For recordings, both the image and information about its provenance matter. Before anyone cuts out a short excerpt or sends the video through a messaging app, it is worth establishing where the source recording is held, who can preserve it and which period is relevant. Preparing the material well makes it easier later to distinguish what is actually visible from assumptions based on an incomplete excerpt.

Establish recording availability as soon as possible

Do not assume that the presence of a drive or card means all videos have been permanently preserved. For example, the Garmin Dash Cam Live manual describes overwriting the oldest unprotected recordings when the card is full and, with a particular setting, deleting unsaved videos after shutdown. This is an example of a specific device, not instructions for every camera. The approach must reflect the model and settings. [1]

If the recording is held by a CCTV administrator, contact them as soon as possible and specify the location, date and approximate time of the incident precisely. Ask whether the relevant material can be preserved. Do not operate someone else's recorder yourself. For a dashcam, take any action only after bringing the vehicle to a safe stop.

Ask for material in its source form

SWGDE guidelines recommend acquiring material in the native format used by the recorder, together with any software needed for playback. An ordinary video file may serve as an additional copy for convenient viewing. However, it should not automatically replace the source export. After export, check that it covers the correct cameras and time period and plays back properly. [2]

Ask for the original export and the manufacturer's player, if required. Preserve the folder structure and accompanying files. If you have only a phone recording of a screen, describe that fact and indicate where earlier material may be held. Such a copy can help establish what to look for, but should not be presented as a file obtained directly from the camera.

Preserve context and time information

Do not limit your request to a single selected second. Agree on a segment covering the time before and after the incident as well as other relevant cameras. SWGDE identifies the need to compare the recorder's time with a reference time and document the difference without changing the device's clock. A visible timestamp therefore requires verification; the text on the image alone does not establish the actual time. [2]

In your enquiry, you can give two times separately: the event time to the best of your knowledge and the time visible on the available video. Add the source of each. If you only have an estimate, say so explicitly. This helps avoid a false impression of precision when recordings are being selected.

Separate preserved material from viewing copies

Recompression and image processing can change an image's properties and metadata. SWGDE recommends preserving the original material and performing transformations on copies. A sharpened, slowed or cropped video should be described as a processed version, identifying its source file where possible. [3]

NIST emphasises the importance of documenting file origins and how files were acquired and transferred. Hash values help check later whether a particular file has changed, but do not replace source information. Agree on how to transfer recordings and preserve the complete set received without editing it yourself. [4]

Attach a brief inventory of the material:

  • the location and device type, if known;
  • camera identifiers and the date and time range;
  • the person or entity from whom the files were received;
  • the date of receipt and a description of the export method, if available;
  • known time differences and earlier transformations;
  • the questions the analysis is intended to answer.

Hypothetical example

A vehicle owner receives a twenty-second video showing contact between two cars. They want to establish which direction the other vehicle came from and whether it stopped beforehand. The clip alone may not show those circumstances. A useful next step is to identify the missing time period and other cameras for the administrator, rather than repeatedly enlarging the same shot. Only the scope and quality of the preserved material will determine the limits of the findings that can be made.

Sources

Primary documents; accessed: 23 October 2026.

Digital forensics—scope of examinations →