Field Recovery of CCTV/DVR Video Surveillance

What happens when there is a DVR that needs examined, but the business uses it 24/7? How do you take it down for the shortest amount of time? DME Forensics specializes in DVR examinations and they give us a look into how field recovery works.

By DME Forensics

Many personnel who work with DVR video recovery within the forensics lab are already advocates for DVR Examiner as an acquisition tool. However, did you know that DVR Examiner can also help save time and resources in the field?

Video surveillance can be a vital piece of evidence when identifying a suspect. If the case is time-critical, it can be much easier for an investigator to access this data while still in the field. Also, some small business owners can feel uncomfortable giving up their surveillance system for an extended period of time. In this case study, we review a common situation that investigators face in the field and highlight how DVR Examiner can quickly recover that video data.

An investigator arrives at the scene of a robbery that appears to be associated with a recent string of incidents. The suspect has fled the scene, and it is crucial that the investigator quickly gathers as much information about them as possible. The owner of the store can’t provide a description of the suspect, but a few surveillance cameras are pointing in the direction of the crime scene.

After documenting the situation, the investigator shuts down the surveillance system to access the hard drive. Inside the DVR, the investigator finds a 2 TB hard drive, connects it to their laptop via a write-blocker, and scans the drive with DVR Examiner. By directly accessing the hard drive from the surveillance system, DVR Examiner can access video safely and securely, even if the owner doesn’t know the device password.

The investigator quickly locates tens of thousands of clips contained on the 2 TB hard drive, but the timeframe they need is limited to a fraction of those clips. The date/time offset adjustment and filtering capabilities of DVR Examiner allows the user to display only the video recorded within the timeframe of the incident. Upon locating these clips, the investigator can watch the relevant clips within DVR Examiner, save a few frames as still images to get out to the local patrol units, and then export just the needed clips. This process is much faster than traditional methods – and all without leaving the scene.

In some situations, after the time-critical information is acquired, it might make sense to create a complete copy of all the data on the hard drive (also known as a forensic image). DVR Examiner can create a forensic image, or load data from many common forensic image formats, to review later.

Recovering video data from CCTV systems in the field allows an agency to be more agile and efficient when identifying critical pieces of evidence. By accessing crucial evidence sooner, agencies can identify and apprehend perpetrators before the next incident occurs. If your agency is currently using DVR Examiner in the forensic lab, consider utilizing the speed and security of this program closer to the crime scene. The sooner the evidence is recovered, the sooner the case is solved.

If you haven’t tried DVR Examiner, download a FREE 30-day trial today to see how DVR Examiner can save you time and resources.


Digital Forensic Community