Jurist prudence
With the explosion in the availability and capabilities of recording equipment in recent years, along with ever-lower prices and easier-to-use software, it’s hardly surprising that digital video is fast becoming one of the most important and useful items in the investigator’s toolkit. But capturing and storing all that video is the easy part; handling, preserving and presenting it so that it will be admissible in court is another matter.
In the old days, any first responder could recover video evidence from a crime scene as easily as hitting an eject button. And back at the station, the evidence could be viewed on any standard VCR. The proliferation of digital video systems has changed all that.
Along with the near-ubiquity of digital recording devices has come a dizzying array — thousands, by some counts — of competing, proprietary video systems, which share few common characteristics, including operation, format and the compression scheme used. Today’s forensic video analyst not only must be familiar with the operation of this huge variety of equipment, but fluent in the alphabet soup of format and CODEC names, in order to keep the data in the most pristine (and therefore admissible) state possible.
The analyst’s work starts with knowing which devices use which recording schemes.
Storing the billions of ones and zeroes comprising even a few minutes of video on a hard drive requires that a DVR use some sort of compression scheme, and compression equals loss, as the amount of data needed to represent the original image is “squeezed.” The first casualties of so-called “lossy compression” schemes are image detail and accuracy, which were likely not DVD-quality to begin with. What’s more, different brands of DVR systems use different video formats, such as Windows Media Player, VLC Media Player or QuickTime. Some of these formats are “open source,” meaning they can be played on a wide variety of equipment, and some are proprietary and must be played on equipment from the same manufacturer.
“What’s really needed is a standard,” said Alan Salmon, a forensic video analyst at the Oklahoma State Bureau of Investigation and president of the Law Enforcement Video Association (LEVA), a group that helps develop best practices for the field. “But the next best thing is to try and stay on top of [the variety of equipment] out there.”
Salmon said the first step any agency must take to ensure that video evidence is useful in court is to develop a standard operating procedure for it. SOPs should be written documents detailing the step-by-step process of evaluating and collecting data, including plenty of detail but without being too rigid. Procedures should be in place to update the SOP as technologies change, and include technical and administrative approval. Having a consistent SOP means that, if necessary, those procedures can be authoritatively explained by an analyst in court and will hold up under the scrutiny of defense attorneys.
Digital multimedia evidence, or DME, includes any metadata attached to a file. Handling of such evidence, the LEVA said, consists of functions, technical and analytical. Technical functions include copying, converting or transcoding digital media, archiving or outputting the data and making basic image or time reference adjustments. Analytical functions include image comparison, aspect-ratio calibration, DME recovery and other more esoteric manipulations of the image, such as motion tracking or audio/video alignment.
Salmon said that some of the trickiest work involving DME is integrity verification and data authentication. “Those are terms that are often misused,” he said. “Integrity verification means that the data you have is complete and unaltered from acquisition; authentication means that what you see in the image is what is actually there.”
According to the LEVA a forensic video analyst should be part of the crime scene investigation team whenever DME may be present. Video equipment and evidence must be handled in the same careful, methodical manner as other kinds of evidence at the scene. And the sooner this happens, the better. Some systems continuously overwrite themselves, and it is not unheard of for evidence to be lost because investigators did not get physical access to the device in time.
Next, since most DME obtained from DVRs already has been compressed, and much of that with a proprietary CODEC, transcoding that data may be the only way for analysts to get a look at it. The lack of standards in the industry make this step particularly crucial; it is important to know, for example, whether the model of DVR at a scene will re-compress its data on output. Often, manufacturers say that re-compressing the data is necessary to move it from their proprietary format to one, such as Windows Media Player, that is more easily viewable on a broad range of equipment. But recompression always alters the original data, resulting in a loss in image detail.
Identifying and recording the model of DVR is the first step in the chain of evidence for DME, according to LEVA’s best practices. This step also will offer valuable information on playback and viewing specifications, including monitor resolution. If a manufacturer specifies that data obtained with a device be viewed on an 800 X 600 monitor, for example, the image will not render correctly on a 1024 x 768 monitor. In particular, viewing with an incompatible monitor or viewing software may alter the perceived aspect ratio of an image, leading to misidentification of people or objects.
For years, broadcasters working with different video formats from around the world often have faced similar problems, correcting images by sight so they look right on U.S. equipment. But changing an image to be used as evidence demands more precision and repeatability than can be found in broadcast engineers’ eyeballs.
Next, the analyst should research the CODEC used by the DVR manufacturer on the particular model of recorder at the scene, since recording CODECS vary by model for some manufacturers. Also, the analyst should be familiar with the idiosyncrasies of different CODECS; MPEG compression, for example, will render certain objects differently than JPEG compression. MPEG files usually will be smaller, making MPEG a popular choice among DVR manufacturers, but it also is more likely to leave motion artifacts. In contrast, JPEG often gives better detail but requires more storage space.
Depending on the DVR’s CODEC and how easy or difficult it is to offload its data, the analyst may choose from various methods, including exporting the relevant files using the DVR’s built-in functions, or transcoding them “manually” using available software. If these methods are not possible, or if the particular files relevant to the event cannot be identified, the analyst may need to copy the entire DVR drive as a binary image, or “clone.” This is often the best option if there is a suspicion that the evidence has been tampered with.
Converting digital information to analog occasionally may be necessary, but doing so always will degrade the image because digital video normally is a progressive scan, while analog is interlaced. Though the degradation of such images can be substantial, the video may still be admissible as a duplicate.
Particularly important for the use of DME in court is that the image’s aspect ratio is properly calibrated. In the conversion from the analog signal produced by most video cameras to the digital format stored in a DVR, errors usually occur in which the relationship between the height and width of objects captured in the video is changed. To correct this error, an analyst may need to calibrate the DME’s aspect ratio, especially if the analyst will be comparing the image to a known person or object.
Carl Kriigel, chairman of the International Association for Identification (IAI) Scientific Working Group on Imaging Technology, said that the lack of standards, especially for CCTV systems, is a particular problem. “We can add 50 pounds to a person if [the aspect ratio] isn’t right,” Kriigel said. “And that problem is more pronounced if an image is printed, say for a wanted poster.”
For years, broadcasters working with different video formats from around the world often have faced similar problems, correcting images by sight so they look right on U.S. equipment. But changing an image to be used as evidence demands more precision and repeatability than can be found in broadcast engineers’ eyeballs.
Kriigel said work has begun on crafting standards for law-enforcement video, but it is in the early stages and results may be a long time coming. Still, careful, knowledgeable analysts, explaining step-by-step their use of established best practices as they worked with a piece of evidence, can go a long way towards making people more comfortable with the use of digital video in the courts.
“What’s most important is making sure that the evidence is handled by people who know what they’re doing and can demonstrate that in court.”
Related Stories
