DVR/NVR and Surveillance System Forensics

A DVR commonly accepts analogue camera feeds and performs digital encoding. An NVR receives already digital streams from network cameras. Hybrid devices combine input types; a model name or connector alone may not establish the entire recording architecture.

IP camera control, discovery and streaming use different protocols and profiles. ONVIF is not a universal video transport label. Power may come from PoE, separate supplies or other arrangements; document actual connections and any switches that keep cameras operating.

Cloud connectivity can provide remote viewing without cloud recording. A subscription, configuration, network condition and retention plan determine whether footage is stored remotely. Local storage can be the primary copy, an edge copy or a cache.

Inventory the recorder, cameras, removable cards, storage arrays, linked accounts and mobile applications. Establish channels, recording schedules, enabled audio, retention and supported export options.

Use appropriate authority for each source. Legal access and disclosure requirements vary by jurisdiction, and a provider request does not guarantee historical content exists. Avoid assuming that a local sales office controls all remotely stored recordings.

Recorders can use proprietary structures, conventional filesystems, databases, encryption or combinations. A familiar partition does not mean generic desktop tools understand the video index. Retain filesystem and device metadata needed for the supported interpretation.

Multiple disks may be independent, concatenated, striped, mirrored or parity-protected. Record disk order, channels and configuration before removal. A RAID label does not guarantee every member is healthy, current or independently readable.

Circular recording can reuse older storage, while motion/event rules, quotas and manual protection can change retention. Segment size and overwrite order are implementation-dependent, not universally fixed.

For a simplified constant-bitrate estimate using decimal units, retention days ≈ usable capacity in GB / (camera count × Mbps per camera × 10.8). With 4,000 GB, 16 cameras and 4 Mbps each, the estimate is about 5.8 days before overhead and other effects.

Under those same assumptions, doubling capacity doubles retention, quadrupling capacity quadruples it, and halving bitrate doubles it. Real variable bitrates, audio, redundancy and recording schedules require an actual measurement or appropriate model.

An empty index or missing playback segment does not alone prove physical erasure. A compatible recovery method may locate retained content, but overwritten or inaccessible encrypted data can remain unrecoverable. Record what the acquisition and tool actually cover.

A codec describes compression; a container organises encoded media and associated information. H.264/AVC and H.265/HEVC streams can appear in different containers, while the same filename extension can hide different implementations.

Intra-coded pictures and predictive pictures have different dependencies, but a simple I/P/B diagram is only a teaching model. Parameter sets and reference structure matter; an isolated I-picture is not guaranteed to decode correctly or represent a random-access point.

With the required stream context, properly decoded predictive frames can be useful evidence. Selecting only I-frames can omit a critical moment. Choose frames for the evidential question and document the decoder, frame reference and any processing.

Frame rate, variable timing, dropped frames and display reordering affect temporal interpretation. A player’s displayed time may differ from a burned-in overlay, container timestamp or vendor metadata. Record the source of each.

Native exports can include proprietary metadata or a player needed for interpretation. Keep these alongside the recording. Create viewing copies separately, and do not infer an exact clock, camera position or authenticity merely from a visible date overlay.

Assess overwrite risk, device state, encryption and access before deciding whether to export, image storage, isolate a network or shut down. Removing power can lose access or damage state; continued operation can also change evidence. Record the chosen method and reason.

Document the device, cabling, active views, channel mapping, configuration and reference time. A front-panel LED is an indicator under that model’s design, not conclusive proof that a particular camera was successfully recording.

Obtain a native export of a suitably broad relevant window when available and authorised. Preserve the player, metadata and settings needed to reproduce it. Exporting can change logs or state, so document interactions; screen recording is a fallback with additional limitations.

Where storage acquisition is appropriate, identify and label each medium and use validated write protection where supported. Preserve acquisition format, hashes, errors and array context. Do not allow a desktop OS to initialise or repair an unfamiliar evidence disk.

Collect accessible camera cards, cloud recordings and supporting logs where relevant. A local export and a physical image answer different questions; neither is mandatory or sufficient for every system. Specialist support may be needed for encrypted or unsupported layouts.

Use format-compatible tools and verify support for the recorder and firmware. Magnet Witness is one current video acquisition/analysis product; older DVR Examiner workflows and other tools must be checked against their actual support. Product naming is not evidence of complete coverage.

FFprobe can inspect supported stream and container properties, and FFmpeg can create documented viewing copies or stills. Preserve the native input, command, version and processing log. Validate output timing and any warnings.

Stream copying avoids codec re-encoding but remuxing can change framing, metadata or timestamps. It does not guarantee that the output container or entire encoded representation has the same hash. Hash the native source and each derivative separately.

A simultaneous comparison with a reliable time reference measures offset at that observation. It does not by itself measure a historical drift rate. Timezone settings, daylight-saving changes, clock resets, NTP adjustments and outages can break a simple constant-offset model.

Hypothetical calculation: if the recorder is demonstrably three minutes slow for the relevant event interval, add three minutes to its displayed time to obtain the reference time. State the evidence supporting that interval and any uncertainty. Do not extrapolate a generic monthly drift backwards as if measured.

Use independent event anchors and configuration/history where available. When historical correction cannot be established, report the recorder time and supported uncertainty rather than create a falsely precise global timeline.

Integrity assessment includes provenance, continuity, complete acquisition records and validation of processing. A matching hash demonstrates agreement between compared byte sequences; it does not prove the original scene, completeness or accuracy of the recorder clock.

Keep original/native recordings, exports, viewing copies and stills distinct. Record their relationships and separate hashes. Document any decoding, scaling, colour adjustment, frame selection, enhancement or re-encoding.

Legal requirements for collection, authentication, privacy and presentation vary by jurisdiction. Use the applicable framework and competent review. Neither a certificate nor a successful playback removes every challenge to authenticity, completeness or interpretation.

Missing footage can arise from motion scheduling, overwrite, loss of power, camera faults, network interruption, export selection or deletion. Assess configuration, logs and storage together; missing data alone does not distinguish these causes.

Encrypted storage may require the recorder or supported credentials. Preserve relevant access and configuration without presuming that removing the disk yields usable plaintext.

Explain channel coverage, blind spots, frame timing and quality limitations. A visible person or object may not be identifiable at the available resolution, and enhancement cannot create missing source detail.

The final exhibit package should let another competent reviewer trace a finding to its native source and reproduce the relevant processing. State missing periods and unsupported formats explicitly.