The scene is on tape. The parking lot camera caught the collision, the register camera recorded the argument, the entrance camera filmed who came in. To the layperson, the case is over: it is all on the footage. To the forensic examiner, the case has just begun, because between the footage that exists and the evidence that sustains a judicial decision there are three questions requiring a technical answer: is this file intact? What does it really show? And what does it allow one to conclude without exceeding the limit the resolution authorizes?
Integrity comes before content
Security video is born inside a recorder, almost always in the manufacturer's proprietary format, and becomes evidence after export. Each of those steps can be questioned: did the export recompress the material? Was there a cut? Is the presented excerpt continuous, or did it skip exactly the seconds that were inconvenient? The authenticity examination answers by studying the file's structure, the continuity of the frames, the traces of reprocessing, and the coherence between the presented format and the equipment that supposedly generated it. Ideal collection preserves the DVR or the native files with hash values and chain of custody; the loose clip sent through a messaging app, recompressed and without demonstrable origin, is the screenshot of the video world.
There is one detail that topples cases with disproportionate frequency: the clock. Security recorders live with wrong dates and times, some still applying a daylight saving time long since abolished in Brazil, no synchronization. The on-screen timestamp is not a fact; it is a claim made by the equipment, and the examination confronts that stamp with external references before any conclusion that depends on "when". An entire alibi can live in a DVR's minutes of lag.
Photogrammetry: measuring what the scene shows
When the question is "how tall is this person?", "did the vehicle fit in that space?", "how far apart were they?", forensic photogrammetry comes in: the extraction of real measurements from the image, using known references in the scene, the camera's geometry, and correction of lens distortion. With method, the image becomes a measuring instrument, with a declared margin of error. It is the technique that allows comparing a suspect's height with the investigated person's, verifying a vehicle's compatibility with the collision spot, or reconstructing positions in an accident.
"Zoom does not create pixels. What the camera did not capture, no honest software invents afterward. When enhancement crosses that frontier, the report has stopped examining and started imagining."
Serious measurement declares its premises: which scene references were used, the uncertainty of each, and how the final margin was calculated. Photogrammetry without a declared margin of error is not measurement; it is a guess holding a ruler.
The limit of identification
The gravest error in this field has a precise address: the categorical conclusion of identity over footage that cannot sustain it. A face at twenty meters, recorded by a modest camera, compressed by the recorder, occupies a few dozen pixels. To state with certainty over that material "it is the defendant" is not forensic work, it is conviction dressed as a report, and a technically assisted defense dismantles the assertion by demonstrating how many different faces would fit in those same pixels. The serious examination works by compatibility: anthropometric characteristics, marks, clothing, gait, weighed and declared with the degree of support the footage offers. The same asymmetry as with the voice applies here: exclusion can be categorical; positive identification has degrees, never dogma.
Image processing has the same status. Adjusting brightness, contrast, and sharpness to reveal what is recorded is legitimate and documentable. "Improving" the image until something appears that was not there is fabrication. The report declares each operation applied, on a working copy, with the original preserved, so the opposing party can retrace the path and arrive at the same frame.
The video that arrives through the messaging app
A growing share of cases does not involve the DVR, but what is left of it: the thirty-second clip that someone exported, sent through the messaging app, and that passed through three recompressions before reaching the record. Worse: the re-recording, the phone pointed at the monitor, which degrades the image and eliminates any useful metadata. These materials are not automatically worthless, but their evidentiary value belongs to another category, and the examination says so frankly: they serve to guide, rarely to sustain an identity conclusion on their own. When the video matters, the correct measure is to seek out the source equipment while the recording still exists, and to confront the received clip with the native file. The era of AI-fabricated videos only reinforces the yardstick: the farther from the source, the less faith the footage deserves, and the greater the technical work needed to restore it to the status of evidence.
What to preserve when the camera recorded something important
- The equipment or the original disk, before circular recording overwrites the period (days, sometimes hours);
- The export in the recorder's native files, never just a video re-filmed from the screen;
- A record of the state of the equipment's clock at the time of collection;
- The chain of custody of who collected it, when, and how;
- The scene data that will serve as measurement references, if a photogrammetry question arises.
The camera is a witness that never blinks, but it testifies only within its limits: resolution, angle, compression, clock. The forensic task is to make that witness say everything it knows, and nothing beyond it. The video that convinces the audience and the video that withstands adversarial scrutiny are separated by a single thing: the examination that measured, authenticated, and had the honesty to declare where the image stops answering.
