Export video evidence so another person can verify it

Source fact: an export can lose what matters

NIST found that surveillance systems use many export formats and that conversion can degrade image quality, remove metadata, and delay analysis. Its CCTV Digital Video Export Profile recommends interoperable video, precise time information, source and export metadata, and support for digital signatures. The NIST Digital Video Exchange project still describes a fragmented export landscape. A file that plays is therefore not proof that it is the best available copy.

The Scientific Working Group on Digital Evidence (SWGDE) defines chain of custody as chronological documentation of an item’s movement, location, and possession. Its digital-evidence collection guidance calls for contemporaneous notes, an evidence inventory, secure preservation, and records of transfers. SWGDE also cautions that video authentication evaluates provenance, content, and integrity; no single metadata field should be trusted in isolation. These are forensic principles, not a ruling that any particular export is legally admissible.

DSE recommendation: freeze the request before touching the recorder

Give the export a unique incident or request number. Record the requester, authority, purpose, camera names and identifiers, requested start and end, local time zone, known clock offset, and whether audio is in scope. Preserve the exact wording of the request. If the recorder clock is wrong, do not silently change the requested interval; document the observed offset and export enough surrounding time to protect context.

Identify the source system: recorder or cloud tenant, site, software and version when available, camera channels, operator, export workstation, storage destination, and export start and finish. Capture relevant screen views or system reports without exposing unrelated footage. Do not change retention, time, recording, or camera settings merely to make the export easier.

Preserve the richest supported copy

1. Export the system’s native or proprietary form when it retains the best available video, metadata, signatures, audit information, or multi-camera relationship. Include the supported player or documented retrieval instructions when licensing and policy permit.
2. Create a broadly playable derivative only as a convenience copy. Label it as a derivative and record the tool, version, settings, and operator. Never replace the native master with a transcoded file simply because the derivative is easier to open.
3. Record filenames, sizes, camera coverage, apparent gaps, audio presence, timestamps, and every error. Compute and retain an organization-approved cryptographic hash for each master file; a later matching value supports a conclusion that the bits have not changed.
4. Verify the export on a separate, supported workstation. Check beginning and end, representative points throughout, correct channel order, image orientation, audio, timestamp display, playback controls, and any required player. An export job marked successful is not an end-to-end test.

Separate integrity technology from custody

A camera-origin signature or export signature can provide valuable technical evidence within its documented boundaries. DSE’s related article, Signed video: what it proves, what must survive export, and what it does not replace, addresses one implementation. A signature does not identify every person who possessed a drive, explain why a derivative was made, establish that the right time range was requested, or supply legal authority. Maintain the human record even when cryptographic verification passes.

Create a master, working copies, and an accountable handoff

Move the verified export from temporary media into approved, access-controlled evidence storage as soon as practical. Treat that preserved set as the master; restrict changes and perform review on a working copy. The custody record should identify the item, sender, recipient or facility, date and time with zone, purpose, transfer method, and acknowledgment. Record every duplication and disposition according to policy.

Before declaring completion, have a second person reconcile the worksheet, file set, hashes, playback result, and requested scope. Escalate damaged recorders, overwritten intervals, unexplained gaps, proprietary-format failures, disputed authenticity, or anticipated litigation to qualified forensic and legal personnel. DSE recommends designing this workflow with counsel and the receiving agency rather than treating this article as legal advice.

Official sources

• NISTIR 8161 Revision 1, CCTV Digital Video Export Profile
• Standard Practice for Data Retrieval from Digital CCTV Systems
• SWGDE Best Practices for Digital Evidence Collection
• SWGDE Best Practices for Digital Video Authentication