Footage Review, Event Logging and Incident Identification
This domain tests whether you can find the relevant minutes inside terabytes of video and record what you saw without bias.
Plan the review
Start from the incident report, not the footage. Fix a time window, work backwards from the first known-good event, and use motion/alarm events plus the recorder event log (video loss, camera offline, alarm in, door forced) to jump to candidate clips. Sweep at 4–8×, switch to 1× and frame-by-frame at the crucial moment.
Log every session
Each entry: date and time in 24-hour IST, camera ID and location, objective observation, action taken, reviewer initials. Also log session start and end, playback speed, technical faults, and negative findings ('reviewed 12:00–13:00, nothing relevant').
Describe behaviour, not motive
Write 'Subject A in a blue shirt entered through door 2 at 14:32:07, remained 6 minutes and left carrying two cartons' - not 'thief stole stock'. Describe people by clothing, height, build and gait, not by name.
What to flag
Forced doors, tailgating, loitering beyond policy time, objects left or removed, running, falls, unauthorised area entry, vehicles and plates, PPE non-compliance, obstructed fire exits, camera obstruction or spray.
Worked example
Retail shrinkage is reported somewhere between 10:00 and 18:00. The auditor opens the stockroom camera's motion-event list, finds 14 events, isolates 15:47 where a person carries cartons toward a rear exit, exports 15:40–16:00, hashes it and logs the exhibit. The search window shrinks from eight hours to twenty minutes.
Traps
Recording inference as fact; reading the wrong camera's timestamp; missing a daylight-saving or drift offset; forgetting to note that footage was unavailable; over-reviewing one camera while ignoring the wider scene.