Forensic Video Analysis: When to Seek an Expert

 Forensic video analysis (FVA) is defined as the scientific examination, comparison and/or evaluation of video in legal matters.1 A short description for a huge variety of tasks, encompassing all the components of the Video Forensic Process as detailed by the UK Forensic Science Regulator, (Digital Forensics – Video Analysis, FSR-C-119) 2:

  1. field retrieval;
  2. laboratory retrieval;
  3. lossless extraction of data from proprietary formats;
  4. processing;
  5. interpretation;
  6. Reporting

Anyone working with video evidence within the legal system, must use a science-based workflow to get the video, manage it, process it, understand it, and then report on it.

In my previous article, entitled “Video Evidence: Handle with Care” I wrote about the common mistakes of processing image and video evidence. The times when this process had not been followed but luckily identified. The purpose of this article is an attempt to ensure that mistakes like those don’t reach the courtroom again.

I must start with Evidential Integrity.

Is the evidence complete and unaltered since the time of acquisition?”

Does anyone check that there is an unbroken chain between what was initially acquired from the video recording device and the item being presented in the courtroom? There appears to be a lot of assumption that it’s correct, with little regard to establishing its correctness.

The chain will often not be a simple one, as most video starts off inside a non-standard digital video recorder within a CCTV system. Therefore, there is a high possibility that some decisions will have been made in the acquisition process, and then also in the processing and presentation stages. If those decisions have resulted in changes, then it must be reproduceable and repeatable.

Most CCTV owners are not aware of these issues. As a result, they could be asked to export some footage and then produce a video that is much worse than what was originally recorded.



Many officers in a first response role do not know the technicalities. They may even be given the wrong equipment to assist them in the export process.

Both could end up with footage that was not complete and that had changed since the first recording.

Can we go back to the original? No. Because most CCTV systems will overwrite the data unless it is saved or exported correctly. What about during the processing stage, back at the police station? Many officers must resort to kiosks, or standalone hardware to process the footage for court. What are these doing to the footage, and is it repeatable?

Whatever is acquired, whether it is the native original evidence or not, it is imperative that a verification method is established as soon as practicable after the creation of the digital file. If not completed, there would be no method to verify that the file has not been altered during any subsequent location change or process.

Next, we have Authenticity.

“Is it a true and accurate representation of that which it purports to be?”

In my last article I wrote about a case where a vehicle was captured on CCTV and an image was extracted to indicate that this was a specific vehicle. Unfortunately, without the correct analysis of the video, an accurate representation could not be established, and the wrong conclusion was therefore presented as fact.

This is the crux of the Authenticity issue – only the correct understanding, restoration, and enhancement can truly ensure that authenticity is preserved.

If the question being asked of the video was a simple one, “is there a vehicle?”, then yes, it is authentic as a vehicle was there. However, when dealing with specifics, the non-standard, unregulated start point of CCTV can bring up all sorts of challenges that only a competent person may identify.

This all leads nicely onto the exhibit, and the processes required after retrieval to get it ready for court.  Whatever is required, each stage must be recorded and documented to ensure the chain back to the original master exhibit can be followed and the processes are repeatable and reproducible.

To put this into some context, let’s look at a scenario involving a vehicle at night.

The first hurdle comes with the playback of the video file. Can we rely on the manufacturer’s player? Can we rely on open-source or standard freeware players? The answer is, as is often the case in the forensic world, not a simple one. Strangely, the biggest errors are usually found in a manufacturer’s playback tool. Missing images, distorted shape and size, and incorrect colours, are all common issues, and all challenging the correct interpretation.

If the decisions made at the playback stage are wrong, the entire chain afterwards could be wrong, and so will be the decisions made of any subsequent images or video produced.

In our scenario we could have the date and time being presented, along with the video footage in the manufacturer’s player. We could use this data, but not the video itself. We will have to deal with that differently as the analysis has identified that the player is not presenting the footage correctly and no options are available to control this.

Using dedicated forensic video software, it is possible to extract the video data from the proprietary format and decode the video data correctly. We are now in a situation where we can control what is happening to the file and ensure any decisions are recorded.

Now comes the Processing stage.

Mistakes often occur here because of wrong decisions during the initial acquisition and, possibly, conversion. For us though, we need to break this down into two parts: Restoration and Enhancement.

Restoration is objective and will often consist of a scientific and documented algorithm to reverse errors in the image to restore a scene or object.

Enhancement is subjective and will often require decisions to be made based on visual appearance of the scene or object.

By understanding the video and interpreting the visual clues correctly, we can reverse the processes made to create it and produce new derivative evidence that answers the questions being asked of the original exhibit.

Importantly here, we must not be swayed in our interpretation by artefacts in the video that can deceive us, or external information that causes an unconscious bias.

Many of the problems I see stem from these points. Not understanding the video and then interpreting the information incorrectly.

Let’s get back on track here and see where we are.

We acquired the evidence correctly, ensuring we have preserved the native video. That has been exhibited and a verification method has been established to ensure that this volatile digital information was not changed.

It was copied correctly, and the working copy was verified as a true copy of the original.

It was decoded using dedicated forensic video software and each process was recorded and logged ensuring repeatability and reproducibility.

Image and video segments have been produced that link directly back to the original frame, in the original video, and all changes to the data have been logged and recorded.

It is these image and video segments that ultimately get presented in court. They may even go on to be included in a compilation, comparison chart or video timeline.

By following a structured forensic workflow, and using software dedicated to the analysis and enhancement of videos and images, we can ensure that anything that gets shown is reliable and based on facts.

Videos and images are some of the easiest evidence to get wrong. The cause, in my experience, is down to simple errors in initial interpretation and decision making with most, luckily, being detected before any harm can be done.

The only way to ensure that what you show in court is reliable, repeatable and reproducible, is by ensuring that the data is dealt with as evidence. Have it reviewed long before you walk into that courtroom and ensure it’s been reviewed by an expert, not just someone who can press play.


David Spreadborough, Amped Software

Share this post