Evidence Export & Timestamping Flashcards

A DVR was set to the wrong time zone, recording at UTC instead of Eastern Time (UTC-5). For a 7:00 PM EST incident, what time appears on the recorded footage?

Answer: 12:00 AM (midnight)

7:00 PM EST is midnight (00:00) UTC, so footage recorded in UTC would display 12:00 AM for the 7:00 PM local incident.

During export, a technician discovers the DVR's footage has gaps (missing minutes) in the recorded timeline. What must be documented?

Answer: The start and end time of each gap, possible cause, and whether the gap existed before export began

Documenting each gap's precise timing, extent, and pre-existing nature prevents the gaps from being attributed to tampering during the export process.

What is the risk of using 'save as' to re-save a video file during evidence handling rather than using a verified file copy method?

Answer: Re-saving can trigger re-encoding or metadata modification, altering the file and invalidating its hash

Re-saving through software may alter codec parameters, metadata, or even pixel data depending on the application, changing the cryptographic hash and compromising integrity.

An exported evidence file's MD5 hash computed at export time differs from the hash computed one week later. What does this indicate?

Answer: The file has been modified or corrupted since original export, and its integrity is compromised

A changed hash definitively indicates the file's content has been altered or corrupted since the original hash was computed, breaking the chain of integrity.

When exporting evidence from a PTZ (pan-tilt-zoom) camera system, what additional information must be documented compared to a fixed camera?

Answer: Pan, tilt, and zoom position data at the time of the incident, as field of view changes what is and isn't recorded

PTZ cameras change their field of view dynamically, so the exact position during the incident must be documented to establish what the camera could and could not see.

A building's surveillance system automatically overwrites oldest footage after 30 days. Law enforcement requests footage from 28 days ago. What is the technician's immediate priority?

Answer: Immediately export and preserve the footage before the overwrite cycle deletes it, then notify law enforcement

Immediate export is critical because overwrite cycles will destroy the evidence; preservation must occur before legal process formalities if evidence is at imminent risk.

What is the primary reason surveillance footage exported as a standard format (e.g., MP4) may still be questioned in court regarding timestamp authenticity?

Answer: Standard container formats do not cryptographically bind the timestamp to the content, so timestamps can be edited in metadata without visible changes

File container timestamps are mutable metadata fields that can be altered with widely available tools, so they require external corroboration to be trusted in court.