Security cameras are everywhere. They capture video at ATM machines and banks, retail outlets, parking garages, transportation centers, entertainment venues, government buildings, educational institutions, and corporate facilities. Large cities like Chicago, New York, Baltimore, and Cincinnati have also installed surveillance cameras on the streets of their high crime areas.

With the growth of the security industry and the proliferation of cameras in our society, it is no wonder that video evidence has become an integral component in many criminal investigations. Video is an impartial witness recording only what it sees without bias. Video evidence has played prominent roles in high-profile cases such as the London subway bombing in 2005, the kidnapping of Carlie Brucia in Sarasota, Fla., the R. Kelly child pornography case, the Columbine school shooting, the "Internet girl fight," the Wal-Mart child abuse incident, and the 9/11 attacks.

Forensic Video Analysis

Due to this influx of video evidence, law enforcement has seen a need for personnel specifically trained and equipment specifically designed for forensic video analysis.

Forensic video analysis (FVA) is defined by the Law Enforcement and Emergency Services Video Association (LEVA) as the scientific examination, comparison, and/or evaluation of video in legal matters. Video evidence is not limited to surveillance footage, although that tends to be the most prevalent. Video evidence can also be home videos, cell phone and camera videos, and videotaped interviews.

A video analyst can examine any media containing video footage including analog sources like VHS and 8mm tapes and digital sources like CDs, DVD, digital tapes, and computer hard drives. Forensic video analysis encompasses simple techniques such as capturing still images to much more complicated examinations involving photographic comparisons, light and color analysis, and photogrammetry (using photos to make accurate measurements). A forensic video analyst may also be asked to evaluate video footage and determine if it is an original or a copy (analog videotapes) or if it has been edited. But before any examination commences, the evidence must be located.

Bearing Witness

The most common type of video evidence seized is that of the actual crime being committed. The video can be reviewed and the actions of the suspect can aid crime scene personnel in processing the scene by indicating where he walked or what he touched.

But video evidence is not limited to just the surveillance footage of the incident itself. By looking beyond the scene of the crime, valuable video evidence may be recovered. Consider the following scenarios where the actual crime was not captured, but valuable video was recovered assisting the investigation:

• A stolen vehicle was recovered and it was discovered that it was used in a homicide. Neither the auto theft nor the homicide was caught on tape. The vehicle was searched and processed. In the vehicle, there was a receipt from a convenience store with a date and time printed on it that indicated the perpetrator visited the store after the vehicle was stolen. Using that receipt, investigators went to the store and collected the surveillance video footage corresponding to the receipt date and time information. A suspect or involved party was shown on the video providing a valuable lead.

• Two suspects were caught on tape filling up gas cans at a pump near the scene of an arson. The gas cans were left on scene. The gas cans were collected and compared to the images of the gas cans on the gas station video. The gas cans from the scene shared several class characteristics such as size, color, shape, and label placement with those in the gas station video. Photos of the two subjects were captured from the video and distributed. The subjects were identified and eventually charged with arson.

• A retail store was robbed, but its surveillance system was not operational. As the suspect fled the scene, he was caught on the camera of an adjacent business.

Clarifying the Video

Once the video evidence is obtained, it is reviewed to determine its value and how it should be processed. In order for the video to have any value, the analyst or investigator must be able to view the video. That's easier said than done sometimes.

Surveillance video, specifically analog (VHS), is typically recorded in the following formats: time-lapse, split/quad-screen, or multiplex (multiple cameras recording to one source so when viewed, a series of rapidly flashing images is seen). Using FVA tools and training, a video displaying 16 rotating cameras can be separated so that each camera can be watched individually, a time-lapsed video can be slowed to real-time for easier viewing, and a quad-screen format can be enlarged. If the incident was captured on multiple cameras, the analyst can piece together all the available video information to create a fluent timeline of events as the suspect or vehicle moves from one camera to the next.

Now that the video can be viewed, more obstacles are often encountered on the road to clarifying it. It would be ideal if every video received were a single camera recording in real-time with the clarity of HD, but that is not the reality. Typical video evidence is grainy, pixilated, blurry, dark or washed out, shaky, or damaged.

Fortunately, there are several techniques that can be applied to obtain the best possible images.

FVA utilizes traditional techniques to clarify the video and render it easier to view such as brightening and contrast, noise reduction, deblurring, speed adjustment, color correction, resizing, and spotlights.

For example, with image stabilization technology available in forensic video processing applications, a shaky recording by a handheld camcorder or an in-car camera in a moving patrol car can be stabilized. Another frequently used technique is frame averaging. By averaging multiple video frames, frame averaging can pull details out of dark video frames as well as eliminate some of the signal noise seen in grainy images.

Utilizing these tools does not alter the content of the video. The tools simply make the details easier to see, similar to turning on a light in a dark room. These traditional clarification tools are frequently applied in conjunction with other techniques used by a video analyst in more complicated examinations of video evidence.

In the previously mentioned arson scenario, an analyst can perform photographic comparisons. Articles of clothing, tattoos, and jewelry are all valuable identifiers. Even the headlight spread pattern of a vehicle, suspect hairlines, and the gait and mannerisms of the suspects may have the potential of being unique.

In the O.J. Simpson case, O.J. claimed that he never owned a pair of Bruno Magli shoes, but he was caught on film walking across a football field two years before the homicide wearing…Bruno Magli shoes, size 12. If a suspect is caught on video and discards the clothing he or she was wearing, it is possible that photos exist of the suspect wearing a shirt, a hat, or other article of clothing that is the same article of clothing worn in the video during the crime.

Clothing can be a great identifier because it can have unique stains, tears, and patterns. Where the pattern meets the seams, edges, or zippers of an article of clothing can also be individual to each item of clothing, depending on how the manufacturer cut and sewed the clothing.

Consider this scenario: A suspect jumps over the counter during a bank robbery. He is wearing a mask but his shoes are captured clearly. The images of the shoes are clarified. Through investigative efforts, a suspect is developed and a description of the shoes is included in the search warrant. The shoes are discovered and collected. They are compared to the images in the video. A positive identification is made based on unique markings that are visible on the shoes in the video and the suspect's shoes.

To further aid in proving that the suspect was actually the person wearing the shoes at the time of the robbery another technique can be employed, photogrammetry. Photogrammetry is defined as mathematically based scientific principles used to extract dimensional information from images such as the height of subjects depicted in surveillance images and accident scene reconstruction. In other words, an analyst can use photogrammetry to determine the size of a suspect's foot just from an image. This technique has also provided useful information on obtaining and comparing the size of objects in a video such as the barrel of a shotgun, the length of a knife, or the size of a tattoo.

Breaking It Down

A video can and should be examined frame by frame, or in the case of analog tapes, field by field.

In analog recordings, 60 fields per second are recorded and interlaced into a 30-frame-per-second video. Each frame is made of two fields—an even and an odd field.

Without examining an analog video at the field level, information can be missed because only half of the information is being examined. An analyst can slowly step through a video field by field and determine subtle movements of people or objects as well as changes in light or luminance values. This is primarily valuable for reconstruction.

In an officer-involved shooting, for example, being able to examine video at the field level may show slight movements or expressions of the parties involved that would have been overlooked if the video could only be examined in real-time. A timeline of events of a car arriving and departing—but the car is not captured on the video—can be established by examining the change in light values. A change in brightness is observed on the video when the car's headlights are on and when they are off.

Perhaps when examining a video a shadow is observed passing in front of a window indicating that there was another party present during the crime.

In a casino shooting case, the muzzle flash of a firearm was recorded as a quick burst of light on a reflective surface existing in only one field of video. This enabled the determination of the exact time the gun went off. Because of the camera angles, the actual assault was not captured on video and knowing when the gun was fired was important to the chain of events. If the video had not been examined at field level, the information would have been missed.

The Technology

There are several forensic video analysis tools on the market today. There are applications that fit different budgets and different levels of sophistication. Within the FVA toolbox, there should be imaging software such as Adobe Photoshop to work with still images. A digital media capture program is also helpful when working with proprietary digital formats. These programs such as dCoder from Ocean Systems, Snagit, and VirtualDub allow the user to capture the video in its original form and convert it to a universal file format that can be viewed on more accessible video players like Windows Media Player, Real Player, and QuickTime. Once the video is in a universal file format, there are more tools available to work with the images.

Forensically speaking, the single most important feature that a forensic video analysis system should have is the ability to accurately convert analog video uncompressed into a digital format to ensure that no loss of information occurs.

By working in the digital world, you are essentially working on the video in a non-destructive environment. The video will not be damaged by repeated pauses, plays, and rewinds, thus ensuring its integrity. Non-linear digital editing systems have been widely used for this purpose. The increase in digital security systems has eliminated the need to convert an analog video to digital, but a non-linear editing system is still beneficial for examining digital video. Other features to consider in a forensic video analysis system include:

• De-multiplexing capabilities to separate multiple cameras recording to the same source

• Frame averaging to analyze a series of video frames to achieve a better image

• Ability to separate video frames into fields if applicable

• Image stabilization

• Magnification functions

• Spotlight/blur functions

• History function that tracks tools settings and each step taken in the analysis

The history function is very important in the scientific world of reproducibility. By recording each step taken, it ensures that at any time, the same procedures can be applied to the original video and the outcome remains the same, therefore adding to the integrity of the analysis.

Experienced Eyes

Along with the proper equipment, a trained forensic video analyst is beneficial. The analyst understands the fundamentals of both analog and digital video and the equipment used to perform the analysis. He or she can ensure that the procedures used to conduct a video examination are in compliance with accepted scientific methods and the legal standards on the admissibility of video evidence.

A valuable resource for training in the field of forensic video analysis is the Law Enforcement and Emergency Services Video Association (www.leva.org). In partnership with the University of Indianapolis, LEVA has installed a multimedia lab containing video analysis workstations specifically designed for training forensic video analysts.

Technology continues to advance. There are cameras that can detect gunshots and alert the police. There are facial recognition features, height estimation features, and object tracking features in current camera systems. The future appears to be headed toward the technology dubbed "intelligent video," where new camera features can be used to find unattended bags at an airport or detect suspicious behavior and zoom in on the perpetrators. Unfortunately, these are not the most prevalent videos collected as evidence from the neighborhood convenience store.

As the technology improves, it is critical that law enforcement continue to maintain high levels of training to keep up. There is still no magical CSI button that will instantly clarify a distorted and grainy image or render a license plate readable from long distances. But there are valuable tools, personnel, and resources available to law enforcement that can aid in getting the most out of video evidence.

Shelli Friesen is a criminalist with the Boulder (Colo.) Police Department. She has eight years of experience as a LEVA-certified forensic video analyst.