CCTV Evidence

CCTVEVIDENCE · AGUIDEFORUKLAWYERS CCTV Evidence Recorders, Retention Loops and the Footage That Overwrites Itself While You Draft the Letter COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM CLOCK & TIMELINE VERIFICATION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: evidence on a countdown 03 The recording estate: DVRs, NVRs, cloud cameras and doorbells 04 The preservation race: stopping the overwrite 05 Export and collection: keeping footage evidential 06 Clocks, synchronisation and the timeline 07 Authenticity, enhancement and interpretation 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : CCTVISWONORLOSTINTHEFIRSTWEEK : PRESERVEBEFORE THELOOP , EXPORTNATIVELY , VERIFYTHECLOCK § 0 2 · FIRSTPRINCIPLES The problem in plain English: evidence on a countdown § 0 3 · THEESTATE The recording estate: DVRs, NVRs, cloud cameras and doorbells § 0 4 · THERACE The preservation race: stopping the overwrite § 0 5 · GETTINGITOUTINTACT Export and collection: keeping footage evidential § 0 6 · TIME Clocks, synchronisation and the timeline § 0 7 · REAL , CLEAR , ANDFAIRLYREAD Authenticity, enhancement and interpretation 35 and the standing fairness rule. § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE CENSUS EXPORTS / PRIMARY CLOUD LOGS & DELETED / RECORDER LAYER PERIPHERY RECOVERABLE OTHER PRIOR CAMERAS COPIES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECENSUSTHATBEATTHELOOP EXAMPLE2 · THEGAPTHATHADASERVICETICKET EXAMPLE3 · THECLIPWITHTWOENCODINGLIVES § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · CCTVLIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The CCTV checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions How long do businesses actually keep CCTV? The footage has already been overwritten. Any hope? Is a phone recording of the CCTV monitor admissible? The other side says our clip is a deepfake. Now what? Can we enhance the footage to read the number plate? Do we have to redact other people before disclosing footage? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY