (toilets, changing rooms, neighbouring property); record only what the purpose requires and retain no longer than necessary.

Access and correction: data principals may request access to their personal data and correction of inaccuracies, subject to exemptions for investigation and legal claims.

Disclosure to police: record the legal basis (written request, summons, court order), the officer's identity and badge, the items supplied, and the hash of each item supplied.

Report structure: purpose and scope, methodology, systems and exhibits examined, findings with exhibit references, limitations, conclusion, and appendices (custody forms, hash records, logs).

Finding statement pattern: what was observed, on which exhibit and channel, at what time (camera time plus corrected time), with what confidence level, and what it does or does not prove.

Separate fact from opinion: state observations first, then interpretation, and label each clearly; opinions must stay within the auditor's competence.

Express times in a fixed format with time zone (e.g. IST, 24-hour clock) and state the offset applied to camera time.

Use a consistent exhibit numbering scheme and cross-reference every claim to an exhibit number so a reader can verify it independently.

Language: plain, precise, past tense, no jargon or speculation; avoid words such as 'obviously' and 'clearly' that overstate certainty.

Limitations section: list resolution limits, frame rate, blind spots, recording gaps, clock offset, and any unverified assumptions.

Presentation: chronological timeline, annotated stills with scale and source caption, and a summary of key findings on the first page for decision-makers.

Quality review: a second reviewer checks hashes, time calculations and exhibit references before issue; record the reviewer's name and date.

Typical roles: security officer/guard, supervisor, control-room operator, CCTV auditor, site manager; each has defined authority and reporting lines.

Control-room operator duties: monitor live feeds, respond to alarms, log events, dispatch patrols, and preserve footage after an incident.

Access control layers: perimeter, building entry, zone, and asset level; methods include token, PIN, biometric and escort rules for visitors.

Visitor management: verify identity, issue a badge, record time in/out, host name and purpose, and require escort in restricted areas.

Patrol methods: clock-in points, random versus fixed routes, and documented checkpoints; record patrol times and observations in the log.

Incident response sequence: observe, assess, report, preserve evidence, secure the scene, and hand over to police or management as authorised.

Preservation trigger: on any incident, immediately export and hash the relevant footage before the retention window overwrites it.

Key control: log issue and return of keys and access cards, and reconcile the register at shift change.

Shift handover: brief incoming staff on open incidents, equipment faults, trespass notices and pending evidence exports; both sign the handover record.

Control-room ergonomics: eye-level monitor top, 50–70 cm viewing distance, 20-20-20 rule (every 20 minutes look 20 feet away for 20 seconds) to reduce eye strain.

Display-screen work: take short frequent breaks, adjust brightness and contrast to the room, and report persistent headaches or eye discomfort.

Fire response: raise the alarm, call the fire service, evacuate via the designated route, and never re-enter for property; use an extinguisher only on a small fire with a clear escape.

Electrical safety: do not open NVR/DVR or PSU enclosures unless trained and authorised; isolate power before handling equipment and use RCD-protected outlets.

First aid priorities: danger, response, airway, breathing, circulation (DRABC); call emergency services and record the time of collapse and interventions.

Emergency numbers in India: 112 (all-in-one emergency), 100 police, 101 fire, 108 ambulance; display them in the control room.

Lone working: check in at agreed intervals, carry a charged radio or phone, and log the start and end of the lone patrol.

Manual handling: assess the load, keep it close to the body, bend the knees, and use two persons for heavy monitors or battery banks.

Incident reporting: report every injury, near miss and equipment fault in writing; near-miss reporting prevents recurrence.

Confidentiality: footage, incident details and personal data are disclosed only to those with a need to know and a lawful basis; record each disclosure.

Objectivity: report what the footage shows even when it contradicts the employer's or client's preferred narrative; state uncertainty explicitly.

Conflict of interest: declare any relationship with persons in the footage or with the client and decline the assignment if independence is compromised.

Record-keeping integrity: never backdate, alter or delete a log entry; correct errors with a dated, signed strike-through and the reason.

Communication model: state the fact, its source, its impact, and the recommended action; keep radio traffic short and use phonetic alphabet and 24-hour time.

Professional boundaries: no unauthorised viewing of footage for personal interest, no sharing of clips on social media, no discussion of cases outside work.

Respect and non-discrimination: treat all persons equally regardless of gender, religion, caste or appearance; do not profile in reports.

Whistleblowing duty: report suspected evidence tampering, bribery or illegal surveillance through the designated channel and keep a personal record.

Testimony conduct: answer only the question asked, do not guess, refer to notes and exhibit numbers, and say 'I do not know' when you do not.