Forensic AudioVideo UnitStandard Operating ProceduresForensic Analysi - PDF document

1 Forensic Audio/Video UnitStandard Operat
Forensic Audio/Video UnitStandard Operating ProceduresForensic Analysis ivision Forensic Audio/Video UnitTable of ContentsForensic Analysis Division Table of ContentsAdministrative/QualityAudio AnalysisDVR ExtractionMedia Duplication/Format ConversionMedia File AnalysisMedia Repair/Recovery Analog and DigitalScene ResponseForensic Video/Image Enhancement Forensic Audio/Video UnitAdministrative/Quality Forensic Analysis Division ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis DivisionAdministrative/Quality1.1.Overview1.1.1.The Forensic Audio/Video Unit (FAVU) is responsible forthe analysis of audio and video evidence in analog or digital form. The FAVUexamines and enhances recordings as requested by laboratory customers. FAVUanalystsmay testify in local, state and federal courts concerning the procedures followed to preserve, analyze, duplicate, enhance, repair, and produce results.The FAVUis divided into two subdisciplines; Forensic Audio Analysis and Forensic Video Analysis.1.2.Services Offered1.2.1.Audio Analysis1.2.1.1.Foren

2 sic Audio Analysis is the scientific exa
sic Audio Analysis is the scientific examination of recordings for the purpose of increased speech intelligibility, attenuation of noise, and/or improvement of the overall quality of a recording. Forensic Audio Analysis can be applied to both analog and digital recordings. These recordings include, but are not limited to, recordings from mobile devices, body microphones, answering machines, 911 call recordings, interview room interrogations, and audio from surveillance video. Additionally, audio analysis includes the reconstruction (repair) of analog mediaif required. 1.2.2.Video Analysis1.2.2.1.Forensic Video Analysis is the scientific examination, comparison, and/or evaluation of video in legal matters. Video enhancement is any process intended to improve the visual appearance of video sequences or specific features within video sequences. Additionally, video analysis includes the reconstruction (repair) of analog mediaif required.1.3.Limitations1.3.1.It is widely acknowledged in the digital multimedia forensic scientific communities that data storage and s

3 ystems used to create, store, and manage
ystems used to create, store, and manage data varies. Variables include types of hardware, software, software versions, and sometimes alternate use of hardware and software from its original intent. Analystsapply their education, training, skills, knowledge, abilitieand experience to formulate a plan to analyze data and media by employing the most thorough and accurate methods defined by the FAVU’s standard operating proceduresOPs); and use the best applicable scientific practices of the digital and multimediavidence discipline.1.4.Roles and Responsibilities Administrative/QualityFADFAVUSOP1Issued By: Section SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis Division1.4.1.Members of the Forensic Audio/Video Unit have various duties and responsibilities. Individuals whocarry out forensic functions and perform casework must prove their competency prior to commencingcasework and must be authorized to doAudio and VideoAnalystswill be deemed competent based upo

4 n completion of the FAVU’s training
n completion of the FAVU’s training program (which may be modified based on experience)and the completion of competency testsAuthorizations will be documented in the form of Authorization Memos.1.4.2.Supervisor1.4.2.1.The Supervisor directthe dayday administrative and technical functions of the AVUDUTIES AND RESPONSIBILITIESincluded but are not limited toSupervise FAVUpersonnel in unitManage case assignments and requests for analysisCoordinateand maintaintraining programReviewunit’s metrics and/or statistical dataPerform administrative and technical reviewsPrepare reports for managementMaintain FAVUSOPsEnsure equipment inventory and maintenance documentation is maintained1.4.3.Analyst1.4.3.1.Analysts enhance audio and video (digital or analog)evidenceAnalyststestify in court when requestedDUTIES AND RESPONSIBILITIESincluded but are not limited toComplete Forensic Audio/Video Analyst training programand pass competenciesParticipate in annual proficiency testing Successfully obtain LEVA certificationPerform technical procedures on media following FAVU S

5 OPs to meet customerrequestsAdhere to th
OPs to meet customerrequestsAdhere to the HFSCQuality Manual and the Health & Safety ManualMaintain evidence integrity by using proper evidence seals and a chain of custody to track evidenceMaintain unit and lab securityPerform administrative and technical reviews of casework1.5.Safety1.5.1.Analystswill be aware of their personal safety when handling evidence and when called to a scene. If an analystsuspects a biohazard is present on media or recording devices at a scene, measures will be taken to ensure their personal safety, such as wearing personal protective equipment like gloves,masks, etc Administrative/QualityFADFAVUSOP1Issued By: Section SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis Division1.5.2.Gloves must be worn when handling any item that is thought tocontain a biohazard. 1.5.3.If media or recording devices contain a biohazardproper PPE shall be worn and the HFSC Health and Safety Manual will be followed. 1.5.4.nalystsshould be aware that elec

6 tronic devices are powered by electricit
tronic devices are powered by electricity and measures should be taken to avoid shock. 1.5.5.f disassembly of a device is required during analysis, analystswill be cautious of sharp edges. 1.5.6.juries shouldbe reported to supervisor and the Health and Safety Specialist immediately to receive appropriate medical attention.1.6.Security1.6.1.The FAVUwork area is secured by locked doors controlled with key card access and by locked doors controlled with individual keys.1.6.2.Evidence in the process of examination is stored at the analyst’s desk or in the evidence storage room1.6.3.Completed items are stored under proper sealand placed in an evidence storage area until they can be returned to the customer or evidence triage group.Exceptions to evidence packaging and storage conditions may be made for exceptionally large items that pose additional challenges. However, evidence will be secure in a limited access area regardless of size.1.7.Quality1.7.1.Validation1.7.1.1.The Unitresponsible for determining whether a new method, software, and/or hardware require

7 validation. Forensic applications (incl
validation. Forensic applications (including off the shelf software) that have been externally validated by reputable sources do not need to be validated by the FAVU but mustbe verified internally(performance checked)before being used for casework. 1.7.1.2.The Forensic Software/Hardware Internal Validation Form will be used to document any validations complet1.7.1.3.Validations and verifications shall be performed on the individual functionality of hardware or software that is relevant to the unit’s technical services, rather than validating all features of a hardware or software.If the functions that are validated work as intended, then the software as a whole has been validated andapproved for casework.1.7.1.4.Equipment/softwareused in a support capacity, from which no direct results are reported, as well as equipment solely designed to decode data and/or identify, remove or bypass security measures, are considered administrative tools and do not require validation or verification(i.e. software such as Media Info or GSpot) Administrative/QualityFADFAVUS

8 OP1Issued By: Section SupervisorIssue Da
OP1Issued By: Section SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis Division1.7.1.5.Subsequently released versions of previously validated equipment or software shall be approved for use after a review of the available release notes by the Unit Supervisoror designee in the applicable software/hardware function(s).Documentation of release notes will be maintained the Unit.1.7.2.Equipment/Maintenance1.7.2.1.Equipment must be maintained to ensure proper performance. Only suitable and properly operating equipment shall be used for caseworkEquipment not frequently usedor not functioning properlywill be labeled out of service with the out of service date noted.1.7.2.2.Equipment will undergo maintenance asneedevia aexternal vendorand will be performance checkedprior to use on casework.1.7.2.3.The Unit maintains an inventory list of laboratory equipment and software (including number of licenses and version numbers) internally.1.7.2.4.Analog equipment is performanc

9 e checked prior to use and noted in the
e checked prior to use and noted in the case record.1.7.2.5.Digital cameras areused for documentation purposes only and are not performance checked but are cleaned as needed. 1.7.2.6.Forensic software that is determined to be infrequently used will be performance verified annually. This will be determined based on data reviewed during technical reviews and by staff feedback. Performance verifications will be documented.1.7.3.Integrity Verification1.7.3.1.Digital and multimedia evidence submitted for examination mustbe maintained in such a way that the integrity of the data is preserved and proven to be ‘reliable’ for court testimony.1.7.3.2.Integrity verification can be accomplished digitally (i.e. hashing) and/or visually ascontent and quality. 1.7.3.3.Writeblockers can also be used for evidence such as USB drives, hard drives, etc. to prevent modification (addition, deletion, or alteration) of media content.1.7.3.4.If the submitted media has a mechanism designed to preserve the recording (safetyrecord tabs, jumper, software setting, etc.), docum

10 ent its state upon receipt. If not alrea
ent its state upon receipt. If not already engaged, activate the mechanism and document that fact. If there is a clear reason not to engage the write protection (e.g., to preserve fingerprints)document that it was not engaged and the reason.1.8.Evidence Handling1.8.1.Submission of Items for Examination: Administrative/QualityFADFAVUSOP1Issued By: Section SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis Division1.8.1.1.The analyst should work with the submitter to ensure that the most appropriate form of the evidence is submitted.1.8.1.2.Evidence to be analyzed by the Unit may be directly submitted through the Unit’s intake areaor delivered to the Unit via the Client Services/Case ManagementteamIf the case has not been createdand/or submitted yet, then a case will be started and a unique forensic case number will be assigned to itin LIMS. If the case has already been createdin LIMS, then that piece of evidence will be added as an additional submission item

11 .This can be checked by searching the ag
.This can be checked by searching the agency’s incident number in LIMS.1.8.1.3.The submitted items are visually examined for damage by the analyst before analysis. If damage is observed, the damage must be photographed and the description of the damage documented in the case record1.8.1.4.Peripheral equipment that does not store data (e.g. monitors, VCRs, audio players) will not be accepted unless those items are unique and are required to facilitate the examination. 1.8.1.5.Receipt of evidence from the submitting customer/agency will be documented at the time of transfer electronically in LIMS and on the submission form, if applicable.1.8.1.6.Submitted items are uniquely marked for identification using the forensic case number and item number1.8.1.7.When evidence is not being actively worked on, then those items mustbe securely locked in the FAVU general evidence lockers or other secure location. Be sure that internal transfers tothe unit’sevidence storageare reflectedin LIMS. Also, all evidence in FAVU storagemust be sealed properly.1.8.1.8.Whenev

12 idence is actively being worked on, then
idence is actively being worked on, then those items should be securely locked in the analyst’s personal storageor secure location. In cases where a DVR is being extracted, the door to the analyst’s office must be lockedwhen the analyst leaves for a period of time (lunch, end of day, etc.)vidence must be in the analyst’s custodyin LIMS. The evidence does not need to be sealed whileit is being worked on. 1.8.1.9.If a case is received where a biohazard is suspectedthe appropriate safety precautions will be followed. See the Houston Forensic Science Center (HFSC) Health and Safety Manual for more detailed information.1.8.2.Submission of Evidence Collected at cene:1.8.2.1.Analystswho are requested to attend onscene incident callouts may assist customers/agenciesin identifying devices that may contain evidence relating to the incident. 1.8.2.2.Analystswill use safety precautions while at a scene. See the Houston Forensic Science Center (HFSC) Health and Safety Manual for more detailed information. Administrative/QualityFADFAVUSOP1Issued By: Sectio

13 n SupervisorIssue Date: April 22, 2016Un
n SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis Division1.8.2.3.Analystswill have the requestor fill out the appropriate submission form to document their request.1.8.2.4.Analysts should photograph the scene, including anyDVR, camera locations and anything else related to the surveillance system or the case.1.8.2.5.Evidence retrieved ‘onscene’ should be transported to the FAVU and secured.Evidence should be transferred to permanent media (i.e. CD/DVD) and that will become itemin LIMS.1.8.2.6.Retrieved evidence will bedocumented electronically in LIMS upon arrival to the FAVUandon paper as part of the chain of custody, if applicable.1.8.3.Returning Evidence:1.8.3.1.Upon completion of casework, evidence shall be sealed properly. A proper seal is one in which there is no possibility that the contents of a container can be removed, altered or a substitution made without the seal being obviously disturbed. Whenever possible, media will be packaged in

14 the same condition/packageas it was rece
the same condition/packageas it was received.1.8.3.2.Outer evidence containers will be sealed and the seal labeled with the analyst’s initials before being returned. Some items may be too large to properly seal. However, every effort will be made to secure the item with its appropriate identifiers. 1.8.3.3.The original submitted item(s) along with hardcopies, CD’s, DVD’s, tapes, and other items produced at the request of the submitter will be kept in the unit’s evidence locker until released to an authorized individual (if the item is of appropriate size to be stored there).1.8.3.4.The return of evidence will be documented at the time of transfer electronically inLIMS and on paper as part of the chain of custody, if applicable.1.9.Documentation1.9.1.The analyst will document observations while performing casework. The case record shouldcontain a through description of submitted items, notation of any repairs made, analystsnotes, and hardware and software used for casework (to include version number of software).Thecase record/file can be m

15 ade up of print outsstored all electroni
ade up of print outsstored all electronically in LIMSor a combination of both1.9.1.1.When a case record is printedall documentation must be marked with the analyst’s initials, forensic case number, and page number.1.9.1.2.aserecordscan also be maintained on an archive disc that is retained in the Unit and/or electronically in LIMS in lieu of printing them out.1.9.1.3.Discrepancies with the submission information documented in the request for analysis must be notedin the case record1.9.2.All media shallbe photocopied or scanned and maintainedin the case record. Administrative/QualityFADFAVUSOP1Issued By: Section SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis Division1.9.2.1.Using a permanent marker, mark all media with theanalyst’s initials, the forensic case number and item number.1.9.3.All data pertinent to the case will be kept the case recordThis includes,but is not limited to, notes, copies ofprints, original submission form, CD’s, DVD

16 46;s, etc.This can be electronically mai
46;s, etc.This can be electronically maintained in LIMSon a secure server, stored in a physical case file folder, or on an archive disc.1.9.4.Technicalnote taking should be kept throughout the examination process to document how itemswere handled and what work practices/processes were performed. 1.9.4.1.The notes mustbe detailed enough to allow a comparably trained analystto repeat the process and arrive at the same result1.9.5.The analyst is responsible for writing a report that provides the reader with all the relevant information in a clear and concise manner, if applicable. 1.9.6.If a case requires deviations from normal operating procedures, approval by the section supervisor is needed. The deviation must bedocumentedin the case record1.9.7.It is sometimes necessary to modify a report after it has been issued. This may be necessary to correct an error in the report, to document additional analysis conducted after the issuance of the report, at the request of an attorney involved in the case, or for various other reasons. 1.9.7.1.If it becomes necessary t

17 o amend a signed report, then the new re
o amend a signed report, then the new report will be clearly identified, will contain a reference to the original report that it is replacing, and will clearly state why an amended report was issued. The original report must be maintained within the case record.1.9.8.Technical and Administrative Reviews1.9.8.1.At least twentyfive percent of the FAVU cases will be technically reviewed by an individual other than the author of the report prior to the issuance of the final report. 1.9.8.1.1.The technical reviewer will fill out the appropriate review formThis form wilthen be added to the case record1.9.8.2.All case files willbe administratively reviewed by an individual other than the author of the report and the technical reviewer prior to the issuance of the final report. 1.9.8.2.1.The administrative reviewer will fill out the appropriate review form. This form will then be added to the case record1.9.8.3.There may be afterhour and/or timesensitive circumstances in which derivative data needs to be released to the customer without its corresponding report h

18 aving an administrative and/or technical
aving an administrative and/or technical review. In these circumstances, it will be made clear to the customer that an official report cannot be released until it has undergone the administrative and technical review process. 1.9.8.4.If there are conflicts during a technical reviewwhere the case analyst and the technical reviewer cannot agree on the way a case was handled or how a case is Administrative/QualityFADFAVUSOP1Issued By: Section SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitAdministrative/QualityForensic Analysis Divisionbeing reported, the conflict shall be brought to a supervisor to make a determination and resolve the situation. These instances willbe trackedby the supervisor in efforts to monitor trends and ensure quality. Administrative/QualityFADFAVUSOP1Issued By: Section SupervisorIssue Date: April 22, 2016Uncontrolled When PrintedPage of Division Audio/VideoAnalysisDivisionAudioAnalysisFAVUBy:SectionSupervisorDate:January11,2016When procedureForensicAudio/VideoUnitanal

19 ystsexamineevidence.Limitationswrongtype
ystsexamineevidence.Limitationswrongtypefiltersproperlyconfiguringsettingscouldintelligibilitycontent.Equipment/Software:Computer/LaptopUSB/Network/Firewiresoftwareneeded)needed)AudacityMiniLabProceduresubmittedfordamage(thisincludeshousings,documentreceivedand/ordocumenttheitemstypemedia,manufacturerinformation,digitalevidencescannedintegritydigitalcopy.informationcodecs).SOP2MediaFileprocedures.thebetweenuncompressed(e.g.,wheneveranalogevidence,determinetheequipmentfordigitalUsedigitalworkingfurtherexaminations.EnhancementProceduredeviceconnectionsplaybackmedia(standard,micro,mini)frequencyresponsethecontent. Audio/VideoAnalysisDivisionAudioAnalysisFAVUBy:SectionSupervisorDate:January11,2016When thatplaybackdevice   recordinganalyzedeterminenoiserecording.audiofilter(s)thatcontent.necessarytypestechniquesmaximizeExamples(butlimitedto):Graphicfilter,Adaptivetheandsettingselectronicallynotes(e.g.screenshotsanalystdeterminedfiltersclarifyaudiopertinentrequestedmedia,therecordingblankmediathenensurethatcaptured.thatenhancedmedia.number,uniqueidentifierinitials

20 .itemscustomer.WorkingGroupEvidence Work
.itemscustomer.WorkingGroupEvidence WorkingGroupImagingTechnologywww.swgit.org EnforcementEmergencyServicesInternationalwww.leva.org Forensic Audio/Video UnitDVR ExtractionForensic Analysis ivision ��Forensic Audio/Video UnitDVR ExtractionForensic Analysis DivisionDVR Extraction1.1.Scope1.1.1.This procedure applies to Forensic Audio/Video Unit analystswhose primary responsibility is to collect and/or prepare digital multimedia evidence for examination and analysis in legal matters. 1.2.Limitations1.2.1.Some removable storagemedia is small and often hard to locate and could be overlooked. USBdrives may be obfuscated to thwart detection, and some removable storage media is susceptible to immediate physical destruction.1.3.Recommended Equipment:Computer/Laptop CD/DVD writer, administrativeaccess, USB/Network/Firewire ports, etc.Media card readersExternal CD/DVD writerUSB/FireWire mass storage devices (multiple sizes), formatted both FAT32 and NTFSCables Network, VGA/Video/Composite/RCA/HDMI, Audio cables, USB/FireWire, Power cables, Extension cables

21 , etc.A/D converter Scan converterWrite
, etc.A/D converter Scan converterWrite BlockersCDs/DVDsMedia Cards (various types and sizes)Monitors (various types including analog capabilities)CameraDigital Video Tape Recorder with blank tapesTools screwdrivers (various types), flashlight, mirror, etc.1.4.Documentation:1.4.1.Research the make/modelof the DVR in question, including reviewingthe user manual (if available).1.4.2.Photograph all applicable sides of the DVR including all ports and information such as serial number and model number. When accessing the information on the DVR, the analyst should photograph all the screens, including menu options, recording informationand hard drive information.1.4.3.Document the following, if applicable: DVRExtractionFAVUSOPIssued By: Section SupervisorIssue Date: April 29, 201Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitDVR ExtractionForensic Analysis Division1.4.3.1.ystem Informationdate/time (compare to the actual date/timeand document the offset), software/firmware version, usernames and passwords, overwrite settings1.4.3.2.torage

22 Information hard drive capacity, amount
Information hard drive capacity, amount of hard drive used, number of hard drives (including external)1.4.3.3.Recording Settings resolution, schedule, motion/alarm settings, earliest recording/latest recording, frames per second (fps, etc.1.4.3.4.Networking settings IP address, usernames and passwords for network, etc.1.5.Assessing Extraction:1.5.1.Determine the date/time needed to be extracted from the DVR.1.5.1.1.The length of time can determine how to extract data off the DVR.1.5.1.2.The date/time of DVR may be off so make sure to adjust when needed1.5.1.3.ecide which cameras, if notall, need to be extracted1.5.2.Determine what methods of extraction are available on DVR.1.5.3.Find out what formats are available.1.5.3.1.AVI format is availablethen extract that with the native format, if time allows. ry and get native format each and every time1.5.4.Some DVRswhen powered onwill continue to record even when no cameras are set up. Make sure to stop recording before exporting as this could impact what is overwritten.1.6.Extraction Methods:1.6.1.CD/DVD writer 1

23 .6.1.1.The DVR system shouldhave an arch
.6.1.1.The DVR system shouldhave an archive, backup, copy, or export function inwhich you can write the data to the CD/DVD driveMake sure the proprietary player is exported with the files. This may have to be chosen manually in the system.1.6.1.2.Writeonce discs should be used, if available (CDR, DVDR)If data will not write to media, try different brands and sizes. If a rewritable disc is used, make sure to transfer to a writeonce disc when possible.1.6.1.3.If the DVR has a finalize disc option, make sure this is turned on and used. 1.6.1.4.After exporting, verify that the downloaded/exported file(s) play back correctly on another system and that the proper dates and times were retrieved.1.6.2.Compact Flash drives 1.6.2.1.Compact flash drives are considered a temporary storage medium. The data should be transferred to permanent media when possible.1.6.2.2.The DVR may only read certain sizestypesor formats of compact flash drives so try all typeif difficulties are encountered.1.6.2.3.This method may require the files to be exported in real time. DVRExtractio

24 nFAVUSOPIssued By: Section SupervisorIss
nFAVUSOPIssued By: Section SupervisorIssue Date: April 29, 201Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitDVR ExtractionForensic Analysis Division1.6.2.4.After exporting, verify that the downloaded/exported file(s) play back correctly on another system and that the proper dates and times were retrieved.1.6.3.USB/FireWire/SCSI devices 1.6.3.1.Most DVRs have ports to connect external USB/FireWire/SCSI devices. Make sure the ports are functional and the devices are being recognized by the DVR.1.6.3.2.USB drives can be used for exporting data, especially smaller amounts of data. For larger amounts of data, an external hard drive may be used. Use different types, sizes, and formats (i.e. FAT32, NTFS) of drives until one is recognized by the DVR. 1.6.3.3.The analyst may have to manually choose the device to backup to. 1.6.3.4.Make sure the proprietary player is exported with the data. The analyst may have to manually choose this in the system.1.6.3.5.USB drives are considered temporary storage devices and the data should be tr

25 ansferred to permanent media when possib
ansferred to permanent media when possible.1.6.3.6.After exporting, verify that the downloaded/exported file(s) play back correctly on another system and that the proper dates and times were retrieved.1.6.4.Networking 1.6.4.1.Most DVRs have a network port in order to do remote viewing.1.6.4.2.Connect a laptop to the DVR using an Ethernet cable. Make sure the laptop being used has administrator rights. Firewalls should be disabled.1.6.4.3.Access the network menu of the DVR. This may require an additional username andpassword. Note the IP address of the DVR. Do not change the settings on the DVR.1.6.4.4.Change the IP address in the network settings on the laptop to coincide with the DVR. Verify that a connection was made.1.6.4.5.Using the remote viewer/software on the laptopnd the requested date/time. The viewer may need to be downloaded to the laptop from the manufacturer or an onlinesource1.6.4.6.The data can be exported using the viewer or screen capture software.1.6.4.7.After exporting/capturing the data, make sure the firewall settings are turned back

26 on the laptop and all settings on the D
on the laptop and all settings on the DVR are back to where they were.1.6.4.8.Verify that the downloaded/exported file(s) play back correctly on another systemand that the proper dates and times were retrieved.1.6.5.Video/Composite/VGA/DVIOutput 1.6.5.1.Some DVRs only have an analog output. If analog output isthe only option, the data must be exported in real time.This should be considered last in the extraction method process as aspect ratio, frame rateand other areas could be incorrect.here may be also loss of quality and compression.1.6.5.2.The analog output options should be observed and the best option for transfer selected DVRExtractionFAVUSOPIssued By: Section SupervisorIssue Date: April 29, 201Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitDVR ExtractionForensic Analysis Division1.6.5.2.1.Using an A/D converter or scan converter, the analog signal can be run into a laptop/computer where it can be captured using a screen capture tool (i.e. Star Witness, Omnivore).1.6.5.2.2.A digital video tape recorder can also be used to re

27 cord the video. The recorder should be
cord the video. The recorder should be connected to the “video out” port (svideo, etc.) and the analyst can confirm the signal by viewing the monitor. It is recommended to use digital magnetic tape (i.e. MiniDV).1.6.5.3.The analyst may need to record each camera separately and the date/time stamp should be visible on the recording.1.6.5.4.Verify the recording by playing back the tape. The tape should be transferred to digital media when possible.1.7.Derivatives1.7.1.After exporting, verify that the downloaded/exported file(s) play back correctly on another systemand that the proper dates and times were retrieved.1.7.2.Working copies shouldbe made from the files extracted from the DVR. 1.7.3.Files extracted from DVRs will be given to the submitters in a format as requested, i.e. CD/DVD. 1.7.4.The items created will be documented in the case notes and chain of custody will be tracked in LIMS.1.8.ReferencesSWGIT Best Practices for the Analysis of Digital Video Recorders, Version 1.0 2012.06.11SWGIT Best Practices for Retrieval of Digital Video, Versi

28 on 1.0 2013.09.27 DVRExtractionFAVUSOPIs
on 1.0 2013.09.27 DVRExtractionFAVUSOPIssued By: Section SupervisorIssue Date: April 29, 201Uncontrolled When PrintedPage of Division Audio/VideoDuplication/FormatConversionAnalysisDivisionFAVUBy:SectionSupervisorDate:January11,2016When Duplication/FormatConversionprocedureAudio/VideoUnitand/orprepareMultimediaEvidence(DME)matters.conversionunderstandingmediaplayback,capture.mediaduplicationhavetreateddocumentedLimitationsRepetitiveplayback,rewinding,pausingmediaDependingused,mightdigitalmedia,thatquality:times,equipmentmedia,EquipmentHardwareandvideo):miniDV/HDVMatroxMXO2Mini:capturesplaybackscomponent,Supportschannelsaudio7.1surroundmonitoringHDMICapture(uncompressed)Computer/LaptopreaderAudio,USB/FireWire,Monitorsincludingcapabilities)Software(i.e.Omnivore)EncoderFIVE Audio/VideoDuplication/FormatConversionAnalysisDivisionFAVUBy:SectionSupervisorDate:January11,2016When (proprietaryformats,universalcarvedimbeddedProcedureAnalogVideoEvidenceplaybackimagesExaminelocatethedefinedconnectedworkstationdigitized(i.e.AmpedVideonowtranscoded/encodedcaptureuniversalpl

29 ayability.    wheretranscodingexamin
ayability.    wheretranscodingexaminationnormaltranscoding/encodingensureleastUniversalDigitalFormatConversionshouldfileMediacomputerthatcompletelycodecs.thereareincorrectratiodigitaltranscodedways:codectranscodethereratiothesometimescorrectedbefore(i.e.AmpedFIVE,AdobeintoformatthethevideoplayerthencapturedscreencapturethequalitythatWindowsthedisplayedthenotdisplayedcorrectaspectcorrectedthecaptureutilitybrought(i.e.Photoshop),correctedthenrenderedthequalitythatWindows Audio/VideoDuplication/FormatConversionAnalysisDivisionFAVUBy:SectionSupervisorDate:January11,2016When ProprietaryConversionshouldadministrativethewilltheplay,aspectframerequired.thethenthefile(s)playback.Thefollowingproprietarydigital(i.e.AmpedFIVE)transcodefileformatthefileopenplayedcapturedcapturethedisplayedtheshouldthecaptureutilityuncompressedbroughtinto(i.e.Photoshop),ratioqualitythat Division Audio/VideoAnalysisDivisionFAVUBy:SectionSupervisorDate:January11,2016When AnalysisprocedureForensicAudio/Videoperformingmultimedia(DME).Limitationsshouldconvertedanotherrewriteheadercompromisean

30 d/orEquipmentHardware:Computer/Laptoprea
d/orEquipmentHardware:Computer/LaptopreaderMonitorsincludingcapabilities)Software:FormatsWMV,etc.)(UniversalFormatsAVI,FIVE(Manyproprietary(Manyproprietaryformats,.exeProcedureshouldthedigitaland/ordetermineunderwhichsubmittedmediaThefollowinginformationRecordingmethodplaybackviewingrecordingthedocumentedthenotedthenotes.preliminarydeterminationthecomparison,thedeterminesanyadditionalnoted Audio/VideoAnalysisDivisionFAVUBy:SectionSupervisorDate:January11,2016When manyinstancesheaderinformationaccuratelyThedeterminemakecorrectionsoutput,needed.Speedtheplaybackaccomplished(i.e.FIVE,Premiere).manyinstancesratio(SAR)representedaspect(DAR)theplayer.notedcorrectionenhancement Division Audio/VideoRepair/RecoveryAnalysisDivisionRepair/RecoveryAnalogandDigitalFAVUBy:SectionSupervisorDate:January11,2016When Repair/RecoveryAnalogDigitalprocedureForensicAudio/VideoUnitanalystscollectpreparedigitalmultimediaexaminationanalysismatters.ThisprocedureunderstandingthefundamentalsphysicalmediamediamagnetictapeCD/DVDfinalizedmedia.LimitationsTypically,digitalmediaetc.)ForensicAudi

31 o/Videobackdamagedcoulddestructionequipm
o/Videobackdamagedcoulddestructionequipmentused.mediamustphotographed/documented.   submittedfordamage(thisincludeshousings,documentrecordtheconditionreceived.submitteditemspermanentlaboratorynumber,uniqueinitialswritingpreviousdocumenttheitemstypemedia,manufacturerinformation,Proceduretypefacilitateplaybacktheanalogmediaincludinglimited8mm,mediarecordingdamagethisrecommendedanalyststheyconductingdocumentconditionpropertheextentmagnetichousing.Magnetictorn,stretched,tapepieceswheretapepieces.piecesuniquelyidentifiedcustomer. Audio/VideoRepair/RecoveryAnalysisDivisionRepair/RecoveryAnalogandDigitalFAVUBy:SectionSupervisorDate:January11,2016When appropriatesplicingMatchthepiecestogetherand,editthemagnetictape.Thererepaired.tapeplacedhousingcondition.housingrepairedmagneticcompatiblethehousing.uniquelyidentifiedHousingtypes,tapemediahousing.thehousingdamaged,magneticcompatibleplacehousing.LabeldiscardthemuniquelyMagneticTapethemagnetictapedirt,grime,water,material,recommendedmagnetictapecleaningthatadverselymedia.themagneticcompatiblehousingplayback,Protectiont

32 herewritefeaturehousing,enableprotectthe
herewritefeaturehousing,enableprotectthealteration.Repairdoesn’tthedrive,differentcommerciallydiskmaydatausedpolishingdamagefinalizedtracksrecovereddedicatedAlthoughfinalizinglab,recoveredunsureconsultcomputerforensicsexaminerrecoverdisc.DuplicationSOP3Duplication/Formatduplicatingmedia.evidenceitemstheincludingdamagedbrokenitem.returningitemadditionalitems,documentcustody Audio/VideoRepair/RecoveryAnalysisDivisionRepair/RecoveryAnalogandDigitalFAVUBy:SectionSupervisorDate:January11,2016When WorkingGroupEvidence WorkingGroupImagingTechnologywww.swgit.org EnforcementEmergencyServicesInternationalwww.leva.org Forensic Audio/Video UnitScene ResponseForensic Analysis Division ��Forensic Audio/Video UnitScene ResponseForensic Analysis DivisionScene Response1.1.Scope1.1.1.This procedure applies to Forensic Audio/Video Unit (FAVU) analysts who are called to collect video evidence and/or provide guidance to customers at a scene or offsite location.1.2.Equipment1.2.1.Field kitmay contain vendor manuals, optical media, flash media,USBdrives, analogcables, f

33 orensic computer, writeblocking devices,
orensic computer, writeblocking devices, A/D converter, scan converterand tool kit.1.3.Preparing for CallOut1.3.1.The FAVU receives requests to assist customers at offsite locations to recover audio or video evidence. These requests are commonly referred to as “callouts” by the FAVU.1.3.2.In order to assist a customer on a calloutcertain information is needed. The following nformation is requiredfor a calloutScene locationLocation type (residence, business, etc.)Name of the requestor and agency information.1.3.3.When a call for assistance is received, questions should be asked prior to leaving for the scene.n attempt should be made to getas much information as possibleprior to heading to the scene. Important or helpful information includes:ontact information for the location.ype of DVR at the location (manufacturer and model)?Date and time of incident and how much video or audio will need to be downloadedype of incident/subject matter of videoasswords to DVR(s)1.3.4.Make sure the field kit has all the necessary equipment needed and items were repla

34 ced if used. 1.4.Scene Arrival1.4.1.The
ced if used. 1.4.Scene Arrival1.4.1.The following information must be captured, if it is available, on relevant itemsobseved at the scene, including but not limited to:DVR make, model and serial numberBased or StandAlone EmbeddedNumber of recording unitsIs system networked? (If it is, this may need to be disconnected to make sure no remote access is usedDate/timedisplayedActual date/timeRecording capacity and when DVR will overwriteNumber of cameras and locations Scene ResponseFADFAVUSOP8Issued By: Section SupervisorIssue Date: April 28, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitScene ResponseForensic Analysis DivisionType of camerasSystem settingsPlayback softwareif knownIs audio being recorded?1.4.2.All notes must be includedin the case record.1.4.3.Photograph the DVRand any menu settings that can be accessed to show all the settings of the DVR1.4.4.Request all usernames and passwords. If not known, then reference the manual for default passwords or contact the manufacturer.1.4.5.Observe video and establish that the inc

35 ident is still recorded on the system.1.
ident is still recorded on the system.1.4.6.Assess all extraction methods available on the DVR and choose the best method for extraction based on amount of video needed. Also, determine native/proprietary format.1.5.Extracting Video1.5.1.Refer to FADFAVUSOP7 DVR Extractionon how to extract the incident from the DVR.1.5.2.If all extraction methods are exhaustedthen methods like a scanconverter or analog to digital converter can be used but only as a last resort.1.5.3.If all options fail at the scene, then the DVR can be seized with consent or warrant and submitted to the Unit.1.6.Considerations1.6.1.If evidence is collected from the scene for submission to the laboratory, a FAVU submission form must be completed. 1.6.2.Once video is extracted, verify everything has been collected and is playable.1.6.3.If a player is needed, make sure the player is provided to the customeror the video is in a playable format.1.6.4.Document any derivatives made at the scene.1.7.Derivatives1.7.1.If derivatives are given at the scene, one of the following items mustapply:o forensi

36 c software was used at the scene.There a
c software was used at the scene.There are timesensitive circumstances (i.e. Amber Alert, high profile homicides) in which forensic software may be used for media releases.In these circumstances, it will be made clear to the customer that an official report cannot be released until it has undergone the administrative and technical review process. 1.8.Returning from CallOut1.8.1.Determinethecase existsin LIMSIf a case does not exist, a new case must be createdvidence from the calloutwillbe submitted and/or archived.1.8.2.All necessary case notes mustbe completed and uploaded into LIMS.For circumstances in which the derivative is given at the scene and no forensic software was used, no LIMS assignment is required and no forensic reportis issued.1.8.3.If there are additonalrequests, the appropriate analysis willbe performedA forensic report will be issued and all necessary reviews will be completed. Scene ResponseFADFAVUSOP8Issued By: Section SupervisorIssue Date: April 28, 2016Uncontrolled When PrintedPage of ��Forensic Audio/Video UnitScene Respo

37 nseForensic Analysis Division1.9.Referen
nseForensic Analysis Division1.9.ReferencesBest Practices for the Retrieval of Digital Video, Version 1.0 2013.09.27Star Witness Training Manual (March 25, 2015) Scene ResponseFADFAVUSOP8Issued By: Section SupervisorIssue Date: April 28, 2016Uncontrolled When PrintedPage of Division Audio/VideoAnalysisDivisionVideo/ImageEnhancementFAVUBy:SectionSupervisorDate:January11,2016When Video/ImageEnhancementprocedureForensicAudio/VideoUnitanalystsprimaryenhance/clarifydigitalmultimediaincludesunderstandingfundamentalsdigitaleditingsequences,exportinginterest,mediaImageEnhancementincludesunderstandingthetechniquesrevealcontentLimitationsnondestructive.negativelyEquipment/HardwareComputer/LaptopreaderSoftwareFIVEEnhancementProceduresubmittedfordamage(thisincludeshousings,documentreceivedand/ordocumenttheitemstypemedia,manufacturerinformation,integritydigitalcopy.conductedThedigitallycontentandquality.createdsubsequentcopiesmadeintegritydigitizedintoworkstation.SOP3Duplication/Formatprocedures.    Audio/VideoAnalysisDivisionVideo/ImageEnhancementFAVUBy:SectionSupervis

38 orDate:January11,2016When information(i.
orDate:January11,2016When information(i.e.codecs).procedures.enhancementdestructiveimagecreationprocessneeded/required,customernotifiedManual    uniquewilltheenhancementprocessesdeterminedcasemediaintendedExamplesimageenhancementtechniquesimproveimage.techniquesappliedTheyinclude,limitedthecontrastresizing(filecropping,positivenegativeinversion,balance,sharpeningblurring(pixelaveraging)interlacing.imageenhancementtechniquesimproveappearance,usedinformationcontainedimage.techniquesinclude,butto,(includingthedeblur,channelsubtraction,and/orgeometricandenhancementtechniquesdocumented.ThisdocumentationthedateensuretheintegrityreproducibilitydocumentedelectronicallyfileUnit),importingserver(keptUnit),etc.)(e.g.DVD,requestor.protected,Rewritablemedia(video,combination)dependentuponwhatcontent,quality,depictedrequiredprinting,mostprocessingensure Audio/VideoAnalysisDivisionVideo/ImageEnhancementFAVUBy:SectionSupervisorDate:January11,2016When media.ratio(widthheight)image.derivativesnumber,uniqueidentifieranalyst’senteredtrackedcustodySWGITPracticesForensicVersionS