CST Evidence Export & Timestamping 3 — Questions and Answers
Question 1: A surveillance technician exports footage using proprietary DVR software that requires a viewer application to play back. What is the key concern for legal proceedings?
- The file will be too large for court exhibits
- The court may not have or accept the proprietary player, limiting accessibility (Correct answer)
- Proprietary formats always compress evidence and cause data loss
- The export will lack audio channels
Correct answer: The court may not have or accept the proprietary player, limiting accessibility
Proprietary formats require specific software to view, which may not be available to opposing counsel or the court, potentially challenging admissibility.
Question 2: During evidence export, the technician notices the footage contains visible on-screen timestamp burns. Why is this still insufficient without additional documentation?
- On-screen timestamps can be fabricated or reflect an uncalibrated internal clock (Correct answer)
- On-screen burns lower video resolution and must be removed
- Burned-in timestamps are not visible on all monitors
- Courts only accept timecodes embedded in the file container
Correct answer: On-screen timestamps can be fabricated or reflect an uncalibrated internal clock
On-screen timestamps reflect the DVR's internal clock, which may be inaccurate, requiring external time verification and documentation of any discrepancy.
Question 3: What is the purpose of exporting a slightly wider time window (e.g., 10 minutes before and after an incident) than strictly necessary?
- To increase the file size for more convincing evidence
- To capture pre-incident and post-incident context that may be relevant (Correct answer)
- To ensure the DVR buffer is fully flushed
- To comply with minimum export duration requirements
Correct answer: To capture pre-incident and post-incident context that may be relevant
Exporting extra footage before and after an incident captures context such as suspect approach, escape routes, or witness behavior that may be critical.
Question 4: Which action should a technician take FIRST when arriving to export evidence from a DVR at a crime scene?
- Begin exporting all available footage immediately
- Photograph the DVR display showing current date and time alongside a reference clock (Correct answer)
- Disconnect the DVR from the network to prevent remote tampering
- Reboot the DVR to clear any errors before export
Correct answer: Photograph the DVR display showing current date and time alongside a reference clock
Photographing the DVR clock display next to a reference clock immediately documents the time discrepancy before any changes occur.
Question 5: An NVR exports footage in MP4 format. A colleague suggests converting it to AVI 'for compatibility.' What is the correct response?
- Convert it, as AVI is universally more compatible
- Do not convert; transcode only a working copy and preserve the original MP4 as evidence (Correct answer)
- Convert it, as AVI preserves more metadata
- Convert it only if the file is over 2GB
Correct answer: Do not convert; transcode only a working copy and preserve the original MP4 as evidence
Converting recompresses the video, altering the original data; the original export must be preserved untouched while working copies can be transcoded.
Question 6: When multiple cameras captured the same incident, what is the recommended export practice?
- Export only the camera with the closest, clearest view
- Export all relevant cameras together and document each camera's ID, location, and time offset (Correct answer)
- Export each camera separately without cross-referencing
- Export only cameras that have uninterrupted footage
Correct answer: Export all relevant cameras together and document each camera's ID, location, and time offset
Exporting all relevant cameras with documented IDs, positions, and time offsets allows investigators to correlate multi-angle coverage of the incident.
Question 7: What is a 'write blocker' and when is it used in surveillance evidence handling?
- Software that prevents video editing on exported files
- A hardware/software device that prevents writing to source media during forensic imaging (Correct answer)
- A DVR setting that locks recording to a specific camera
- A legal injunction preventing evidence destruction
Correct answer: A hardware/software device that prevents writing to source media during forensic imaging
A write blocker is a forensic tool that allows reading from storage media while preventing any data from being written back, preserving original evidence.
CST Evidence Export & Timestamping 3
A surveillance technician exports footage using proprietary DVR software that requires a viewer application to play back.
What is the key concern for legal proceedings?