The rapid proliferation of DVR-based video surveillance systems has been a boon to law enforcement and homeland security agencies because of the availability of private security video footage.
by Wayne Cole
And, because of the increasing availability of “Do-it-yourself” security system kits containing cameras, displays, DVRs, and wiring through online and brick-and-mortar consumer electronics stores—which are proving popular with small business and residential installations—that expansion will likely continue.
Both “consumer” and industrial DVR systems offer a dizzying list of specs that most DIY purchasers never consider. There is nothing wrong with judging a video security system by its real-time picture display, especially if the main application is real-time surveillance. However, once users are tasked with reviewing footage, or providing it to an investigator, the headaches often begins.
DEVIL IN THE DETAILS
Even if the “self-installer” has done the necessary homework on camera positioning, field of view, depth of field and focal length, the recorded video may be disappointing. The differences between camera, display and recording resolution specs are frequently overlooked.
Consider a system with “D1” camera and display resolution, but which records frame-multiplexed video. The real-time single-camera view will look great. But recorded “frames” from a given camera may be reduced to 320 pixels x 240 pixels or less after grabbing a single field of standard 30 frames per second (fps) interlaced video. At that point, compression for storage will further degrade resolution and introduce compression artifacts. Objects, persons and actions in the sweet spot of a camera’s field of view and depth of field may still be identifiable upon playback. For most consumer systems, that is near the center of the view axis at a range from five feet to 15 feet. Outside that area, the reduced recording resolution and compression losses make identification questionable and details of activity difficult to establish.
Unlike on television detective shows, there is no forensic “magic application” that can, for example, “zoom in” to the perp’s eyeball and pick a reflected face off his iris. Forensic tools are much like audio systems with equalizers. They can enhance or suppress certain “frequencies” or aspects of the picture, they cannot create “frequencies”—e.g. resolution or other visual data from the scene—that was not recorded in the first place. Individual image filters may degrade a desired aspect of the picture even further. The classic “zoom” or magnify, for example, will make compression artifacts bigger, and effectively lowers resolution, by spreading a smaller number of original pixels over a larger number of pixels in the magnified view.
Application of sharpening, contrast, brightness, de-colorization or other filters might make the image slightly more intelligible, but they do nothing to increase resolution. They simply make the appearance of certain artifacts of low resolution and high compression less obvious, but do not “undo” or cure the imagery of them.
When recorded video is more important than real-time surveillance, the recorded resolution and display resolution should at least be equal to the camera’s resolution. Resolutions numbers are typically spread throughout a system’s specs. Certainly, if the recording resolution and display resolution exceed the camera resolution, the recorded imagery should still hold up well, provided the compression is moderate to mild and uses a high-quality CODEC like H.264 (MPEG-4). If the specs for an 8-camera system claims that the DVR can record at 240 fps and store 48 hours of video from all cameras on a 320 GB hard drive, the user should expect some disappointing recorded video, even from the best cameras.
Unlike tape-based systems, simply asking for “a copy of the video” from a DVR-based system probably will not be good enough. DVRs have make and model specific “harvesting” options that can profoundly affect the quality of the harvested video. Almost all use proprietary players to review video because of the proprietary databases used to store imagery and metadata. The harvesting procedure may involve designating a camera view and time span for export to a computer-playable multimedia file. Or the video “harvester” may need to attach a video recorder (typically via composite, S-VHS or IEEE-1394 DV connection) to capture the desired segment for later analysis.
When using a DVR’s analog video tapes, it is best to record “uncompressed” video using tape or digitally to an “uncompressed” CODEC like DV, AVI or QuickTime with no compression. Resulting uncompressed files may be huge, but the harvesting process will result in the least possible degradation of the captured video.
Clearly, investigators should not tell a small business or private home security system owner/operator, to “give me a copy of the video”. If an investigator cannot consult the owner’s manual to determine a procedure to harvest the video with the least degradation, the alternative is to remain present and document the harvesting procedure used by the operator. In so doing, a video-savvy investigator can ensure that the operator chooses output options that produce the best quality playback because, left on their own, operators will often go for the smallest file size or use the least amount of media. That will inevitably spoil much of the video’s evidentiary value.
There are no on-going “forensic digital video harvesting” courses of which I am aware. Neither is there a handy library of all DVR security systems owner’s manuals, or proprietary player applications. Without continuing self-education, investigators will never know if they are getting the best quality video with the maximum evidentiary value from any give DVR system.
However, there are some helpful resources like the Digital Forensics Investigator newsletter and forums (difnews.com), and the Forensic Multimedia Community at Media-Geek.com. Using such resources as starting points, DVR data “harvesters” can create self-teaching curricula and start building a personal library of DVR system manuals and proprietary players that can help deal with the current and future generations of DVR surveillance systems.