9: How to Recover Digital Media Evidence

9: How to Recover Digital Media EvidenceI’d like to discuss evidence recovery, specifically digital media evidence recovery.  Having a forensic expert retrieve the evidence maintains the quality of the evidence and can help ensure that the original evidence stays intact on the original system so it can later be retrieved by other parties.  This is why it is extremely important that only a trained expert retrieve the evidence.  In this episode, I will cover proper procedures for evidence retrieval, proper handling of the evidence and what precautions one should take when retrieving digital media evidence from a recording system.

Steps for Proper Evidence Retrieval

1. Research before retrieving the evidence.  The forensic expert should learn everything they can about the recording system beforehand.  Connecting with the manufacturer, reading the manual and researching further online all benefit the expert.  This will make analyzing and operating the system onsite easier for the expert and optimize the retrieval process.

2. Obtain any necessary software, proprietary player or codec. If the system records proprietary or encoded files, the expert should obtain the player or codec beforehand.  If that is not possible, the expert should be prepared to install the necessary player or codec onsite from either the recording system or client.  More often than not, modern digital surveillance systems require a special codec or proprietary player and without this installed, the forensic expert will not be able to access the digital media evidence.

3. Record the evidence retrieval process. The forensic expert should record both audio and video of the evidence retrieval to include in the chain of custody and forensic report.  When I am recovering evidence from a digital recording system, I always have a VIEVU body camera on my person, as well as a digital audio recorder in my pocket.  Along with authenticating the evidence, this can serve as the expert’s notes later on in the investigation in case they need to refer to something that was discussed during the evidence retrieval.

4. Photograph and inspect the digital recording system. The forensic expert should include photographs of the unit in their report and take careful notes on anything they notice about the unit.  This could include damage, tampering or any other abnormalities they notice on the recorder.  Along with the video recording, it is usually beneficial for the expert to photograph anything they note during the process.

5. Follow the manual for the highest quality retrieval. The expert should have the manual with them when retrieving the evidence to make sure that any copy or export is in the highest quality format and does not affect the original recorded file.
photo credit: iLike iRiver via photopin (license)

Tags: , ,

Comments are closed.

Client Reviews
As a business owner myself, I am aware of the effort it takes to assemble a team of employees that conduct their business as if it were their own, and take pride in how they represent your company to others. As an owner who feels has achieved that status myself, I immediately recognize it in others. I must say that this is not common in the workforce today. From the first contact with your company, through closeout, every one of your employees made this experience a pleasure and acted with the upmost professionalism.read more
Abc Def
20:32 03 Dec 18
Primeau Forensics is a professional, top-flight organization that knows how to access and deliver verifiable forensics information quickly, efficiently and productively. Don't let their cheerful, friendly attitude make you think they are not on top of their game--they are!read more
dan schulte
18:35 12 Dec 18
I received credentials from two technicians, then a third person ended up doing all the work and kept in touch with me by e-mail. I never saw any proof that the work was done and they told me they found nothing. They could not tell me what was making the noise or the lights. A waste of $750.00.read more
Teresa Galyon
16:13 13 Dec 18
Excellent work. Primeau took a low light camera recording of vandalism at my home and converted the video to images that we used to identity the vandals. Additionally, Primeau was able to identify characteristics of the vandals car that were used for a positive identification. Services were efficient, timely, and professionalread more
Todd Conte
15:18 27 Aug 18
Ed and his team are great! I took in footage of my boyfriends dog being stolen and they were so willing to take every step possible to enhance the video to retrieve the information we needed. The resolution on our camera/video wasn't great (our fault, not theirs) and they were unable to get the information we needed BUT they guided me in the next steps to take. Thank you guys!!read more
Anita Tela
12:47 23 Oct 17
Places We’ve Worked
Learn About Us!