Testing of Security Recording Equipment

Approximately two years ago I authored a paper entitled, “The Forensic Examination of Video Recordings” which discussed some of the more conventional forensic techniques for examining questioned videotapes regarding their originality and possible evidence of tape alteration. This paper specifically addressed the various mechanical and electrical signal anomalies that occur when editing of a videotape is present or if different VCR recorders had been used in the production of a composite videotape. The videotapes examined included conventional two-hour VHS which were continuously recorded on the original VCR. The instruments utilized in the examination of these continuously recorded two-hour videotapes included an oscilloscope, a waveform monitor, crosspulse monitor, spectrum analyzer, and other analytical equipment. Whenever editing/tampering did occur on a evidential videotape, invariably the above listed equipment was successful in identifying various timing differences that produced both visible and audible variations in the horizontal, vertical, and color synchronization pulses which makeup the video waveform. Portions of the audio signal are also often adversely affected because of the editing process.

Forensic Analysis of CCTV Surveillance Videotapes

Security VCR’s have a number of addition features specifically designed for the industrial marketplace or for those institutions that require 24 hours a day video\audio surveillance. Some of the primary differences between a two-hour domestic VCR and a time-lapse VCR for the security industry include; TL VCR’s can record up to 960 hours on a 120-minute tape; they can further record either continuously or in time-lapse modes between 6 and 960 hours; a conventional VCR records continuously in real-time with 25 frames per second while a time-lapse recorder has selectable recording intervals depending upon the amount of elapsed time recorded by the VCR; the recordings in time-lapse mode are periodic rather than continuous and there will always be a certain amount of information loss during the discontinuous recording process; time-lapse VCR’s can also be trigged by external alarms which will cause the recording unit to switch from time-lapse mode into real-time for a preset duration or until the alarm is cleared; the time-lapse recorders also can be programmed to recycle and rerecord which is extremely useful when there is no operator to replace the 24-hour tape. It is also important to remember that time-lapse recorders do provide 2, 6, and 24 hour videotape recording but the original tape has to be played back in the same or similar time-lapse recorder set at these particular recording speeds to permit review of audio information. Although sometimes the audio signal is weak and has poor intelligibility, there is a host of audio enhancement software and other audio filters that can improve the audio signal intelligibility even if recorded in 12 or 24-hour time-lapse mode.

It is common in many industrial sites to require multiple camera and monitor viewing during the playback process. A simple analog video switcher can accommodate several different camera inputs and by selectively pushing buttons on the monitor can activate
particular fields of view. The next form of video switcher is known as a QUAD which allows a simultaneous display of four cameras onto a single monitor by splitting each view into quarter size samples. QUAD’s are capable of viewing single or multiple cameras in a sequence or can individually provide for a single view. The resolution unfortunately for QUAD processors is normally marginal and the recorded image does degrade further with the copying process. A recent innovation by the security industry is the development of a multiplexer which can display typically from 4 to 32 camera images into a single monitor. Multiplexing of the cameras result in their output being recorded in sequence onto single videotape. The recorded images are captured in full screen thus insuring good resolution. The rate at which they are recorded can vary depending upon the initial setup of the time-lapse recorder and the multiplexers ability to process the information. The disadvantages of multiplexers are that recording of each camera is not continuous and when played back the system decodes whatever is on the tape. The multiplexer further encodes the time date and camera number in the vertical blanking interval of the video waveform following each recorded field. If you attempt to playback the tapes without a multiplexer the decoding process does not occur and you see exactly what was recorded on the tape which is normally observed as an extremely rapid rate of change of the different camera fields.

The forensic examination of time-lapse recordings invariably require that attempts be made to obtain the original videotape as any tape copy would necessarily bear some of the electronic and mechanical signatures of the copy VCR and not that of the original recorder. It is within the vertical blanking interval of the video waveform that a waveform monitor or oscilloscope can view important data information that is stored by the time-lapse VCR during the recording process. It normally consists of 32 blank lines and it gives the recorder an opportunity to store important information about camera, date and time recording, store information, etc. for each line of video that has been recorded. Often times a monitor that has under-scan capability can visualize the vertical blanking interval and some of the data produced during the time-lapse recording process.

Although the majority of time-lapse recorders and corresponding videotapes are of the analog variety, there is an increasing demand for both digital video recorders and related equipment which would require different forensic examination techniques. One of the primary advantages of digital recording is it is more immune from electronic and other forms of interfering noises. A digital signal as an electronic waveform is comprised of the numeric values of zeros and ones. This results in less signal degradation and a better picture quality for the surveillance industry. The signal can also be digital processed and stored and this would aid in such factors as image enhancement, compression and other forms of correction. Lastly, there is no degradation between the originally recorded video signal and the copy tape.

Other signals that can be analyzed during the testing of time-lapse tapes include the audio signal which is recorded normally along one edge of a conventional VHS tape as either a single or stereo channel. Often times a separate erase head is mounted next to the audio head to facilitate a dubbing of a new audio signal onto the original videotape. In addition there is a control track which normally is a 30-hertz square wave signal which synchronizes the video frames on the tape with the monitor during playback. Full track-erase heads are normally seen on the video drum and is available for erasing any prerecorded material on the tape including audio\video or control track information.

Trends in the CCTV Industry

There has been a notable shift in the last five years from the use of black and white surveillance cameras to color equipment and likewise there has been a dramatic change in both size and low light capabilities of CCTV cameras. Correspondingly there has also been a dramatic drop in the prices of CCTV cameras and time-lapse recorders and a surveillance system today costs significantly less then it did several years earlier. There has been increasing change in digital video recording equipment which is transmitted not only over local/wide area networks but also the Internet. At Sanyo Security Products in California the latest digital recording device (DSR-C100) includes a hard drive which allows continues recording of 17,000 high quality digital images on an internal 10.2 GB hard drive. The surveillance cameras connect directly to a PC and can record on compact flash cards for transportation and backup. During playback the operator can choose a zoom capability of up to 21 times normal enlargement and a “water marking” capability further ensures that digital editing does not occur.

Common Questions Concerning Forensic Imaging

What is Forensic Video Image Analysis?
Forensic video image analysis is the relationship between video image processing, law enforcement, industrial security and the courts. It is a relatively new scientific tool for enhancement and identification of individuals and situations in recorded video crime scenes.
VCR tapes suffer noise, low light level environments, motion blur, and time base synchronization problems. Perpetrators are too small for identification and four camera scenes are compressed to a single frame, quad format. All these situations have been successfully resolved by forensic image processing techniques.
Low light level can be brightened. Small size regions containing the perpetrator can be magnified times two and times four with optical like clarity. Motion blur and time base distortions can be removed. Quad camera images in a single frame can be magnified to full camera views. Fields can be enlarged to frames. The same technique can remove perpetrator motion blur. License plate alphanumerics can be magnified and enhanced for legibility.
Are results from this type of analysis accepted by law enforcement and in a court of law?
Yes, there have been many cases where investigators have obtained positive identifications and arrests. Convictions have been obtained using this technology and public defenders have made practical use of this technology for their clients.
There are several court decisions that have allowed forensic video image enhancement into evidence.

What process does a tape go through when it enters FTA?
First, the tape is logged in by the office manager and all sides of the tape are scanned and put into the file so there is a record of the condition in which we received the tape. We check to make sure that the tape is write-protected and a copy is made as a back up.
The technician does an initial overview of the tape to make sure that instructions from the client are clear and that the scene or object to be enhanced is located and clearly understood. The length of the tape, record mode, time code, head switch, and cross pulse information are all noted in cases where authentication is an issue. Additional information concerning videotape authentication procedures can be found at www.forensictapeanalysisinc.com or e-mail info@tapeexpert.com