Forensic Audio/Video Unit Standard Operating Procedures · Forensic Audio/Video Unit Table of...

Forensic Audio/Video Unit Standard Operating Procedures

Forensic Analysis Division

Forensic Audio/Video Unit Table of Contents


Table of Contents

1. Administrative/Quality 2. Audio Analysis 3. DVR Extraction 4. Media Duplication/Format Conversion 5. Media File Analysis 6. Media Repair/Recovery – Analog and Digital 7. Scene Response 8. Forensic Video/Image Enhancement

Forensic Audio/Video Unit Administrative/Quality


Forensic Audio/Video Unit Administrative/Quality Forensic Analysis Division

1. Administrative/Quality

1.1. Overview

1.1.1. The Forensic Audio/Video Unit (FAVU) is responsible for the analysis of audio and video evidence in analog or digital form. The FAVU examines and enhances recordings as requested by laboratory customers. FAVU analysts may testify in local, state and federal courts concerning the procedures followed to preserve, analyze, duplicate, enhance, repair, and produce results. The FAVU is divided into two sub-disciplines; Forensic Audio Analysis and Forensic Video Analysis.

1.2. Services Offered

1.2.1. Audio Analysis 1.2.1.1. Forensic Audio Analysis is the scientific examination of recordings for the purpose of

increased speech intelligibility, attenuation of noise, and/or improvement of the overall quality of a recording. Forensic Audio Analysis can be applied to both analog and digital recordings. These recordings include, but are not limited to, recordings from mobile devices, body microphones, answering machines, 911 call recordings, interview room interrogations, and audio from surveillance video. Additionally, audio analysis includes the reconstruction (repair) of analog media, if required.

1.2.2. Video Analysis 1.2.2.1. Forensic Video Analysis is the scientific examination, comparison, and/or evaluation

of video in legal matters. Video enhancement is any process intended to improve the visual appearance of video sequences or specific features within video sequences. Additionally, video analysis includes the reconstruction (repair) of analog media, if required.

1.3. Limitations

1.3.1. It is widely acknowledged in the digital multimedia forensic scientific communities that data storage and systems used to create, store, and manage data varies. Variables include types of hardware, software, software versions, and sometimes alternate use of hardware and software from its original intent. Analysts apply their education, training, skills, knowledge, abilities, and experience to formulate a plan to analyze data and media by employing the most thorough and accurate methods defined by the FAVU’s standard operating procedures (SOPs); and use the best applicable scientific practices of the digital and multimedia evidence discipline.

1.4. Roles and Responsibilities

Administrative/Quality FAD-FAVU-SOP1 Issued By: Section Supervisor Issue Date: April 22, 2016 Uncontrolled When Printed Page 2 of 9


1.4.1. Members of the Forensic Audio/Video Unit have various duties and responsibilities.

Individuals who carry out forensic functions and perform casework must prove their competency prior to commencing casework and must be authorized to do so. Audio and Video Analysts will be deemed competent based upon completion of the FAVU’s training program (which may be modified based on experience) and the completion of competency tests. Authorizations will be documented in the form of Authorization Memos.

1.4.2. Supervisor 1.4.2.1. The Supervisor directs the day-to-day administrative and technical functions of the

FAVU. DUTIES AND RESPONSIBILITIES included but are not limited to:

• Supervise FAVU personnel in unit • Manage case assignments and requests for analysis • Coordinate and maintain training program • Review unit’s metrics and/or statistical data • Perform administrative and technical reviews • Prepare reports for management • Maintain FAVU SOPs • Ensure equipment inventory and maintenance documentation is maintained

1.4.3. Analyst 1.4.3.1. Analysts enhance audio and video (digital or analog) evidence. Analysts testify in

court when requested. DUTIES AND RESPONSIBILITIES included but are not limited to:

• Complete Forensic Audio/Video Analyst training program and pass competencies • Participate in annual proficiency testing • Successfully obtain LEVA certification • Perform technical procedures on media following FAVU SOPs to meet customer

requests • Adhere to the HFSC Quality Manual and the Health & Safety Manual • Maintain evidence integrity by using proper evidence seals and a chain of custody

to track evidence • Maintain unit and lab security • Perform administrative and technical reviews of casework

1.5. Safety

1.5.1. Analysts will be aware of their personal safety when handling evidence and when called to a scene. If an analyst suspects a biohazard is present on media or recording devices at a scene, measures will be taken to ensure their personal safety, such as wearing personal protective equipment like gloves, masks, etc.



1.5.2. Gloves must be worn when handling any item that is thought to contain a biohazard. 1.5.3. If media or recording devices contain a biohazard, proper PPE shall be worn and the HFSC

Health and Safety Manual will be followed. 1.5.4. Analysts should be aware that electronic devices are powered by electricity and measures

should be taken to avoid shock. 1.5.5. If disassembly of a device is required during analysis, analysts will be cautious of sharp

edges. 1.5.6. Injuries should be reported to a supervisor and the Health and Safety Specialist

immediately to receive appropriate medical attention.

1.6. Security 1.6.1. The FAVU work area is secured by locked doors controlled with key card access and by

locked doors controlled with individual keys. 1.6.2. Evidence in the process of examination is stored at the analyst’s desk or in the evidence

storage room. 1.6.3. Completed items are stored under proper seal and placed in an evidence storage area

until they can be returned to the customer or evidence triage group. Exceptions to evidence packaging and storage conditions may be made for exceptionally large items that pose additional challenges. However, evidence will be secure in a limited access area regardless of size.

1.7. Quality

1.7.1. Validation 1.7.1.1. The Unit is responsible for determining whether a new method, software, and/or

hardware requires validation. Forensic applications (including off the shelf software) that have been externally validated by reputable sources do not need to be validated by the FAVU but must be verified internally (performance checked) before being used for casework.

1.7.1.2. The Forensic Software/Hardware Internal Validation Form will be used to document any validations completed.

1.7.1.3. Validations and verifications shall be performed on the individual functionality of hardware or software that is relevant to the unit’s technical services, rather than validating all features of a hardware or software. If the functions that are validated work as intended, then the software as a whole has been validated and approved for casework.

1.7.1.4. Equipment/software used in a support capacity, from which no direct results are reported, as well as equipment solely designed to decode data and/or identify, remove or bypass security measures, are considered administrative tools and do not require validation or verification (i.e. software such as Media Info or GSpot).



1.7.1.5. Subsequently released versions of previously validated equipment or software shall

be approved for use after a review of the available release notes by the Unit Supervisor or designee in the applicable software/hardware function(s). Documentation of release notes will be maintained by the Unit.

1.7.2. Equipment/Maintenance

1.7.2.1. Equipment must be maintained to ensure proper performance. Only suitable and properly operating equipment shall be used for casework. Equipment not frequently used or not functioning properly will be labeled out of service with the out of service date noted.

1.7.2.2. Equipment will undergo maintenance as needed via an external vendor and will be performance checked prior to use on casework.

1.7.2.3. The Unit maintains an inventory list of laboratory equipment and software (including number of licenses and version numbers) internally.

1.7.2.4. Analog equipment is performance checked prior to use and noted in the case record.

1.7.2.5. Digital cameras are used for documentation purposes only and are not performance checked but are cleaned as needed.

1.7.2.6. Forensic software that is determined to be infrequently used will be performance verified annually. This will be determined based on data reviewed during technical reviews and by staff feedback. Performance verifications will be documented.

1.7.3. Integrity Verification 1.7.3.1. Digital and multimedia evidence submitted for examination must be maintained in

such a way that the integrity of the data is preserved and proven to be ‘reliable’ for court testimony.

1.7.3.2. Integrity verification can be accomplished digitally (i.e. hashing) and/or visually as to content and quality.

1.7.3.3. Write-blockers can also be used for evidence such as USB drives, hard drives, etc. to prevent modification (addition, deletion, or alteration) of media content.

1.7.3.4. If the submitted media has a mechanism designed to preserve the recording (safety-record tabs, jumper, software setting, etc.), document its state upon receipt. If not already engaged, activate the mechanism and document that fact. If there is a clear reason not to engage the write protection (e.g., to preserve fingerprints), document that it was not engaged and the reason.

1.8. Evidence Handling

1.8.1. Submission of Items for Examination:



1.8.1.1. The analyst should work with the submitter to ensure that the most appropriate

form of the evidence is submitted. 1.8.1.2. Evidence to be analyzed by the Unit may be directly submitted through the Unit’s

intake area or delivered to the Unit via the Client Services/Case Management team. If the case has not been created and/or submitted yet, then a case will be started and a unique forensic case number will be assigned to it in LIMS. If the case has already been created in LIMS, then that piece of evidence will be added as an additional submission item. This can be checked by searching the agency’s incident number in LIMS.

1.8.1.3. The submitted items are visually examined for damage by the analyst before analysis. If damage is observed, the damage must be photographed and the description of the damage documented in the case record.

1.8.1.4. Peripheral equipment that does not store data (e.g. monitors, VCRs, audio players) will not be accepted unless those items are unique and are required to facilitate the examination.

1.8.1.5. Receipt of evidence from the submitting customer/agency will be documented at the time of transfer electronically in LIMS and on the submission form, if applicable.

1.8.1.6. Submitted items are uniquely marked for identification using the forensic case number and item number.

1.8.1.7. When evidence is not being actively worked on, then those items must be securely locked in the FAVU general evidence lockers or other secure location. Be sure that internal transfers to the unit’s evidence storage are reflected in LIMS. Also, all evidence in FAVU storage must be sealed properly.

1.8.1.8. When evidence is actively being worked on, then those items should be securely locked in the analyst’s personal storage or secure location. In cases where a DVR is being extracted, the door to the analyst’s office must be locked when the analyst leaves for a period of time (lunch, end of day, etc.). Evidence must be in the analyst’s custody in LIMS. The evidence does not need to be sealed while it is being worked on.

1.8.1.9. If a case is received where a biohazard is suspected, the appropriate safety precautions will be followed. See the Houston Forensic Science Center (HFSC) Health and Safety Manual for more detailed information.

1.8.2. Submission of Evidence Collected at Scene: 1.8.2.1. Analysts who are requested to attend on-scene incident call-outs may assist

customers/agencies in identifying devices that may contain evidence relating to the incident.

1.8.2.2. Analysts will use safety precautions while at a scene. See the Houston Forensic Science Center (HFSC) Health and Safety Manual for more detailed information.



1.8.2.3. Analysts will have the requestor fill out the appropriate submission form to

document their request. 1.8.2.4. Analysts should photograph the scene, including any DVR, camera locations and

anything else related to the surveillance system or the case. 1.8.2.5. Evidence retrieved ‘on-scene’ should be transported to the FAVU and secured.

Evidence should be transferred to permanent media (i.e. CD/DVD) and that will become an item in LIMS.

1.8.2.6. Retrieved evidence will be documented electronically in LIMS upon arrival to the FAVU and on paper as part of the chain of custody, if applicable.

1.8.3. Returning Evidence: 1.8.3.1. Upon completion of casework, evidence shall be sealed properly. A proper seal is

one in which there is no possibility that the contents of a container can be removed, altered or a substitution made without the seal being obviously disturbed. Whenever possible, media will be packaged in the same condition/package as it was received.

1.8.3.2. Outer evidence containers will be sealed and the seal labeled with the analyst’s initials before being returned. Some items may be too large to properly seal. However, every effort will be made to secure the item with its appropriate identifiers.

1.8.3.3. The original submitted item(s) along with hardcopies, CD’s, DVD’s, tapes, and other items produced at the request of the submitter will be kept in the unit’s evidence locker until released to an authorized individual (if the item is of appropriate size to be stored there).

1.8.3.4. The return of evidence will be documented at the time of transfer electronically in LIMS and on paper as part of the chain of custody, if applicable.

1.9. Documentation

1.9.1. The analyst will document observations while performing casework. The case record should contain a thorough description of submitted items, notation of any repairs made, analysts notes, and hardware and software used for casework (to include version number of software). The case record/file can be made up of print outs, stored all electronically in LIMS, or a combination of both.

1.9.1.1. When a case record is printed, all documentation must be marked with the analyst’s initials, forensic case number, and page number.

1.9.1.2. Case records can also be maintained on an archive disc that is retained in the Unit and/or electronically in LIMS in lieu of printing them out.

1.9.1.3. Discrepancies with the submission information documented in the request for analysis must be noted in the case record.

1.9.2. All media shall be photocopied or scanned and maintained in the case record.



1.9.2.1. Using a permanent marker, mark all media with the analyst’s initials, the forensic

case number and item number. 1.9.3. All data pertinent to the case will be kept in the case record. This includes, but is not

limited to, notes, copies of prints, original submission form, CD’s, DVD’s, etc. This can be electronically maintained in LIMS, on a secure server, stored in a physical case file folder, or on an archive disc.

1.9.4. Technical note taking should be kept throughout the examination process to document how items were handled and what work practices/processes were performed.

1.9.4.1. The notes must be detailed enough to allow a comparably trained analyst to repeat the process and arrive at the same result.

1.9.5. The analyst is responsible for writing a report that provides the reader with all the relevant information in a clear and concise manner, if applicable.

1.9.6. If a case requires deviations from normal operating procedures, approval by the section supervisor is needed. The deviation must be documented in the case record.

1.9.7. It is sometimes necessary to modify a report after it has been issued. This may be necessary to correct an error in the report, to document additional analysis conducted after the issuance of the report, at the request of an attorney involved in the case, or for various other reasons.

1.9.7.1. If it becomes necessary to amend a signed report, then the new report will be clearly identified, will contain a reference to the original report that it is replacing, and will clearly state why an amended report was issued. The original report must be maintained within the case record.

1.9.8. Technical and Administrative Reviews 1.9.8.1. At least twenty-five percent of the FAVU cases will be technically reviewed by an

individual other than the author of the report prior to the issuance of the final report.

1.9.8.1.1. The technical reviewer will fill out the appropriate review form. This form will then be added to the case record.

1.9.8.2. All case files will be administratively reviewed by an individual other than the author of the report and the technical reviewer prior to the issuance of the final report. 1.9.8.2.1. The administrative reviewer will fill out the appropriate review form. This

form will then be added to the case record. 1.9.8.3. There may be after-hour and/or time-sensitive circumstances in which derivative

data needs to be released to the customer without its corresponding report having an administrative and/or technical review. In these circumstances, it will be made clear to the customer that an official report cannot be released until it has undergone the administrative and technical review process.

1.9.8.4. If there are conflicts during a technical review where the case analyst and the technical reviewer cannot agree on the way a case was handled or how a case is



being reported, the conflict shall be brought to a supervisor to make a determination and resolve the situation. These instances will be tracked by the supervisor in efforts to monitor trends and ensure quality.


Forensic Audio/Video Unit

Forensic Audio Analysis Forensic Analysis Division

Forensic Audio/Video Unit Forensic Audio Analysis Forensic Analysis Division

Forensic Audio Analysis FAD‐FAVU‐SOP5 Issued By: Section Supervisor Issue Date: January 11, 2016 Uncontrolled When Printed Page 2 of 3

1. Forensic Audio Analysis

1.1. Scope

1.1.1. This procedure applies to Forensic Audio/Video Unit analysts whose primary responsibility is to analyze and examine audio evidence.

1.2. Limitations

1.2.1. Using the wrong type of filters or not properly configuring filter settings could negatively affect the intelligibility of voice content.

1.3. Recommended Equipment/Software:

Computer/Laptop – CD/DVD writer, administrative access, USB/Network/Firewire ports, etc.

Headphones Appropriate software Camera (if needed)

Cables/Wires (as needed)

Izotope RX Sound Forge Pro Adobe Audition Audacity Cardinal MiniLab

1.4. Procedure

1.4.1. Inspect submitted items for physical damage (this includes cassette housings, magnetic tape, CDs). If irregularities are found, document the condition of media received in the case record and/or report.

1.4.2. Describe and document the items received (e.g. type of media, manufacturer information, write protection, previous markings).

1.4.3. If possible, digital evidence should be scanned for viruses before any files are opened. 1.4.4. To preserve the integrity of a digital original, make a bit stream duplicate to use as a

working copy. 1.4.5. Determine any file information (i.e. codecs). Refer to FAD‐FAVU‐SOP2 Media File Analysis

for proper procedures. 1.4.6. Converting the audio file(s) may be necessary. Convert to or between uncompressed

formats (e.g., PCM) whenever possible. 1.4.7. If analyzing analog evidence, determine the proper equipment for playback. Capture the

analog signal to an uncompressed digital format. Use this digital copy as the working copy for further examinations.

1.5. Audio Enhancement Procedure 1.5.1. Determine the proper type of audio device and connections to accurately playback the

original audio recording. 1.5.1.1. Audio media such as cassette tape (standard, micro, or mini) may require an

azimuth adjustment to optimize the frequency response of the audio content.

Forensic Audio/Video Unit Forensic Audio Analysis Forensic Analysis Division

Forensic Audio Analysis FAD‐FAVU‐SOP5 Issued By: Section Supervisor Issue Date: January 11, 2016 Uncontrolled When Printed Page 3 of 3

1.5.1.2. Verify that the audio playback device is working properly. 1.5.2. Playback the entire audio recording to analyze and determine the types of noise issues

with the recording. 1.5.3. Select the audio filter(s) that will effectively reduce noise and clarify speech content. It

may be necessary to apply different types of filtering techniques to maximize audio clarity. Examples of audio filters include (but are not limited to): Graphic Equalizer, High/Low Pass filter, Notch filter, Comb filter, and Adaptive filter.

1.5.4. Document the selected filter(s) and filter settings electronically or in the case notes (e.g. using screenshots or an audit trail in the software).

1.5.5. Once the analyst has determined the most effective filters to clarify the audio content, apply them to the entire audio recording or pertinent area(s) requested by the customer.

1.5.6. If recording to analog media, start the recording of the blank media first and then start playback of the original audio recording to ensure that all of the pertinent speech is captured.

1.5.7. Verify that the enhanced copy recorded properly by playing back the audio media. 1.5.8. Mark the enhanced audio copies with the forensic case number, unique identifier and the

analyst’s initials. 1.5.9. All original items and derivatives made are returned to the customer.

1.6. References

Scientific Working Group on Digital Evidence – www.swgde.org Scientific Working Group on Imaging Technology – www.swgit.org Law Enforcement and Emergency Services Video Association International – www.leva.org

Forensic Audio/Video Unit DVR Extraction



Forensic Analysis Division 1. DVR Extraction

1.1. Scope

1.1.1. This procedure applies to Forensic Audio/Video Unit analysts whose primary responsibility is to collect and/or prepare digital multimedia evidence for examination and analysis in legal matters.

1.2. Limitations

1.2.1. Some removable storage media is small and often hard to locate and could be overlooked. USB drives may be obfuscated to thwart detection, and some removable storage media is susceptible to immediate physical destruction.

1.3. Recommended Equipment:

• Computer/Laptop – CD/DVD writer, administrative access, USB/Network/Firewire ports, etc. • Media card readers • External CD/DVD writer • USB/FireWire mass storage devices (multiple sizes), formatted both FAT32 and NTFS • Cables – Network, VGA/S-Video/Composite/RCA/HDMI, Audio cables, USB/FireWire, Power

cables, Extension cables, etc. • A/D converter • Scan converter • Write Blockers • CDs/DVDs • Media Cards (various types and sizes) • Monitors (various types including analog capabilities) • Camera • Digital Video Tape Recorder with blank tapes • Tools – screwdrivers (various types), flashlight, mirror, etc.

1.4. Documentation:

1.4.1. Research the make/model of the DVR in question, including reviewing the user manual (if available).

1.4.2. Photograph all applicable sides of the DVR including all ports and information such as serial number and model number. When accessing the information on the DVR, the analyst should photograph all the screens, including menu options, recording information, and hard drive information.

1.4.3. Document the following, if applicable:

DVR Extraction FAD-FAVU-SOP7 Issued By: Section Supervisor Issue Date: April 29, 2016 Uncontrolled When Printed Page 2 of 5



1.4.3.1. System Information – date/time (compare to the actual date/time and document the offset), software/firmware version, usernames and passwords, overwrite settings

1.4.3.2. Storage Information – hard drive capacity, amount of hard drive used, number of hard drives (including external)

1.4.3.3. Recording Settings – resolution, schedule, motion/alarm settings, earliest recording/latest recording, frames per second (fps), etc.

1.4.3.4. Networking settings – IP address, usernames and passwords for network, etc.

1.5. Assessing Extraction: 1.5.1. Determine the date/time needed to be extracted from the DVR.

1.5.1.1. The length of time can determine how to extract data off the DVR. 1.5.1.2. The date/time of DVR may be off so make sure to adjust when needed. 1.5.1.3. Decide which cameras, if not all, need to be extracted.

1.5.2. Determine what methods of extraction are available on DVR. 1.5.3. Find out what formats are available.

1.5.3.1. If AVI format is available, then extract that with the native format, if time allows. Try and get native format each and every time.

1.5.4. Some DVRs, when powered on, will continue to record even when no cameras are set up. Make sure to stop recording before exporting as this could impact what is overwritten.

1.6. Extraction Methods:

1.6.1. CD/DVD writer 1.6.1.1. The DVR system should have an archive, backup, copy, or export function in which

you can write the data to the CD/DVD drive. Make sure the proprietary player is exported with the files. This may have to be chosen manually in the system.

1.6.1.2. Write-once discs should be used, if available (CD-R, DVD-R). If data will not write to media, try different brands and sizes. If a re-writable disc is used, make sure to transfer to a write-once disc when possible.

1.6.1.3. If the DVR has a finalize disc option, make sure this is turned on and used. 1.6.1.4. After exporting, verify that the downloaded/exported file(s) play back correctly on

another system and that the proper dates and times were retrieved. 1.6.2. Compact Flash drives

1.6.2.1. Compact flash drives are considered a temporary storage medium. The data should be transferred to permanent media when possible.

1.6.2.2. The DVR may only read certain sizes, types, or formats of compact flash drives so try all types if difficulties are encountered.

1.6.2.3. This method may require the files to be exported in real time.




1.6.2.4. After exporting, verify that the downloaded/exported file(s) play back correctly on another system and that the proper dates and times were retrieved.

1.6.3. USB/FireWire/SCSI devices 1.6.3.1. Most DVRs have ports to connect external USB/FireWire/SCSI devices. Make sure

the ports are functional and the devices are being recognized by the DVR. 1.6.3.2. USB drives can be used for exporting data, especially smaller amounts of data. For

larger amounts of data, an external hard drive may be used. Use different types, sizes, and formats (i.e. FAT32, NTFS) of drives until one is recognized by the DVR.

1.6.3.3. The analyst may have to manually choose the device to back up to. 1.6.3.4. Make sure the proprietary player is exported with the data. The analyst may have

to manually choose this in the system. 1.6.3.5. USB drives are considered temporary storage devices and the data should be

transferred to permanent media when possible. 1.6.3.6. After exporting, verify that the downloaded/exported file(s) play back correctly on

another system and that the proper dates and times were retrieved. 1.6.4. Networking

1.6.4.1. Most DVRs have a network port in order to do remote viewing. 1.6.4.2. Connect a laptop to the DVR using an Ethernet cable. Make sure the laptop being

used has administrator rights. Firewalls should be disabled. 1.6.4.3. Access the network menu of the DVR. This may require an additional username and

password. Note the IP address of the DVR. Do not change the settings on the DVR. 1.6.4.4. Change the IP address in the network settings on the laptop to coincide with the

DVR. Verify that a connection was made. 1.6.4.5. Using the remote viewer/software on the laptop, find the requested date/time. The

viewer may need to be downloaded to the laptop from the manufacturer or an online source.

1.6.4.6. The data can be exported using the viewer or screen capture software. 1.6.4.7. After exporting/capturing the data, make sure the firewall settings are turned back

on the laptop and all settings on the DVR are back to where they were. 1.6.4.8. Verify that the downloaded/exported file(s) play back correctly on another system

and that the proper dates and times were retrieved. 1.6.5. S-Video/Composite/VGA/DVI Output

1.6.5.1. Some DVRs only have an analog output. If analog output is the only option, the data must be exported in real time. This should be considered last in the extraction method process as aspect ratio, frame rate, and other areas could be incorrect. There may be also loss of quality and compression.

1.6.5.2. The analog output options should be observed and the best option for transfer selected.




1.6.5.2.1. Using an A/D converter or scan converter, the analog signal can be run into a laptop/computer where it can be captured using a screen capture tool (i.e. Star Witness, Omnivore).

1.6.5.2.2. A digital video tape recorder can also be used to record the video. The recorder should be connected to the “video out” port (s-video, etc.) and the analyst can confirm the signal by viewing the monitor. It is recommended to use digital magnetic tape (i.e. MiniDV).

1.6.5.3. The analyst may need to record each camera separately and the date/time stamp should be visible on the recording.

1.6.5.4. Verify the recording by playing back the tape. The tape should be transferred to digital media when possible.

1.7. Derivatives 1.7.1. After exporting, verify that the downloaded/exported file(s) play back correctly on

another system and that the proper dates and times were retrieved. 1.7.2. Working copies should be made from the files extracted from the DVR. 1.7.3. Files extracted from DVRs will be given to the submitters in a format as requested, i.e.

CD/DVD. 1.7.4. The items created will be documented in the case notes and chain of custody will be

tracked in LIMS.

1.8. References SWGIT Best Practices for the Analysis of Digital Video Recorders, Version 1.0 2012.06.11 SWGIT Best Practices for Retrieval of Digital Video, Version 1.0 2013.09.27



Media Duplication/Format Conversion Forensic Analysis Division

Forensic Audio/Video Unit Media Duplication/Format Conversion


Media Duplication/Format Conversion FAD‐FAVU‐SOP3 Issued By: Section Supervisor Issue Date: January 11, 2016 Uncontrolled When Printed Page 2 of 4

1. Media Duplication/Format Conversion

1.1. Scope

1.1.1. This procedure applies to Forensic Audio/Video Unit analysts whose primary

responsibility is to collect and/or prepare Digital and Multimedia Evidence (DME) for

examination and analysis in legal matters. Media duplication and format conversion

includes understanding the fundamentals of quality control, original media playback, and

media capture. Direct media duplication does not have to be treated or documented as a

forensic process.

1.2. Limitations

1.2.1. Repetitive playback, rewinding, and pausing of original analog video media will lead to

degradation of the original recording. Depending on the process used, transcoding might

result in the loss of data and degradation of the video. When outputting to digital media,

be aware that the following factors can reduce output quality: high compression rates,

long record times, poor quality equipment and media, and incorrect settings.

1.3. Equipment

1.3.1. Recommended Hardware

CD/DVD Duplicator Analog Playback Devices (both audio and video): VHS, HI8, mini‐DV/HDV etc.

Time Based Corrector (TBC)

Matrox MXO2 Mini: captures and playbacks HD and SD video via HDMI, analog

component, S‐Video, and composite. Supports stereo RCA and up to 8 channels of

HDMI audio I/O as well as 5.1 and 7.1 surround sound monitoring on the HDMI output.

Video Capture Card Video to USB Converter (uncompressed)

Computer/Laptop – administrative access, CD/DVD optical drive, USB ports etc.

Media card reader

Cables – Component/S‐Video/Composite, RCA Audio, USB/FireWire, VGA, DVI, HDMI

etc.

Monitors (various types including analog capabilities)

1.3.2. Recommended Software

Capture software (i.e. Omnivore)

Adobe Media Encoder (universal file formats)

Amped FIVE (proprietary file formats and universal file formats)




FFMPEG (proprietary file formats, universal file formats, as well as data carved

streams from exe imbedded files)

1.4. Procedure

1.4.1. Analog Video Evidence

1.4.1.1. The appropriate playback device should be chosen to provide optimum signal

quality thus providing the best images possible.

1.4.1.2. Examine the video footage to locate the requestor’s defined area of interest.

1.4.1.3. The analog footage is then connected to a forensic workstation and digitized using

forensic software (i.e. Amped FIVE, Video Focus) or a non‐linear editor (i.e. Adobe

Premiere).

1.4.1.4. The digitized video can now be transcoded/encoded out of the capture software

into a universal file format for optimal playability.

1.4.1.5. In cases where transcoding of video files is required for examination and/or normal

viewing, the transcoding/encoding process must ensure the least amount of

degradation to the derivative.

1.4.2. Universal Digital Format Conversion

1.4.2.1. The analyst should attempt to play the file using Windows Media Player on a

computer that is completely free of any outside additional codecs. If Windows Media

Player is able to play the file and there are no issues, such as incorrect aspect ratio or

frame rate, no more action is required.

1.4.2.2. A universal digital video file can be transcoded in the following ways:

1.4.2.2.1. The analyst can use a forensically accepted media encoder, using a universally

playable codec to transcode to a file format that is playable with Windows

Media Player. If there are aspect ratio or frame rate issues with the original

video, they can sometimes be corrected within the encoder before output.

1.4.2.2.2. The analyst can use software (i.e. Amped FIVE, Adobe Premiere) to transcode

the file into a playable format for Windows Media Player.

1.4.2.2.3. If the above two options do not load the video, the video can be played in a

universal player such as GOM or VLC. It should then be captured using a screen

capture utility and exported at the best quality possible to a format that is

playable in Windows Media Player.

1.4.2.3. If the video displayed by the player is not displayed in the correct aspect ratio, it

should be corrected in the software aligned with the screen capture utility or exported

as an uncompressed video file, brought into software (i.e. Photoshop), the aspect ratio

corrected and then rendered out at the best quality possible to a format that is

playable in Windows Media Player.




1.4.3. Proprietary Digital Conversion

1.4.3.1. The analyst should attempt to open the proprietary player on a computer that has no

administrative rights. If the player will open, the video file will play, and there are no

issues such as incorrect aspect ratio or frame rate, no more action is required.

1.4.3.2. If the player does not open, then transcoding of the video file(s) is necessary for

universal playback. The following are ways of transcoding a proprietary digital video

file:

1.4.3.2.1. The analyst can use software (i.e. Amped FIVE) to transcode the file into a

playable format for Windows Media Player.

1.4.3.2.2. If the video file does not open in software, the video can be played in its

proprietary player. It should then be captured using a screen capture utility and

exported at the best quality possible to a format that is playable in Windows

Media Player.

1.4.3.2.3. If the video that is being displayed by the player is not being displayed in the

correct aspect ratio, it should be corrected in the software aligned with the

screen capture utility or exported as an uncompressed video file, brought into

software (i.e. Photoshop), the aspect ratio corrected and then rendered out at

the best quality possible to a format that is playable in Windows Media Player.


Media File Analysis Forensic Analysis Division

Forensic Audio/Video Unit Media File Analysis


Media File Analysis FAD‐FAVU‐SOP2 Issued By: Section Supervisor Issue Date: January 11, 2016 Uncontrolled When Printed Page 2 of 3

1. Media File Analysis

1.1. Scope

1.1.1. This procedure applies to the Forensic Audio/Video Unit analysts tasked with performing

media file analysis of digital multimedia evidence (DME).

1.2. Limitations

1.2.1. Before the examination process, DME should never be converted into another file format.

This will rewrite the header information, recompress the file, and could compromise the

original frame rate and/or resolution.

1.3. Equipment

1.3.1. Recommended Hardware:

Computer/Laptop – administrative access, CD/DVD optical drive, USB ports etc.

Media card reader

Monitors (various types including analog capabilities)

1.3.2. Recommended Software:

Media Information (Universal File Formats e.g. AVI, WMV, MOV, etc.)

G‐Spot (Universal File Formats e.g. AVI, WMV, MOV, etc.)

Amped FIVE (Many proprietary file formats and universal file formats)

FFMPEG (Many proprietary file formats, universal file formats as well as data

carved streams from .exe imbedded files)

VirtualDUB (AVI)

1.4. Procedure

1.4.1. The analyst should research the digital video file and/or system in order to determine the

reliability of the process under which it was recorded.

1.4.2. The submitted media should be reviewed. The following information should be verified, if

known:

Recording method

Time/date of incident

Problems in playback or viewing of the recording

1.4.3. Discrepancies with the submission information documented in the request for analysis

must be noted in the case report and notes.

1.4.3.1. A preliminary determination should be made as to the feasibility of the requested

task (e.g. enhancement, comparison, duplication).

1.4.3.2. If the analyst determines any additional tasks are necessary, these should be noted

in the worksheet/case notes.

Forensic Audio/Video Unit Media File Analysis


Media File Analysis FAD‐FAVU‐SOP2 Issued By: Section Supervisor Issue Date: January 11, 2016 Uncontrolled When Printed Page 3 of 3

1.4.3.3. In many instances the header information does not accurately report the frame rate

in any of the examination tools. The analyst can manually determine the frame rate

of the original video and make corrections on the output, if needed. Speed

adjustments are made by varying the playback frame rate and may be accomplished

through video‐processing software (i.e. Amped FIVE, Adobe Premiere).

1.4.3.4. In many instances the storage aspect ratio (SAR) is not accurately represented by

the display aspect ratio (DAR) of the player. In this situation, the contradicting

resolutions/aspect ratios should be noted for correction in the enhancement

process.


Media Repair/Recovery – Analog and Digital Forensic Analysis Division

Forensic Audio/Video Unit Media Repair/Recovery – Analog and Digital


Media Repair/Recovery – Analog and Digital FAD‐FAVU‐SOP4 Issued By: Section Supervisor Issue Date: January 11, 2016 Uncontrolled When Printed Page 2 of 4

1. Media Repair/Recovery – Analog and Digital

1.1. Scope

1.1.1. This procedure applies to Forensic Audio/Video Unit analysts whose primary responsibility is to collect and/or prepare digital multimedia evidence for examination and analysis in legal matters. This procedure includes understanding the fundamentals of physical media repair and recovery, media housings, contaminants, magnetic tape and reels, CD/DVD scratches, and un‐finalized media.

1.2. Limitations

1.2.1. Typically, digital media (CDs, minidiscs, hard drives, flash/memory cards, etc.) cannot be repaired by the Forensic Audio/Video Unit. Playing back damaged media could result in further destruction to the evidence and/or equipment used. Any damaged media must be photographed/documented.

1.3. Physical Inspection

1.3.1. Inspect submitted items for physical damage (this includes cassette housings, magnetic tape, CDs). If irregularities are found, document in the case record the condition of the media received.

1.3.2. Label the submitted items with a permanent CD/DVD‐safe marker with the laboratory case number, unique identifier, and initials of analyst. Avoid writing over previous markings if possible.

1.3.3. Describe and document the items received (e.g. type of media, manufacturer information, write protection, previous markings).

1.4. Procedure 1.4.1. Determine the type of repair that is required to facilitate proper playback of the video

recording. 1.4.2. Repairs can be made to analog and digital tape media including but not limited to: VHS

video, 8mm, digital 8mm, and other formats. 1.4.3. Digital media including CDs, DVDs, hard drives, and flash memory cards may not be able

to be repaired by an analyst due to the nature of the digital recording format and severity of the damage itself. In this case, it is recommended that analysts consult with the Digital Forensics Laboratory (DFL) to see if they can repair and/or recover any data.

1.4.4. Before conducting any repairs, document the condition of and photograph the damaged media.

1.4.5. Using the proper set of tools, disassemble the cassette housing to evaluate the extent of damage to the magnetic tape and/or cassette housing.

1.5. Broken Magnetic Tape 1.5.1. Cut away torn, stretched, or jagged tape pieces in the area where the splice(s) will be

made. Do not discard any magnetic tape pieces. Place cut pieces in a separate uniquely identified and sealed container for return to the customer.




1.5.2. Select the appropriate size splicing block. Match the end pieces together and, using splicing edit tabs, adhere on the non‐magnetic side of the tape. There may be multiple spliced areas that need to be repaired.

1.5.3. The repaired magnetic tape may be placed back in the original housing if it is in a usable condition. If the housing is unusable, place the repaired magnetic tape into a compatible housing. Do not discard the original housing. Place it in a uniquely identified and sealed container for return to the customer.

1.6. Broken Housing 1.6.1. Using empty cassette housings from similar media types, place the original video

magnetic tape media into the new cassette housing. 1.6.2. If the housing reels are damaged, wind the original video magnetic tape onto compatible

reels and place in the compatible housing. Label the housing appropriately. 1.6.3. Do not discard any original housing parts. Place them in a uniquely identified and sealed

container for return to the customer.

1.7. Contaminated Magnetic Tape 1.7.1. If the magnetic tape is contaminated with dirt, oil, grime, salt water, waste material, or

other chemicals, it is recommended to place magnetic tape in water and clean with mild soap or similar cleaning product that will not adversely affect the magnetic media.

1.7.2. Place the magnetic tape into a compatible housing to facilitate playback, if necessary.

1.8. Write Protection 1.8.1. If there is a write protection feature on the housing, enable it to protect the original

media from inadvertent alteration.

1.9. Digital Repair 1.9.1. If a disc doesn’t play in the selected drive, try a different drive. If that fails, use of a

commercially available disk polisher may allow the data to be recovered. Caution should be used as polishing could further damage the disk.

1.9.2. Un‐finalized tracks and sessions can be recovered using software dedicated to this purpose. Although it may be possible to recover some data by finalizing in the lab, some data may not be recovered by this process. If unsure about the process, consult a computer forensics examiner to recover data from the disc.

1.10. Duplication 1.10.1. Refer to FAD‐FAVU‐SOP3 Media Duplication/Format Conversion for instructions on

duplicating media.

1.11. Derivatives 1.11.1. All evidence items are returned to the customer, including damaged and/or broken

parts. Duplications are returned with the original evidence item. When returning the original item and any additional items, document all chain of custody in LIMS.

1.12. References




Scientific Working Group on Digital Evidence – www.swgde.org Scientific Working Group on Imaging Technology – www.swgit.org Law Enforcement and Emergency Services Video Association International – www.leva.org

Forensic Audio/Video Unit Scene Response



Forensic Analysis Division 1. Scene Response

1.1. Scope

1.1.1. This procedure applies to Forensic Audio/Video Unit (FAVU) analysts who are called to collect video evidence and/or provide guidance to customers at a scene or off-site location.

1.2. Equipment

1.2.1. Field kit- may contain vendor manuals, optical media, flash media, USB drives, analog cables, forensic computer, write-blocking devices, A/D converter, scan converter, and tool kit.

1.3. Preparing for Call-Out

1.3.1. The FAVU receives requests to assist customers at off-site locations to recover audio or video evidence. These requests are commonly referred to as “call-outs” by the FAVU.

1.3.2. In order to assist a customer on a call-out, certain information is needed. The following information is required for a call-out: • Scene location • Location type (residence, business, etc.) • Name of the requestor and agency information.

1.3.3. When a call for assistance is received, questions should be asked prior to leaving for the scene. An attempt should be made to get as much information as possible prior to heading to the scene. Important or helpful information includes: • Contact information for the location. • Type of DVR at the location (manufacturer and model)? • Date and time of incident and how much video or audio will need to be downloaded. • Type of incident/subject matter of video • Passwords to DVR(s)

1.3.4. Make sure the field kit has all the necessary equipment needed and items were replaced if used.

1.4. Scene Arrival

1.4.1. The following information must be captured, if it is available, on relevant items observed at the scene, including but not limited to: • DVR make, model and serial number • PC-Based or Stand-Alone Embedded • Number of recording units • Is system networked? (If it is, this may need to be disconnected to make sure no

remote access is used.) • Date/time displayed • Actual date/time • Recording capacity and when DVR will overwrite • Number of cameras and locations

Scene Response FAD-FAVU-SOP8 Issued By: Section Supervisor Issue Date: April 28, 2016 Uncontrolled When Printed Page 2 of 4



• Type of cameras • System settings • Playback software if known • Is audio being recorded?

1.4.2. All notes must be included in the case record. 1.4.3. Photograph the DVR and any menu settings that can be accessed to show all the settings

of the DVR. 1.4.4. Request all usernames and passwords. If not known, then reference the manual for

default passwords or contact the manufacturer. 1.4.5. Observe video and establish that the incident is still recorded on the system. 1.4.6. Assess all extraction methods available on the DVR and choose the best method for

extraction based on amount of video needed. Also, determine native/proprietary format.

1.5. Extracting Video 1.5.1. Refer to FAD-FAVU-SOP7 DVR Extraction on how to extract the incident from the DVR. 1.5.2. If all extraction methods are exhausted, then methods like a scan converter or analog to

digital converter can be used but only as a last resort. 1.5.3. If all options fail at the scene, then the DVR can be seized with consent or warrant and

submitted to the Unit.

1.6. Considerations 1.6.1. If evidence is collected from the scene for submission to the laboratory, a FAVU

submission form must be completed. 1.6.2. Once video is extracted, verify everything has been collected and is playable. 1.6.3. If a player is needed, make sure the player is provided to the customer or the video is in a

playable format. 1.6.4. Document any derivatives made at the scene.

1.7. Derivatives

1.7.1. If derivatives are given at the scene, one of the following items must apply: • No forensic software was used at the scene. • There are time-sensitive circumstances (i.e. Amber Alert, high profile homicides) in

which forensic software may be used for media releases. In these circumstances, it will be made clear to the customer that an official report cannot be released until it has undergone the administrative and technical review process.

1.8. Returning from Call-Out

1.8.1. Determine if the case exists in LIMS. If a case does not exist, a new case must be created. Evidence from the call-out will be submitted and/or archived.

1.8.2. All necessary case notes must be completed and uploaded into LIMS. For circumstances in which the derivative is given at the scene and no forensic software was used, no LIMS assignment is required and no forensic report is issued.

1.8.3. If there are additional requests, the appropriate analysis will be performed. A forensic report will be issued and all necessary reviews will be completed.




1.9. References

Best Practices for the Retrieval of Digital Video, Version 1.0 2013.09.27 Star Witness Training Manual (March 25, 2015)



Forensic Video/Image Enhancement Forensic Analysis Division

Forensic Audio/Video Unit Forensic Video/Image Enhancement


Forensic Video/Image Enhancement FAD‐FAVU‐SOP6 Issued By: Section Supervisor Issue Date: January 11, 2016 Uncontrolled When Printed Page 2 of 4

1. Forensic Video/Image Enhancement

1.1. Scope

1.1.1. This procedure applies to Forensic Audio/Video Unit (FAVU) analysts whose primary

responsibility is to enhance/clarify digital multimedia evidence.

1.1.2. Video Enhancement includes understanding the fundamentals of capturing analog video,

processing digital video, editing recorded sequences, exporting still frames of interest,

and media copy. Image Enhancement includes understanding the techniques used to

clarify or reveal content that was not previously evident.

1.2. Limitations

1.2.1. Image/video processing and adjustments should be nondestructive. Over‐processing

could negatively affect the quality of the video/image.

1.3. Recommended Equipment/Hardware

• Computer/Laptop – administrative access, CD/DVD optical drive, USB ports etc.

• Media card reader

1.4. Recommended Software

• Amped FIVE

• Video Focus

• Star Witness

• Clear ID

1.5. Image Enhancement Procedure

1.5.1. Inspect submitted items for physical damage (this includes cassette housings, magnetic

tape, CDs). If irregularities are found, document the condition of media received in the

case record and/or report.

1.5.2. Describe and document the items received (e.g. type of media, manufacturer information,

write protection, previous markings).

1.5.3. Digital evidence should be scanned for viruses before any files are opened.

1.5.4. To preserve the integrity of a digital original, make a bit stream duplicate to use as a

working copy. All analysis shall be conducted using the working copy. The working copy

should be digitally and/or visually verified as to content and quality. For duplication

purposes, a master copy should be created and all subsequent copies be made from this

master.

1.5.5. To preserve the integrity of analog footage, it is digitized into a forensic workstation.

Refer to FAD‐FAVU‐SOP3 Media Duplication/Format Conversion for proper procedures.




1.5.6. Determine all relevant file information (i.e. codecs). Refer to FAD‐FAVU‐SOP2 Media File

Analysis for proper procedures.

1.5.7. The video/image enhancement process should remain a non‐destructive one, meaning

the original image or video must not be altered by the creation of the derivative. If a

destructive process is needed/required, the customer and supervisor must be notified

prior to processing. Refer to the HFSC Quality Manual for further information.

1.5.8. Every case is unique and will differ in the enhancement processes that need to be applied.

This will be determined by the analyst on a case by case basis based on the media and the

derivatives’ intended use. Examples of processes are:

1.5.8..1. Basic ‐ Basic image enhancement techniques are those used to improve the

overall appearance of the image. These techniques can be applied over an

entire image and in localized areas in an image. They include, but are not

limited to, the following: brightness and contrast adjustment, resizing (file

interpolation), cropping, positive to negative inversion, image

rotation/inversion, conversion to grayscale, white balance, color balancing

and/or color correction, basic image sharpening and blurring (pixel averaging)

and de‐interlacing.

1.5.8..2. Advanced ‐ While advanced image enhancement techniques may also be

applied to improve the overall appearance, they are often also used to extract

specific information contained in the image. The techniques include, but are

not limited to, the following: aspect ratio correction, frame averaging, fourier

analysis (including the use of FFT), deblur, noise reduction, image restoration,

color channel selection and subtraction, perspective control and/or geometric

correction, and advanced sharpening tools such as unsharp mask.

1.5.9. All enhancement techniques and processes must be documented. This documentation

should include the order and date in which the processes were applied to ensure the

integrity and the reproducibility of the results. The processing steps should be

documented electronically (saving to a file copy disc (kept in the Unit), importing into

LIMS, saving to an archive case file on server (kept in the Unit), etc.) and/or in case notes.

1.6. Derivatives

1.6.1. Results can be output to media, such as prints, write once optical media (e.g. DVD, CD),

hard drive, etc., for return to the requestor.

1.6.2. Media should be write protected, when possible. Rewritable optical media (e.g. DVD‐RW,

CD‐RW) should only be used as a last resort.

1.6.3. The type of output files (video, stills, or a combination) is dependent upon what best

illustrates the content, quality, and events to be depicted in the final product.

1.6.4. If adjustments for pixel aspect ratio are required for printing, in most cases they should be

done after all image processing and enhancement is performed. Prior to output, ensure




the pixel aspect ratio is correct for the chosen media. If the aspect ratio is not correct, the

output results may not be proportionate (width to height) and will not be an accurate

representation of the original image.

1.6.5. The derivatives should be marked with the forensic case number, unique identifier and

the analyst’s initials.

1.6.6. All derivatives will be entered and tracked through chain of custody in LIMS.

1.7. References

SWGIT Best Practices for Forensic Video Analysis, Version 1.0 2009.01.16

SWGIT Best Practices for Documenting Image Enhancement, Version 1.3 2010.01.15

Forensic Audio/Video Unit Standard Operating Procedures · Forensic Audio/Video Unit Table of...

Documents

Transcript of Forensic Audio/Video Unit Standard Operating Procedures · Forensic Audio/Video Unit Table of...