There was a time in the analog world when images were captured on film cameras and video tapes however in today’s digital world film cameras are no longer made and most law enforcement agencies photograph all their crime scenes and evidence on digital still and video cameras.
The move to digital has been a perplexing one for the courts. Analog film and video cameras always provided a sure fire way to validate the evidence by providing the negatives or raw unedited video tape in court.
Digital cameras and recorders have provided better, higher resolution images with greater clarity however digital images also provided easier ways to edit and alter digital images, increasing the odds of digital evidence being questioned and challenged in court.
Continuity of digital evidence is paramount to insuring it’s admissibility in court. Unlike their analog counterparts digital images do not have negatives or raw video tape to refer back to therefore the handling and continuity of this evidence needs to be documented and preserved. There are a number of steps that can be taken to insure your digital evidence is valid if challenged in court, here a a few suggestions for digital camera and digital video recording evidence. While these suggestions won’t guarantee the admissibility of your digital evidence in court, they will strengthen it’s value.
1 – Raw Source Data: Most digital cameras capture images to a memory card (SD card). These images are then transferred or downloaded to a computer for viewing and editing and often the original memory card is erased or re-written. If the evidence you are capturing is going to be used in court it is strongly recommended that a Fresh, New, Virgin, memory card be used each time you wish to capture evidence and then that memory card be filed away and stored for archival purposes should your evidence be questioned on challenged. One can argue that the images downloaded from the memory card to a hard drive or USB stick are the same images and should be OK however they are NOT the Source device used to capture the images and therefore can be questioned. Keeping the RAW – SOURCE Memory card is the closest equivalent to a Negative in the digital world.
2 – Witness Affidavits: Next to the raw source memory card, actual witness affidavits of other employees or just passers by confirming that they say you taking photographs at the scene can be a secondary means of confirming the digital photographic evidence
3 – Source Hard Drive: While this is no replacement for the original source storage device (SD Card) having the actual hard drive the images were downloaded to can also be beneficial for secondary confirmation. Of course this is largely impractical as hard drives fill up and data needs to be erased to make room for new data.
4 – Original and Copy Images: Often digital images are edited, enhanced or altered to provide better clarity and focus. While this can be done if necessary all images should be saved as COPIES and the original image file should never be re-written or saved over.
5 – Copies or Back Ups: Most digital evidence is edited and stored to a CD, DVD, memory stick or hard drive as a copy for presentation in court. While this is fine the original source image and format should be maintained (Step 1) to insure the highest valuation and acceptance by the court of the digital evidence. Copies of the original memory card, hard drive and copies of CDs or DVD roms are all great back up measures however each copy dilutes the strength of the evidence presented especially when copies are not logged, documented or recorded.
6 – Continuity of Evidence – Journal: You often hear the line “follow the evidence” on TV crime shows, well when it comes to evidence in court, following the continuity of the evidence presenting is essential to admissibility. Everything must be documented and journaled with regard to the collection of evidence. The date and times and locations of the photographs, who took the photographs, the equipment used to take the photographs, witnesses or observers are all important at the initial stage. Next when transporting the photographs and then downloading the photos this also needs to be journaled and if possible witnessed. Editing and manipulation of images needs to be documented and if possible witnessed.
Copies – lastly all copies need to be documented and cataloged and each copy needs to bare some form of unique identification. A list or log of who received copies of the digital evidence needs to maintained.
Digital Video – Surveillance Camera Footage:
Similar rules apply for digital video surveillance camera footage as for Digital still camera photographs.
1 – Raw Source Data: Digital video recorders capture and encode their image recordings in a proprietary method exclusive to each DVR manufacturer. Most DVRs will recording images in a AVI, MOV,, MPG3 or MPG4 digital video codec with a special digital watermark to identify this image as original source information. When copying the digital file from the DVR to external media, (CD, DVD, USB Stick or Hard Drive) this digital encoded watermark is transferred with the data and in most cases a special “Video Player File” which contains the decryption or digital key necessary to unlock and play the digital file is also necessary. Downloading data to an external device does provide a copy of the digital image data however the original RAW Source data resides on the Hard Drive of the DVR and whenever possible should be stored and protected from being re-recorded or over written by future DVR recordings. Most DVRs allow you to save or protect a specific hard drive recording or portion of the hard drive from being over written and depending on the size of your hard drive and recording requirements recordings being used for evidence should be saved or protected until the event is challenged or dismissed in court. A secondary “SAVED” external copy is good especially when it is the first copy and encrypted or watermarked however the only sure way to prove the validity of the video is to show it on the SOURCE Hard Drive or storage device.
2 – Copies or Backups: Unlike digital photo cameras which have inexpensive removable storage most DVRS have large hard drives or multiple drives making removing the hard drive and saving it as an archive expensive and impractical. For this reason most of evidence from video recordings will be downloaded and saved to an external device. It is very important when doing this that whenever possible you have a witness to confirm what steps you took in downloading the data to the external device and it is very important to MARK and DOCUMENT the first, original copy made and all successive copies. All copies should be made from the original source DVR hard drive and not from another copy. Each digital copy needs to be documented and logged and the FIRST ORIGINAL COPY should remain untouched and stored safely.
Important Tip: Whenever downloading data off your DVR to an external device you should always download and save the “Player” with the data file and once the Copy is saved you should immediately “TEST” the copy to insure it works and plays properly. This should be done for each copy.
3 – Original and Copy Images: Most digital video recorder data files are encrypted or watermarked to avoid alternation. Whenever possible all copies should be made from the original source 1-1 rather than from another copy. All copies need to be cataloged and documented as to source, destination and distribution.
4 – Witness Affidavits: When downloading data or saving to an external device it is beneficial to have a secondary witness with you to corroborate exactly what you did and how you did it.
5 – Continuity of Evidence – Journal: The same rules apply to digital video files as to digital photograph files. Continuity of Evidence is important to establish credibility of the evidence. The date and times and locations of the video files, the equipment used to record the video, witnesses to who saw the event or video the video “on the source equipment” are all important.
What about Off Site Storage and Backups? We’ll speak briefly to backups first then off site storage or cloud storage.
Back ups do not hold the same evidentiary value as the original source material but can be used to validate the original source files.
If the backup is the only file available it may be used as the primary source but could be questioned as to the validity as to why it’s being used as the primary. Acceptable reasons would be the original DVR HD was stolen, damaged destroyed etc…
Off Side Storage and Cloud Back Ups face additional challenges compared to on-site raw data files or 1-1 copies direct from the source. If the DVR recordings are handled off site then questions regarding the security of the network, security of the off site storage facility and their network and personnel all come into question and can be challenged. While most or all of these challenges can be overcome they do provide added points and opportunities for the defense to challenge the validity of the video evidence.
Most critics agree that digital photograph and video surveillance today is far superior then the analog images of yesteryear but digital evidence needs to be handled more cautiously and perhaps even more so then it’s analog counterparts.
It should be noted that most recorded digital media has a shelf life of 5-10 years. Hard drives will dry up and fail, CD and DVD recordable discs will eventually degrade and may not play or pixelate. Source playback systems may also be discontinued, try and find a betamax player today and good luck if you find one getting the tape to play, the same holds true for floppy discs, mini discs, zip drives …. you get the point. Recorded evidence is only useful if there is a machine capable of playing it back.