How to manage CCCTV Evidence

Every major building and facilities these days have closed circuit television (CCTV) installed.  This you can see from the glaring cameras installed in these buildings and streets.  At times you rudely get welcomed with the “THESE BUILDING IS UNDER CCTV SURVEILLANCE 24/7” warnings conspicuously placed within or without some premises.  Indeed, a milestone achievement compared to a few years past.  What seems not clear, at least to me is the management of such CCTV images.  Are the images captured in such cameras ever used as credible evidence in the courts of law? What are the general principles of CCTV evidence management?  The following discussion seeks to highlight on CCTV Evidence management.

  1. Retrieval: Is the acquisition of CCTV evidence from a CCTV system, either directly or indirectly from a third party.
  • General principles

2.1       Where practical, CCTV evidence should be obtained in its native format including:

  1. file type
  2. frame rate
  3. resolution (pixel dimensions and aspect ratio)
  • Data stored on the CCTV system is the primary data
  • Data initially retrieved from CCTV system is the original data (or master copy)
  • Original data should be a copy made directly from the primary data as soon as practicable
  • Original CCTV evidence should be stored securely
  • Where a person of interest may have had access to the digital CCTV evidence or recording system, consider a full forensic acquisition on site, or seizing the device under warrant to allow a full forensic acquisition at a later date.
  1. Guidelines when retrieving digital CCTV evidence:
  • A documented chain of custody must be maintained for all CCTV evidence, as per agency policy
  • Details relating to the retrieval should be recorded including:
    • the time, date and location of data retrieval
    • the name (or other suitable identifier) of the operator producing the original saved record
  • Details of the recording device should be recorded, including:
    • make and model
    • any time errors (system displayed time versus actual current time).
    • serial number of the DVR device
    • software name and version numbers
    • number of cameras connected versus number being recorded
    • a diagram and/ or photographs of the layout and location of all cameras recording to the storage device identifying the cameras responsible for the retrieved CCTV data
  • Identification and recording of output file format options and recording of the option chosen (if applicable). (Output options – i.e. optical drive, USB, Flash media or network)
  • Recording of any usernames and passwords required to gain access to the digital CCTV evidence
  • Recordings for remote access systems, network information, such as IP addresses should be considered

3.7 The current recording may need to be stopped to prevent overwriting of the relevant digital CCTV evidence before it has been recovered from the CCTV system

  • Relevant players / viewing software may also need to be copied from the system.
  • Visual verification
    • Verify that digital CCTV evidence captured as the original record is playable and a fair representation of what was on the CCTV system.


  • If there is any visible loss in quality from what was viewed on the system, it is likely that a compressed format has been obtained and it may be necessary to obtain the higher quality digital CCTV evidence.


  • Where practical, the native format should be obtained. However, other versions may also be exported from the DVR or CCTV system and may be suitable for use depending on the intended use of the data or the type of analysis required.


  • Storage of original copies of the digital CCTV evidence must be made:
    • at the first opportunitybefore any further processing or analysis is undertaken.


  • The original copy must be stored securely with write protection. For example WORM media or an appropriately protected and backed-up mass storage system


  • Verified working copies must be made from the master copy before any processing / transmission.


5.4 Transmission is the transfer of the digital CCTV evidence from one source or location to another, or from one media type to another. It includes copying of the digital CCTV evidence.


6.         Guidelines for CCTV Evidence Management.

Write protection of the original copy of the CCTV evidence must be considered before making a working copy:

  1. WORM media (CD, DVD) is suitable for an original copy
  2. secure server storage, where access and write privileges are enabled to prevent modification of the original copy, is also suitable for storage
  3. write blockers should be considered where CCTV evidence is stored on USB or Flash based media.
  4. All processing should be completed on a working copy. The original copy should remain secure and unedited not be modified (copying / opening file can modify it in some instances).
  5. Notes of all processes and/or process settings should be recorded to ensure the process is repeatable.
  6. It is good practice to work from the native files or files of the highest resolution. If lower resolution files are used, it should be clearly stated at the beginning of any output (video or any report), that higher resolution CCTV evidence is available.
  7. Suitable processes to carry out on CCTV evidence may include, but are not limited to: transcoding (compression, format conversion); brightness/contrast/gamma etc ; cropping / resizing; speed adjustments; sharpening / de-blurring; video stabilisation, and frame averaging.

7. Analysis

Analysis is any process that requires an interpretation of the content of the digital CCTV evidence where comparisons are made and/ or conclusions given.

7.1 General principles
  1. All processes must be valid, reliable and repeatable.
  2. Acceptable processes will vary depending on the CCTV evidence and the nature of the analysis.
  3. Records must be kept detailing all processes undertaken, and observations and interpretations as a result of the processing.


7.2 Guidelines for analysis of CCTV Evidence
  1. Any analysis must be carried out on a working copy. The working copy should be in the native file format or at the maximum resolution available.


  1. Any processing or analysis techniques used must be valid.


  1. Any processing or analysis must be undertaken in a reliable manner.


  1. Case notes must be recorded to ensure any processing or analysis is repeatable.


  1. Practitioners should be working in accordance with principles of ISO 17025.


  1. Processes that fit this “analysis” may include but are not limited to: photogrammetry; facial mapping; stereoscopy; speed calculations; other edge or feature identification or comparison techniques. (This list does not confirm these processes as valid analysis techniques but rather lists them as some techniques beyond ‘simple processing’ that deliver a basic visual enhancement).


  1. Before these or any other techniques are used the practitioner must ensure that each technique meets the testing requirements or ISO 17025).


  1. The limitations or uncertainty of any analysis and the subsequent opinions and conclusions drawn from it must be known and disclosed.

8    Output

Output is the final presentation medium for the digital CCTV evidence and will be dependent upon what best illustrates the content, quality and events depicted in original digital CCTV evidence.


8.1 General principles on output

Final output format should preserve the content and aspect ratios of the original CCTV evidence.

Where basic processing has occurred, the final output should appear visually the same or similar to the original digital CCTV evidence.


Where advanced analysis has occurred, comprehensive written reports should support the final output.

8.2 Guidelines on handling an output
  1. When CCTV evidence is played on device A and viewed on device B (or in some cases devices C and D) awareness must be given that playback devices or viewing devices can alter or change aspect ratios, image quality and colour fidelity “on the fly”.
  1. Before an output is provided, it should be checked for completeness, accuracy and that it is fit for purpose. Technical review of the output and the accompanying records of examination / processing by a second competent analyst is one way of verifying the quality of the output.


  1. A written report should accompany the CCTV output when processing or analysis has been conducted. The report should state the qualifications and experience of the CCTV analyst. It should also contain information detailing the types of techniques applied to the data and where relevant, the limitations or uncertainty relating to any opinions and conclusions drawn from the processed data.



In nutshell, the System operators should adopt the following 12 guiding principles so as to ensure the evidence is credible and able to withstand the painstaking process of justice:

  1. Use of a CCTV camera system must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.
  2. The use of a CCTV camera system must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified.
  3. There must be as much transparency in the use of a CCTV camera system as possible, including a published contact point for access to information and complaints.
  4. There must be clear responsibility and accountability for all CCTV camera system activities including images and information collected, held and used.
  5. Clear rules, policies and procedures must be in place before a CCTV camera system is used, and these must be communicated to all who need to comply with them.
  6. No more images and information should be stored than that which is strictly required for the stated purpose of a CCTV camera system, and such images and information should be deleted once their purposes have been discharged.
  7. Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.
  8. CCTV camera system operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain those standards.
  9. CCTV camera system images and information should be subject to appropriate security measures to safeguard against unauthorised access and use.
  10. There should be effective review and audit mechanisms to ensure legal requirements, policies and standards are complied with in practice, and regular reports should be published.
  11. When the use of a CCTV camera system is in pursuit of a legitimate aim, and there is a pressing need for its use, it should then be used in the most effective way to support public safety and law enforcement with the aim of processing images and information of evidential value.
  12. Any information used to support a CCTV camera system which compares against a reference database for matching purposes should be accurate and kept up to date.