DVR Examiner 1.24.1

DVR Examiner 1.24.1

Update: DME Forensics has published version 1.24.1 which fixes an issue that may cause DVR Examiner to hang when an error is encountered. If you have already downloaded 1.24.0, please be sure to apply this update.

If you have already purchased DVR Examiner or have an active free trial you can download DVR Examiner from our support portal:

Download DVR Examiner

 

or if you want to give it a test drive

Free 30 Day Trial

Salient Sciences updates to VideoFOCUS and Cardinal MiniLab

Salient Sciences have released updates across their range of audio and video analysis and clarification software tools. I will update the relevant product pages as soon as I can but in the meantime if you would like a copy of the relevant products data sheet please send an email to info@demux.co.uk stating which product(s) you would like further information on.

VideoFOCUS Version 6.0 Released

VideoFOCUS Version 6.0 is now in general release, and incorporates numerous improvements including:

  • Improved Combine and Track Timing functionality in VideoFOCUS Pro, allowing synchronisation of multiple videos to a time-coherent MultiView session to review, process, and export as a group;
  • The CARDINAL MiniLab audio filters in VideoFOCUS Pro have been updated to the version 2.5 standard, allowing multiple preset combinations (e.g. Reverberation Reduction, Muffling Correction, Hiss Reduction, etc.) to be previewed and applied at once;
  • Most video filters plus the QuickEnhance audio filter, which were previously available only in VFPro, are now included with the VFSource product, and;
  • Demultiplex function now included with the VFCapture product.
VFPro V6 screenshot

VideoFOCUS Pro now with Multiview function.

All VideoFOCUS users who were current on maintenance or subscription as of 1 July 2016 are entitled to this update

CARDINAL MiniLab Suite Version 2.5

CARDINAL MiniLab Suite Version 2.5 incorporates several important improvements including:

  • Filter Chains can now be “nested”, allowing multiple presets to be previewed and applied in a single pass, and;
    Filter Chain now produces a comprehensive laboratory report describing all plug-ins used and their parameter settings, complete with screen shots, either as a Word document or an HTML webpage.
  • All current MiniLab license holders, including those who have previously purchased either the Advanced Suite or Forensic Suite, are entitled to this update.
Cardinal MiniLab screenshot

Cardinal MiniLab now with comprehensive Lab Report and ability to nest filters.

If you would like a copy of the relevant products data sheet please send an email to info@demux.co.uk stating which product(s) you would like further information on.

Which Forensic Hard Disk Image format is better?

Forensic Images for DVR Analysis – E01 or DD

binary data
Many computer forensic examiners utilise the E01 forensic image file format to store bit for bit copies of hard drives used in their examinations. It is the default imaging option for many computer forensics tools and has become a defacto standard of sorts.

While somewhat lesser known, the raw image file format also produces a bit for bit copy of the contents of a drive. This format is often referred to as the DD format due to the tool which originally generated such images.

There are two main differences between the two formats. First raw image files do not contain any metadata. They are simply an exact raw copy of the original data. Secondly, E01s natively support compression which typically results in a much smaller image file size.

At face value, E01 seems to be the superior format. It offers additional metadata and space savings, so what isn’t to like? As you’ll see, for those of us examining hard drives from DVRs, using E01s may not be the best choice.

Traditional Computer Hard Drives vs. DVR Hard Drives

Think for a moment about a typical computer hard drive that might be subjected to computer forensics examination. Among other things, an examiner is likely to encounter two things: free space and compressible data (high quality pictures, videos, etc).

Now consider what is typically contained on a hard drive from a DVR. First, there is usually little to no free space. The devices generally run 24/7 and overwrite themselves constantly. In addition, the data recorded is heavily compressed (with lossy technologies like H.264 and JPEG).

Effects of Compression in E01

Lossless compression (the type used in E01, ZIP, and many other applications) does a great job of offering the ability to save space while being able to recreate the original data exactly. There are two issues, however. First, if the original data is already compressed, the space savings won’t amount to much. More importantly, the process of compressing/decompressing isn’t free – there is overhead associated with it. This will mean less performance. That loss in performance might be worth it if you are achieving 50% space savings, but if your drive is full of already-compressed data, your space savings won’t come close to that number.

Experiment

Let’s do a short test to illustrate the above points. We’ll use a 500 GB 7200 RPM Western Digital SATA hard drive (approximately 466 GB of actual capacity). This particular hard drive was utilised in a real world DVR and was entirely allocated (full).

The destination hard drive for imaging/searching was an empty 1TB 10000 RPM Western Digital SATA hard drive. This is one of the fastest spinning disks on the market, so your results may vary depending on your hardware.

The test hard drive was imaged using AccessData’s FTK Imager in an unsegmented E01 format using the default compression setting (“6”). The imaging process completed in about 1 hour and 27 minutes. The resulting image file was approximately 434 GB yielding a savings of about 32 GB (a little less than 7%).

The E01 image was loaded into FTK Imager and a search for the (not present) ASCII text string (“UNFINDABLE”) was performed from the beginning of the first sector. The search process completed in approximately 1 hour 53 minutes.

The destination hard drive was formatted between tests in order to avoid any possible effects of fragmentation.

The test hard drive was imaged using AccessData’s FTK Imager in an unsegmented raw DD format. The imaging process completed in 1 hour 24 minutes. With no compression, the resulting image was obviously 466 GB.

The DD image was loaded into FTK Imager and a search for the same ASCII text string was performed from the beginning of the first sector. The search process completed in approximately 1 hour 6 minutes.

Results

FiletypeTime to ImageSpace SavingsTime to Search
E011:27:0632 GB (7%)~ 1:53:00
DD1:24:44N/A~ 1:06:00

Obviously the time to create the image was about the same, and we didn’t save much space (less than 7%) by using E01. Looking at the searching performance numbers however, you’ll notice that our searching was about 42% faster by utilizing the raw DD format over E01. That was just on one search, so if you are doing a lot of analysis on this data, that performance increase can really make a difference over the course of the examination.

These tests don’t take into account segmented image files. Segmentation (whether in E01 or DD format) does introduce some amount of overhead. We may explore this difference in a future blog post, but in short, you’ll see a slight performance by using unsegmented image files whenever possible.

Originally posted on the DME Forensics Blog May 27,2014

 

Read more about DVR Examiner here

DVR Examiner – Date & Time Correction, Sorting and Filtering

CCTV Time stampwrist watchHow often do you find that the time and sometimes even the date being used by a CCTV system is incorrect?

DVR Examiner - Sorting and Filtering

By using the Date/Time offset adjustments built into DVR Examiner you can quickly and easily adjust the DVR times to real time. Now you can find your date/time of interest without the hassle of doing the calculations.

Once you get the correct date/time you can easily sort, filter, and group clips to narrow down your search. Only need Channel 3 between a certain time? Apply a quick filter and limit the amount of video you have to review.

You can learn  more about DVR Examiner here

Commendation for Video Analysis and Court Presentation

I attended a commendation ceremony a few months ago at Bedfordshire Police HQ for police officers and others who brought the perpetrators of a large scale Cash for Crash operation to justice.

The text of the Chief Constable’s commendation included the following textDavid Thorne receiving commendation for video analysis

Judge Kay said, I want to commend the diligence and professionalism of the police officers and others involved in this inquiry. It has been a long and tortuous process to piece together the web of fraud in this operation. There were tens of thousands of documents that had to be reviewed, assessed and evaluated. By their efforts, the police and others involved have brought to an end a fraud which would have continued for some considerable time after November 2006 if it had not been stopped. It would have led to further considerable losses for the motor insurance industry and, ultimately, for all of us.

I COMMEND David Thorne who went to enormous efforts to put together all the photographic and video evidence, which was invaluable as it was so important to the investigation.

 

David Farrell QC  previously wrote;

David Thorne worked in collaboration with the OIC and Counsel. As Leading Counsel for the Prosecution I was impressed with the skills and dedication of David Thorne. He was often required to change or amend presentations over night or even at Court. He did so with speed and accuracy. (Tweet this)

Furthermore, he made positive contributions to the operation, using his former Police investigative skills to review the photographic evidence in the context of his knowledge of the case and thereby provide in itself valuable evidence. For example, he was able to see photographic damage to vehicles the significance of which had not been apparent to the investigative team and when placed before the Jury substantially contributed to the strength of this Prosecution.

I have no hesitation in recommending David Thorne as a dedicated and skilled forensic multimedia analyst who provides a first class service.

If you would like to discuss how David can help you to understand and present the video evidence in your case please use the Contact Us button or call 0845 226 3128

HR Managers can use CCTV Analysis in disciplinary investigations

CCTV CameraThe recent outcome of the EAT (Employment Appeal Tribunal) City and County Of Swansea v Gayle was reported  and discussed in a recent blog post  from the PPMA (Public Sector People Managers’ Association), the last paragraph being;

“This case is essentially helpful to employers both in making it clear that CCTV evidence will be potentially allowable as part of a disciplinary investigation and but also in making it clear how its use can be justified if there are privacy and human rights issues involved.” (Tweet this)

You may want to review the findings in this tribunal before setting out to use CCTV Analysis to provide evidence of wrong doing, see the link below.

A word of caution

If you are going to use CCTV material then you may want to consider consulting a CCTV analyst who can explain the technology, possible pitfalls and how to use the material in an investigation. CCTV Analysis will determine the content of the material and how it can assist you in your case.

Something that William Hill, the well known bookmakers, may have wished they had considered when investigating one of their employees. The Miller v William Hill Organisation EAT case of this year , also referenced in the PPMA blog article, discovered that their lack of knowledge of the time stamps used by their CCTV and computer systems not being synchronised lead to a flawed investigation and their subsequent dismissal of the appellant. The EAT found that the appellant had been unfairly dismissed.

(Tweet this)

see below for the transcript of the EAT.

Experts are here to help

If you are involved in in any legal matter which involves Audio or Video recordings or CCTV material we would be glad to provide you with expert assistance be that understanding the technology, analysing the content and possibly enhancing it, testing it against other material and preparing it for use in your case.

See here for the EAT Judgement in the Miller v William Hill Organisation.
See here for the EAT Judgement in the City and County of Swansea v Gayle 
See here for the PPMA blog article.

Has the CCTV video evidence been converted to DVD-VIDEO?

DVDinawindow-analoguematerial

Video tape recording converted to DVD-Video

It appears to have become common practice to convert CCTV video evidence to the DVD-Video format.

Why should Solicitors and courts care?

Our CCTV Analysis has shown that there can be issues with the quality of the conversion of the original material to DVD-Video in respect of image quality and it not always being a faithful representation of all the originally  recorded images.

Apart from the quality and veracity of the content it is unlikely that the Compilation DVD will  contain all of the material seized and you may possess information that requires additional images to be viewed.

See my previous article on the problems with using the DVD-Video format for evidential material. Click here

What to look for.

Here are some indicators to help you tell if the CCTV evidence has been re-formatted to the DVD-Video format;

  • The disc may be identified with an easy to see DVD-R or DVD+R text or logo, not a definitive test but enough to suggest that the material needs further examination.

    DVD+R disc

    Look for disc markings

  • When you insert the DVD into your computer either a window opens with options to play the DVD using one of your installed software players or one of those players automatically opens.
    pop up window when disc inserted

    Pop up window

     

  • Once the software player is open you may see a menu which might provide some information about the content of the video and who created it. The menu will also contain text or small thumbnails which act as buttons that allow you to select which video to play. Some DVD-videos do not have a menu and the video images play straightaway. – See more at: https://demux.co.uk/blog/category/dvd/#sthash.VhNJQScG.dpuf

    DVD Menu Screens

    Selection of DVD menu screens

  • With the video playing there are likely to be visual clues such as;
    • There might be a wide border, typically black, around the video.
    • The images may show the video playing in another player that you are unable to control.
    • The camera view may change suddenly indicating that the video may have been created as a compilation of views to show the images that best support the editors point.
    • Some of the text around the image such as the date and time may be blurred, imagine what the conversion has done to the image detail.
  • Using your computer explore the contents of the disc in the same way you would folders on your hard drive, if you find a folder entitled VIDEO_TS and it contains files with the extensions .IFO, .BUP & .VOB you have a DVD-Video.

What to do next?

If you want to ensure that you have all of the recorded images at the best possible quality and the CCTV system uses a Digital Video Recorder (DVR) you should request a bit for bit copy of the original material or if the system is tape based you will require access to the original master video tape recording.

Or if you prefer you can send the material to us together with copies of relevant case papers and we will carry out an Initial Assessment and provide a report on its suitability for analysis or as a format for presenting the evidence.

CCTV DVR

Storyboards

We have found that one of the most compelling methods of using video evidence is when it is in the form of a storyboard.

   We will take your video images and produce a document containing A4 size pages with typically six images per page. The images are produced in a chronological sequence and depending on the individual requirements the images may be all of the relevant images, a selection from a sequence or sequences from multiple cameras and systems.

We recently assisted an investigator who needed the video images in a format that could easily be used to show witnesses and interview suspects, he writes…

Operation Hovercraft
As part of an investigation into a large scale organised fraud I had seized CCTV videotapes for several dates from multiple locations. I needed to extract images of the offences taking place for use in obtaining witness statements and in suspect interviews and ultimately in any court proceedings. This task was made very difficult as the vast majority of the CCTV images were not time or date stamped.

   Demux quickly reformatted the tapes to DVD format with a time-code overlaid which allowed me to review and create a brief chronology of any relevant contents. Demux then digitised the relevant periods from the original tapes and created a storyboard of video stills to show the movements of those involved in chronological order, with the position of each person highlighted and colour coded. In addition they produced DVD’s containing video clips of each counter transaction.

   Their [Demux] background and expertise in this field has provided me with the material to effectively investigate the offences and will reduce the time required to interview witnesses and suspects.

Detective D. B. Economic Crime Unit, City of London Police

If you have video evidence and would like it in a format

that would allow you to use it effectively in your investigation or case preparation please contact us to see how we can assist you

0845 226 3128