There has been a thread on several of the forums about moving the date/time stamp onto a copy of video footage - and some clever solutions have been provided. The responses were all right on the money - only issue I have is that no one advocated rigorous testing (and documenting) before using the method on live data. You need to be able to articulate what happens to the data as it is transformed.
When I used to work for that agency that doesn't exist, we had two rules:
- "If you didn't see it, it isn't true."
- "If you didn't write it down, it never happened."
I come from the computer forensic side of the aisle. A very large part of the forensic process is validating your tools - if YOU haven't tested it then you don't KNOW that it works. I would expand this to any tradecraft or methods that you develop in the course of your investigations. In the situation above, have you checked to see that the times are correctly copied?
You all should know that, if the evidence can't be refuted - the opposition will attack you and your methods. Imagine the situation where you are testifying - with supporting video footage - and opposing counsel, having done their homework, starts asking you about the video, itself:
1. "Is this is the original footage?" (No, this is a copy)
2. "Is this digital or analog (with explanations to anyone that might need it) (Digital)
3. "How did you get the dates and times transferred? (with review of the issue)" (I used ________, which will transfer the dates and times."
4. "Did you test this method and confirm the results prior to using it on my client's video footage?" (Well...no - I DID check to see if it would work...)
5. "...but you did not test to see if the dates and times were correctly transferred to the copy..." (NO)
"...so, isn't it possible that the software (or method) changed the dates and times so that it only appears that my client was at that location at that date and time..."
Now - I have to say that such an exchange is unlikely - but as counsel becomes more technologically adroit there is a greater likelihood that it could. The history of computer forensics is filled with just such events. Why do you think that a forensic examiner no longer refers to an image of the suspect data as to a 'mirror image'?
Let's revisit Question 4, with a different ending:
4. "Did you test this method and confirm the results prior to using it on my client's video footage?" (Yes - on <test date> a series of tests were conducted where digital video footage from <some camera> was transferred using <your method>. In all cases, the dates and times displayed in the copy match, frame for frame, the dates and times in the original footage. Based on these tests, it is our belief that the dates and times displayed are an accurate copy of the original. The tests were documented in <your test report>, which I can provide if requested. )
5. "...no further questions..."
Taking this one step further, if the reference to your test documentation is included in your final report, the question about dates and times will likely never come up.
In closing, please give some thought to testing and documentation as a part of adopting new tradecraft.
LSG (nom de guerre)