Video Footage Retrieval, Storage Media and Chain of Custody
This domain tests how footage is lawfully and verifiably pulled off a recorder so that it survives scrutiny months later.
Three-copy rule
The master (original on the recorder) stays untouched; a working copy is used for review; an exhibit copy is sealed and signed. Never review directly on the live recorder.
Export discipline
- Use the recorder's own export function to a fresh, formatted, labelled medium.
- Prefer native/proprietary format plus the manufacturer's player; if MP4/AVI is required, keep the native file too.
- Select exact camera numbers and start/end times; check the export plays on a clean machine.
- Never screen-record, phone-film the monitor, or send clips by WhatsApp - all of these transcode, strip metadata and break authenticity.
Hash at export
Compute SHA-256 (or MD5) of the exported files immediately, record the value on the chain-of-custody form, and re-verify at every handover. A changed hash means the file changed.
Chain-of-custody form
Exhibit number; site and case reference; recorder make, model and serial; HDD serial; camera IDs and names; the date/time window with time zone; medium type and serial; hash and algorithm; operator name and signature; purpose; and a running transfer log with dates and signatures.
Worked example
A theft is reported nine days after the event. The site retains seven days. The auditor checks the recorder log, confirms overwrite on day seven, records the retention setting and the last available timestamp, and documents the loss of evidence rather than guessing at content.
Traps
Storing the exhibit on a personal pen drive; hashing the folder rather than the file; missing custody signatures or gaps between dates; forgetting the time zone; deleting the original 'to save space'.