Recorded video and related feature data of events is one of the first and most important resources for incident review. But what is available in this data, and what are the opportunities for industrial security, first responders, operations management, safety and loss-prevention professionals? To understand this, we first need to define what is included with this “forensic” video data and then apply a process for its use.
Digital Multimedia Content — more than just video data
Digital Multimedia Content (DMC) is also known as digital video data, IP video content, or Digital Multimedia Evidence (DME). The purpose of referring to this evidence, as “multimedia” is essential in understanding the different digital data categories included. Video content, audio content, metadata-incorporating object characteristics such as color, size, trajectory, location-based information, relevant IP addresses, recording time and system time may be attached or associated with a digital video file. DMC may be compressed or uncompressed and may also be referred to as original, copied, local or virtual. Compressed DMC is the most common video data available that has been transcoded from the original DMC in an industry-standard file format, resulting in a reduced size and network bandwidth required to represent the original data set. Advances in h.264 video compression, the ability to store DMC within the camera or video-encoding device itself and virtualized or cloud computing have dramatically improved the volume and duration of video data available to investigations.
Uncompressed DMC or a copy of the original DMC with no further compression or loss of information that is in an industry-standard file format — although desirable by professional video-evidence examiners — is often unavailable and can be an unreasonable expectation due to the far larger storage requirements. Given the choice between having compressed video evidence that can be used together with other data, still-image photography is what most security professionals prefer.
The act of applying forensic video technology to this DMC defines “forensic video review.” Some of these review tasks include playback and analysis of DMC, together with applying a scientific methodology of forensic video analysis.
Also important is the use of DMC evidence in the legal setting, performing data recovery as needed, performing forensic image comparison and the development of a visual presentation of evidence.
DMC authentication and tamper detection are examples of maintaining the chain of custody for DMC evidence as specified under Law Enforcement and Emergency Services Video Association “Guidelines for the Best Practice in the Forensic Analysis of Video Evidence.”
Applying an understanding of the effect of light on the scene can improve the image quality of the video content. Advances in camera technology that produce usable color or “find the light” in dark- or low-illumination scenes are improving forensic video content.
The design of the video solution to provide maximum coverage is of great importance for systems used for forensic review. Using standards-based, high-image quality sources like HDTV IP cameras and technologies to accommodate difficult lighting will improve the recorded image quality.
Video content analysis
Applications that use video analytics can perform complex repetitive functions such as object detection and recognition simultaneously on many channels of video. These tools can provide improved searches, based on object characteristics and behavior.
Designers consider this where: