Forensic Audio/Video Unit Training Manual Forensic Analysis Division

Transcription

1

2 Table of Contents 1. Overview Training Program Competency Practical Competency Exam Written Exam Remedial Training Certification Continuing Education Proficiency Mock Trial Limitations Modules... 6 Module 1 - Evidence Handling... 6 Module 2 - Media File Analysis... 7 Module 3 - Media Repair and Recovery... 8 Module 4 - Media Duplication-Format Conversion... 9 Module 5 - Forensic Audio Analysis Module 6 - Forensic Video/Image Enhancement Module 7 - DVR Extraction Module 8 - Scene Response Module 9 Legal and Testimony FAVU Uncontrolled When Printed Page 2 of 20

3 1. Overview The Forensic Audio/Video Unit (FAVU) strives to ensure that the Houston Forensic Science Center (HFSC) mission statement To receive, analyze and preserve physical and digital evidence while adhering to the highest standards of quality, objectivity and ethics is carried out on a daily basis. The FAVU is divided into two sub-disciplines; Forensic Audio Analysis and Forensic Video Analysis. Forensic Video Analysis, as defined by the Law Enforcement & Emergency Services Video Association (LEVA), is the scientific examination, comparison and/or evaluation of video evidence in legal matters. Forensic Audio Analysis, as defined by the Scientific Working Group for Digital Evidence (SWGDE), is the scientific examination, analysis, comparison, and/or evaluation of audio. The FAVU provides forensic audio and video analysis of crime related evidence. The FAVU s purpose is to serve the community by assisting in investigations and by presenting results of analysis in court. FAVU analysts may testify in local, state, and federal courts concerning the procedures followed to preserve, analyze, duplicate, enhance, repair, and produce results. This FAVU training manual is designed to introduce and/or refresh Forensic Video and Forensic Audio fundamentals and concepts to new hires. This manual also establishes a competency benchmark for the unit. This manual is broken up into modules with checklists of key knowledge benchmarks at the end of most modules. Once the checklist for the module has been completed and the trainer is satisfied with the trainee s progress during the module, a written and/or practical exam will be administered, when applicable Training Program As the trainee progresses toward independent casework, the training program will remain specific to the trainee s forensic sub-discipline. In situations involving newly-hired analysts who have already been performing casework for other laboratories or organizations, the newly-hired analyst s competency will be assessed and the training program modified accordingly. At a minimum, new analysts will complete a competency test prior to performing casework. In any training program, additional training tasks and mock casework may be included at the discretion of the trainer or supervisor. This training manual along with other materials generated during the training program shall be retained in a binder or electronically. All training checklists, authorization memos, and supervisor s signature with module completion dates will be documented Competency All analysts must successfully pass a comprehensive competency test. Competency testing can be conducted either at the end of the training program or in a modular format throughout the course of training. At any point when an analyst learns a new technique, process, and/or software to perform their duties, their competency in that area should be tested: These levels are driven by the requirements established in the forensic community for the specific tasks to be accomplished. FAVU Uncontrolled When Printed Page 3 of 20

4 This curriculum is designed to provide the skills and information necessary for the analyst to attain competency in audio and/or video analysis Practical Competency Exam The practical exam consists of conducting analysis on known evidence with a known outcome predetermined by the trainer. The trainee is required to correctly identify the relevant issue(s), select appropriate software and/or hardware tools to conduct the analysis, and produce an appropriately processed output result. The trainee will produce case notes and any other required documentation for the exam. A report will be issued by the trainee to the findings of the examination. All work must be conducted in compliance with current FAVU and HFSC Quality Manual policies and procedures. This only applies to modules with a practical exam Written Exam The written exam covers general principles of forensic audio or video analysis terms and definitions, technologies, standards, and hardware and software applications used in the processing of evidence. Both analog and digital topics will be covered to insure the trainee has acquired the necessary base knowledge needed to process all forms of evidence. A minimum score of 80% is required to pass the exam. This only applies to modules with written exams Remedial Training If a trainee fails to pass a written or practical exam then they will repeat the training module and have one opportunity to retake the test. If the trainee is still not successful, the supervisor, in conjunction with the deputy director and/or director, will determine the best course of action. The trainee may be required to take additional training courses prior to repeating modules or competency tests. If a trainee fails to pass a mock trial, the trainee may redo the mock trial up to two times. If the trainee is still not successful, the supervisor, in conjunction with the deputy director and/or director, will determine the best course of action Certification Certifications can be comprehensive or topic specific and can be an added tool in verifying analysts technical skills and abilities. Certifying bodies generally require training and a minimum amount of experience in the discipline in order to sit for an exam. LEVA and IAI certification of digital and multimedia evidence analysts in all sub-disciplines in which they conduct casework is encouraged. Maintaining certification may require retesting and meeting specific continuing education requirements Continuing Education Forensic education provides an analyst with the skills and knowledge of evolving technology in digital and multimedia forensics. Training in specific sub-disciplines and specialized areas may be dictated by the forensic discipline, accreditation status, and/or the requirements of the Houston Forensic Science Center. FAVU Uncontrolled When Printed Page 4 of 20

5 Continuing education should be obtained annually from training conferences, trade shows, professional organizational memberships, professional publications, current literature, or specialized courses. This training should address updates and the use of new technologies as it relates to: Hardware and equipment Software Techniques, procedures, and methods 1.8. Proficiency Once they are authorized to conduct casework, analysts must successfully pass an annual discipline-specific proficiency test. Proficiency testing is the continual evaluation of FAVU personnel in the performance of tasks relating to their discipline. If proficiency testing is not achieved, independent casework must cease until proficiency is demonstrated. Refer to the HFSC Quality Manual for information regarding proficiency tests Mock Trial Testimony is an important aspect of forensic science and is something that a Forensic Audio or Video Analyst may be requested to give. A mock trial shall be used to determine the trainee s ability to provide effective expert witness testimony. The mock trial should be completed prior to the analyst testifying in court or within a reasonable time frame determined by the unit supervisor Limitations It is widely acknowledged in the digital and multimedia forensic scientific communities that data storage and systems used to create, store, and manage data varies. Variables include types of hardware, software, versions, and sometimes alternate use of the equipment s original intent. Analysts should apply their education, training, skills, knowledge, ability, and experience to formulate a plan for examination Resources How Video Works, Weiss/Weynard CCTV- From Light to Pixels, Vlado Damjanovski Digital Video Compression, Peter Symes Photoshop CS3 for Forensic Professionals, George Reis, ISBN Principles of Digital Audio, Ken C. Pohlmann Modern Recording Techniques, Huber & Runstein The Audio Dictionary, Glenn D. White & Gary J. Louie SWGDE/SWGIT Spreadys.wordpress.com FAVU Uncontrolled When Printed Page 5 of 20

6 2. Modules Module 1 - Evidence Handling Recommended Reading: HFSC Evidence Handbook HFSC Quality Manual Definitions: TERM COPY DIGITAL EVIDENCE DIGITAL IMAGE DUPLICATE MEDIA MULTIMEDIA EVIDENCE DESCRIPTION an accurate reproduction of information information of probative value that is stored or transmitted in binary form an image that is represented by discrete numerical values organized in a two-dimensional array (when viewed on a monitor or paper, it appears like a photograph) an accurate and complete reproduction of all data objects independent of the physical media objects on which data can be stored analog or digital media including, but not limited to, film, tape, magnetic and optical media, and/or the information contained therein Training Objectives: The trainee will learn the ways items can be submitted to the FAVU. The trainee will learn how to create cases in LIMS and how to add items to already created cases. The trainee will learn the best practices for submission of evidence. The trainee will learn how to properly package and seal evidence. The trainee will complete the checklist in order to show competence in evidence handling. Module 1 Checklist: Evidence Handling Read and understands Evidence Handling SOP, HFSC Evidence Handbook, and HFSC Quality Manual Trainee s Trainer s Date Completed Knowledge of evidence handling practices and procedures Knowledge of FAVU submission form Knowledge of creating evidence/cases in LIMS Knowledge of Physical Inspection procedures Ability to communicate best practices for identifying and seizing media evidence for subsequent laboratory examination, evidence preservation, packaging, transport, and storage. FAVU Uncontrolled When Printed Page 6 of 20

7 Ability to determine whether a request is within the scope of an individual s or the laboratory s services. Ability to assess the risks to media evidence posed by processes from other forensic science disciplines. Ability to assess the risks to non-media evidence posed by forensic processes. Ability to determine an appropriate sequence of interdisciplinary forensic analyses, given the risks that exist. Knowledge of physical media formats and how to protect them from overwrite and environmental damage. Ability to safeguard recorded evidence (write protection and physical, magnetic, and environmental protection). Ability to properly pack, seal, and ship media exhibits without damaging the physical media or the recorded evidence. Ability to properly label media exhibits for identification without damaging evidence. Created new cases using LIMS (minimum of 2) Created new items to already existing cases (minimum of 2) Module 2 - Media File Analysis Recommended Reading: FAVU Media File Analysis SOP How Video Works, Weiss/Weynard Best Practices for Forensic Video Analysis, SWGIT Recommended Training Courses: LEVA Level 1: Forensic Video Analysis & the Law LEVA Level 2: Digital Multimedia Evidence Processing Definitions: TERM AUTHENTICATION VERIFICATION ANALOG VIDEO EVIDENCE COMPOSITE VIDEO SIGNAL S-VIDEO COMPRESSION DESCRIPTION the process of confirming that the data is a true and accurate representation of what it purports to be Information of probative value consisting of a representation of various brightness levels as different voltages in a series of images. Formats include but are not limited to: VHS, S-VHS, VHS-C, ¾, Betamax, Betacam, Hi8, 8 mm, Mini DV, as well as other analog /digital tape based video formats. an analog signal which contains chroma, video, blanking and sync information and has been combined using one of the coding standards NTSC, PAL, SECAM, etc. a signal in which the luminance and chrominance are separate the process of reducing the size of a data file FAVU Uncontrolled When Printed Page 7 of 20

8 CODEC (COMPRESSOR/ DECOMPRESSOR) FILE FORMAT PROPRIETARY FORMAT A device or program capable of encoding and decoding digital data. Codecs encode a stream or signal for transmission, storage or encryption and decode it for viewing. Codecs are necessary for playback of encoded data. Generally, codecs from DCCTV systems are proprietary. the structure by which data is organized in a file any file format that is unique to a specific manufacturer or product Training Objectives: The trainee will gain the skills required to effectively complete an analysis of digital and analog media in order to identify the best technical procedures to satisfy a customer s request. The trainee will complete the Media File Analysis checklist. This module must be completed before modules 4-8. Module 2 Checklist: Media File Analysis Trainee s Trainer s Date Completed Read FAVU SOP, Media File Analysis Can define terminology such as: frame, field, interlaced scanning, deinterlacing Can define terminology such as: codec, compression method, storage aspect ratio, display aspect ratio, frame rate Working knowledge of DME examination tools such as: Media Info Tool, G- Spot, FFMPEG, and Amped FIVE Completed mock cases on media file analysis (minimum of 2) Module 3 - Media Repair and Recovery Recommended Reading: FAD-AV-SOP on Media Repair and Recovery How Video Works, Weiss/Weynard Definitions: TERM ANALOG CASSETTE DIGITAL EVIDENCE DESCRIPTION pertaining to or being a device, recording media, or signal having the property of continuously varying in strength or quantity, such as voltage, an audio signal, a video signal or photographic film a self-contained plastic housing holding video or audio tape information of probative value that is stored or transmitted in binary form FAVU Uncontrolled When Printed Page 8 of 20

9 Training Objectives: The trainee will learn different techniques of repairing analog evidence that includes video and/or audio media. The trainee will learn ways to examine digital evidence and how to repair and/or recover evidence. Trainee will complete checklist and practice repairing analog and digital media. Module 3 Checklist: Media Repair and Recovery Knowledge of the production and assembly of forensic media, the materials from which they are made, the physical properties of those materials, and how the media are designed to function. Ability to evaluate media damage to determine whether it may affect access, playback, or recovery of the recording. Ability to disassemble and reassemble media housings and replace damaged components as necessary. Trainee s Trainer s Date Completed Ability to clean magnetic tape without damaging it. Ability to clean optical discs without damaging them. Ability to identify the following in magnetic tape reels: sticky-shed, binding, pack slip, torn or wrinkled tape, and damage to the tape reel. Ability to determine if data has been written to a recordable optical disc. Ability to splice magnetic tape. Completed mock media repair cases (minimum of 2) Module 4 - Media Duplication-Format Conversion Recommended Reading: FAD-AV-SOP on Media Duplication-Format Conversion How Video Works, Weiss/Weynard Recommended Training Courses: LEVA Level 1: Forensic Video Analysis & the Law LEVA Level 2: Digital Multimedia Evidence Processing Definitions: TERM ANALOG VIDEO EVIDENCE DESCRIPTION information of probative value consisting of a representation of various brightness levels as different voltages in a series of images (formats include but are not limited to: VHS, S-VHS, VHS-C, ¾, Betamax, Betacam, Hi8, 8 mm, FAVU Uncontrolled When Printed Page 9 of 20

10 BIT RATE (AUDIO/VIDEO) CBR (CONSTANT BIT RATE) CODEC (COMPRESSOR/ DECOMPRESSOR) COMPOSITE VIDEO SIGNAL COMPRESSION DEINTERLACING DIGITAL MEDIA EVIDENCE (DME) DIGITAL VIDEO RECORDER (DVR) DIGITIZING FRAME FIELD FILE FORMAT ITU-R 601 (INTERNATIONAL TÉLÉCOMMUNICATIONS UNION) STANDARD PROPRIETARY FORMAT S-VIDEO TIME BASED CORRECTOR (TBC) VBR (VARIABLE BIT RATE) Mini DV, as well as other analog/digital tape based video formats) the amount of bits per second that are used to make up a digital file constant bit rate encoding means that the rate at which a codec's output data should be consumed is constant no matter how complex the segment of media A device or program capable of encoding and decoding digital data. Codecs encode a stream or signal for transmission, storage, or encryption and decode it for viewing. Codecs are necessary for playback of encoded data. Generally, codecs from DCCTV systems are proprietary. an analog signal which contains chroma, video, blanking and sync information and has been combined using one of the coding standards NTSC, PAL, SECAM, etc. the process of reducing the size of a data file separating an interlaced frame into two discrete fields information of probative value stored or transmitted in binary form including but not limited to film, magnetic media, optical media, and flash media and/ or information contained therein a stand-alone embedded system or a computer based system used to record video and/or audio data the process of converting information into a digital format Lines of spatial information of a video signal. For interlaced video, a frame consists of two fields, one of odd lines and one of even lines, displayed in sequence. For progressive scan (non-interlaced) video, the frame is written through successive lines that start at the top left of the picture and finish at the bottom right. An element of a video signal containing alternate horizontal lines. For interlaced video, the scanning pattern is divided into two sets of spaced lines (odd and even) that are displayed sequentially. Each set of lines is called a field and the interlaced set of the two sets of lines is a frame. the structure by which data is organized in a file The standard for encoding interlaced analog video signals in digital video form. It includes methods of encoding 525-line 60 Hz and 625-line 50 Hz signals, both with an active region covering 720 luminance samples and 360 chrominance samples per line. The color encoding system is known as YCbCr 4:2:2. any file format that is unique to a specific manufacturer or product a signal in which the luminance and chrominance are separate an electronic device that improves video signal stability by correcting timebased errors inherent in mechanical video tape recorders allows a higher bit rate to be allocated to the more complex segments of media files while less space is allocated to less complex segments Training Objectives: The trainee will learn the most optimal ways to convert/duplicate analog and digital media. The trainee will demonstrate knowledge of analog and digital video compression and the pros and cons to it. The trainee will complete the checklist and practical exam to show competency. FAVU Uncontrolled When Printed Page 10 of 20

11 Module 4 Checklist: Media Duplication Format Conversion Trainee s Trainer s Date Completed Ability to make CD/DVD copies using the Microboards CD/DVD duplicator Ability to articulate definitions such as ITU-R 601, bit rate, VBR&CBR, lossy and lossless compression etc. Knowledge of analog video to digital conversion while maintaining a visually lossless derivative Knowledge of universal digital format conversions as described above Knowledge of proprietary digital format conversion as described above Completed mock media duplication/format conversion cases (minimum of 2) Practical Exam The practical exam will consist of three format conversions. The trainee will select the appropriate conversion method and produce an appropriate processed output result. The trainee will document the procedure as if the exam were casework. Module 5 - Forensic Audio Analysis Recommended Reading: FAD-AV-SOP on Forensic Audio Analysis Best Practices for Forensic Audio, SWGDE Core Competencies for Forensic Audio, SWGDE The Audio Dictionary Modern Recording Techniques Recommended Training Courses: Introduction to Audio Forensics, Resolution Video Accelerated DAC School, Digital Audio Corporation 3 Day Audio Forensics Training, Tracer Technologies Forensic Audio Enhancement, National Center for Media Forensics Definitions: TERM AZIMUTH ATTENUATION BANDWIDTH BIT DEPTH DISTORTION FORENSIC AUDIO DESCRIPTION the angle of a tape head s recording gap relative to the tape the weakening of a transmitted signal as it travels farther from its source the complete range of frequencies over which a circuit or electronic system can function with minimal signal loss the number of bits of information in each sample undesired changes in the waveform of a signal, barrel, and pincushion scientific examination, analysis, comparison, and/or evaluation of audio FAVU Uncontrolled When Printed Page 11 of 20

12 FREQUENCY INTELLIGIBILITY the number of complete cycles of a periodic waveform that occur in a given length of time in cycles per second (Hz) the state or quality of being intelligible; capability of being understood Training Objectives: Trainee will learn general knowledge and skills related to audio analysis. Trainee will learn software specific for audio analysis including filters. Trainee will learn about analog audio and the proper equipment to use when examining analog evidence. Trainee will learn when and how to repair audio evidence (e.g. media housings) Module 5 Checklist: Forensic Audio Analysis Ability to test audio processing software using known audio data to verify it is performing as expected. Can define terminology like forensic audio, frequency, bandwidth, bit depth, intelligibility, and distortion Knowledge of physical characteristics of various types of media (digital and analog) Trainee s Trainer s Date Completed Types of audio recording devices (digital and analog) Knowledge of voice recorder operation and the function of its basic parts Basic understanding of sound and hearing fundamentals How to inspect audio evidence (digital and analog) How to optimize evidence playback Noise identification and frequency analysis Completed mock audio cases (minimum of 2) Written Examination Passing Score: 80% The exam will cover the general principles of audio forensics, terms and definitions, audio technologies, standards, and hardware and software applications used in the processing of audio evidence. Both analog and digital topics will be covered to ensure the trainee has acquired the necessary base knowledge needed to process audio evidence. Practical Exam This will consist of conducting audio analysis on a mock case. The trainee will be required to correctly identify the relevant audio issue with the recording, select appropriate software and/or hardware tools to conduct the analysis, and produce an appropriately processed output result. Case notes and a report will be issued by the trainee to the findings of the examination. All work must be conducted in compliance with current FAVU policies and procedures. FAVU Uncontrolled When Printed Page 12 of 20

13 Module 6 - Forensic Video/Image Enhancement Recommended Reading: FAVU SOP covering Forensic Video/Image: Enhancement How Video Works, Weiss/Weynard The Image Processing Cookbook, 2nd Edition, Dr. John C. Russ Recommended Training Courses: LEVA Level 1: Forensic Video Analysis & the Law (LEVA) LEVA Level 2: Digital Multimedia Evidence Processing (LEVA) Forensic Imaging Techniques (LEVA) Amped FIVE Training Key Concepts/Definitions: TERM BRIGHTNESS/CONTRAST CROPPING/RESIZING CURVES DAR (DISPLAY ASPECT RATIO) DEINTERLACING FRAME AVERAGING GAUSSIAN BLUR IMAGE ENHANCEMENT INTERPOLATION LEVELS SAR (STORAGE ASPECT RATIO) DESCRIPTION The specific settings for brightness and contrast filters should be set so that the level of detail for the area of interest is not adversely affected. Steps should be taken to ensure that clipping does not occur in the area of interest within the image. In a global brightness adjustment, areas of the image that are not pertinent may in fact be made less visible in order to optimize the pertinent area. the removal of the outer parts of an image to improve framing, accentuate subject matter or change aspect ratio Allows the user to adjust contrast levels without affecting the color saturation of the image. It does not use the LAB color space to adjust the histogram and saturation of the image. The LAB color space does not handle color saturation properly. the ratio of the width to the height of the display frame for the video; the aspect ratio of what we see the process of converting interlaced video, such as common analog television signals or 1080i format HDTV signals, into a non-interlaced form frame averaging will remove noise that appears over several images A function typically used to reduce image noise and detail using a specific mathematical function known as the Gaussian Kernel or bell-curve. The visual effect of this technique is a smoothing of image features as if viewing the image through a translucent filter. any process intended to improve the visual appearance of an image or specific features within an image A method of image processing whereby one pixel, block, or frame is displayed or stored based on the differences between the previous and subsequent pixel, block, or frame of information. This is often done to increase the apparent clarity of an image. enhances under/overexposed images the frame size and aspect ratio of the digital video stored in the file FAVU Uncontrolled When Printed Page 13 of 20

14 SHARPENING SPEED ADJUSTMENT VIDEO ENHANCEMENT Sharpening techniques can be useful to enhance edge detail. Since the fine detail of an image lies in the high frequencies, video analysts may choose to boost the high frequencies of an image in an attempt to better visualize these details. Speed adjustment of forensic video is typically performed for the following reasons: to convert the playback speed of time-lapsed video recordings to a real-time rate and to slow the playback speed of video to a less-than-realtime rate ( slow motion ). Speed adjustments are made by varying the playback frame rate and may be accomplished through hardware (e.g. timelapse VCR) or video-processing software (e.g. Amped FIVE). any process intended to improve the visual appearance of video sequences or specific features within video sequences Training Objectives: Trainee must complete Module 3 Media File Analysis prior to this module. Trainee will learn proper methods of examining files and deciding what process to take. Trainee will learn software specific for video and image analysis including filters. Trainee will learn proper methods of exporting/converting enhanced files. Trainee will develop a workflow for video analysis casework. Module 6 Checklist: Forensic Video/Image Enhancement Ability to articulate the two categories of images Trainee s Trainer s Date Completed Knowledge of various enhancement techniques both basic and advanced, as well as their strengths and weaknesses. Knowledge of output considerations as well as the factors that can reduce output quality. Knowledge of a proper workflow from capture to enhancement and output, maintaining a nondestructive workflow with comprehensive documentation. Completed mock video/image analysis cases (minimum of 2) Written Examination Passing Score: 80% The exam will cover general knowledge of DME enhancement, terms and definitions, and hardware and software applications used in the processing of video and still images. Both analog and digital topics will be covered to insure the trainee has acquired the necessary base knowledge needed to process all video evidence. Practical Exam This practical will satisfy both the Media File Analysis & Forensic Video/Image Enhancement modules. This will consist of conducting an image enhancement on known evidence with a known outcome predetermined by a trained Forensic Video Analyst from analysis of the media to output of the derivative. Case notes and a report will be created by the trainee as to workflow and processes performed. All work must be FAVU Uncontrolled When Printed Page 14 of 20

15 conducted in compliance with current FAVU policies and procedures. Module 7 - DVR Extraction Recommended Reading: FAVU SOP covering DVR Extraction CCTV Networking & Digital Technology, by Vlado Damjanovski How Video Works, Weiss/Weynard Best Practices for the Analysis of Digital Video Recorders, SWGIT Recommended Training Courses: Digital Video Recorders: Video Evidence Retrieval (LEVA) Digital Video Recorders: Byte Level Analysis (LEVA) LEVA Level 2: Digital Multimedia Evidence Processing (LEVA) Digital Video Evidence Recovery (Resolution Video) Traditional Recovery of Evidence from DVRs (DME Forensics) DVR Examiner Fundamentals (DME Forensics) Definitions: TERM COMPRESSION CODEC COMPOSITE VIDEO SIGNAL DIGITAL EVIDENCE DIGITAL VIDEO RECORDER (DVR) MULTIPLEXER/ DEMULTIPLEXER PROPRIETARY FORMAT/NATIVE FILE FORMAT DESCRIPTION the process of reducing the size of a data file A device or program capable of encoding and decoding digital data. Codecs encode a stream or signal for transmission, storage or encryption and decode it for viewing. Codecs are necessary for playback of encoded data. Generally, codecs from DCCTV systems are proprietary. an analog signal which contains chroma, video, blanking and sync information and has been combined using one of the coding standards NTSC, PAL, etc. information of probative value that is stored or transmitted in binary form a stand-alone embedded system or a computer based system used to record video and/or audio data a device used to combine multiple video signals into a single signal or separate a combined signal any file format that is unique to a specific manufacturer or product Training Objectives: Trainee will learn the types of Digital Video Recorders. Trainee will be able to troubleshoot the best method of extracting from a DVR. Trainee will learn the different formats used by DVRs. Trainee will learn how to set up a DVR and properly play back video. FAVU Uncontrolled When Printed Page 15 of 20

16 Module 7 Checklist: DVR Extraction Knowledge of types of DVRs Trainee s Trainer s Date Completed Knowledge of common ports/drives/connections associated with DVRs Knowledge of cameras analog and IP Knowledge of extraction methods and pros and cons of each Knowledge of considerations regarding DVRs Completed mock DVR cases (minimum of 2) Written Examination Passing Score: 80% The exam will cover general knowledge of DVRs, terms and definitions, extraction methods, and hardware and software applications used in the processing of DVR evidence. Both analog and digital topics will be covered to insure the trainee has acquired the necessary base knowledge needed to process DVRs. Practical Exam This will consist of conducting DVR analysis on known evidence with a known outcome predetermined by a trained Forensic Video Analyst. Case notes and a report will be created by the trainee to the findings of the examination. All work must be conducted in compliance with current FAVU policies and procedures. Module 8 - Scene Response Recommended Reading: FAVU SOP on Scene Response Best Practices for the Retrieval of Video Evidence from Digital CCTV Systems LEVA Best Practices for the Acquisition of Digital and Multimedia Evidence Version: 3.0 (4/14/10) Definitions: TERM CHAIN OF CUSTODY EXTRACTION LEGAL AUTHORITY PRESERVATION STORAGE MEDIA DESCRIPTION The procedures and documents that account for the possession of a sample by tracking its handling and storage from its point of collection to its final disposition. any method of exporting data from a source consent to search and/or seize digital and multimedia evidence the process undertaken to maintain the integrity of potential digital evidence any object on which data is preserved Training Objectives: FAVU Uncontrolled When Printed Page 16 of 20

17 Trainee must complete and pass the Module 7 DVR Extraction written and practical exams prior to completing this module. Trainee will learn how to take what was learned in Module 7 and apply it at a scene. Trainee will learn how to prepare for call outs and learn protocols for them. Trainee will learn safety procedures and protocols to follow while at a scene. Module 8 Checklist: Scene Response Trainee s Trainer s Date Completed Read and understands related SOPs and Modules 8 and 9 Knowledge of types of DVRs and extraction methods Knowledge of preparing for a scene response Knowledge of scene arrival protocols Knowledge of protocols for returning from a scene response Observed scene responses with a trained Forensic Analyst (minimum of 2) Module 9 Legal and Testimony Recommended Reading: HFSC Code of Ethics LEVA Code of Ethics Recommended Training Courses: LEVA Level 1- Forensic Video Analysis and the Law LEVA Level 2- Digital and Multimedia Evidence Processing HFSC Ethics Training Moot Court Training Definitions: TERM AUTHENTICATION CHAIN OF CUSTODY LEGAL AUTHORITY DESCRIPTION the (1.) process of substantiating that the asserted provenance of data is true, and (2.) the process of substantiating that data are accurate representations of what they are purported to be the procedures and documents that account for the possession of a sample by tracking its handling and storage from its point of collection to its final disposition consent to search and/or seize digital and multimedia evidence Training Objectives: FAVU Uncontrolled When Printed Page 17 of 20

18 Trainee will study important court cases and learn how they pertain to the Audio/Video discipline. Trainee will learn how to present him or herself in court and be able to explain concepts and analysis in a clear and concise manner. Forensic Science and the Law: Video evidence is classified as a form of photographic evidence under Federal Rules of Evidence 1001 and falls into one of three categories: illustrative, event recording, or surveillance. Forensic Science and the Law training provides the analyst ability to present clear and non-technical digital and multimedia evidence-based testimony in court. It also provides the analyst an ability to prepare accurate and reliable documentation and/or visual aids (i.e. notes, reports, printouts, audio recordings). This training should address the use of techniques such as: Lecture-type presentation relevant to court testimony Court monitoring Moot court Ethics training Test for Relevant Evidence- Texas Rules of Evidence 401/FRE 401: Evidence is relevant if: It has any tendency to make a fact more or less probable than it would be without the evidence; and The fact is of consequence in determining the action. General Admissibility of Relevant Evidence- Texas Rules of Evidence 402/FRE 402: Relevant evidence is admissible unless any of the following provides otherwise: the United States or Texas Constitution; a statute; these rules; or other rules prescribed under statutory authority 1993, United States Supreme Court, Daubert v Merrell Dow Pharmaceuticals, Inc.: The judge is the gatekeeper to expert testimony and will only allow expert testimony to be presented to the jury if specific requirements are met. The current rules on experts were created by the United States Supreme Court in the case of Daubert v Merrill Dow Pharmaceuticals. Judge is gatekeeper: The trial judge has the job of gatekeeping or guaranteeing that expert testimony is actually scientific knowledge. Relevance and reliability: The trial judge must make sure that the expert s testimony is relevant to the task at hand and rests on a reliable foundation. Any concerns about expert testimony cannot be given to the jury as a question of the weight of the evidence. Also, the Judge must find it more likely than not that the expert s methods are reliable and reliably applied. FAVU Uncontrolled When Printed Page 18 of 20

19 Scientific method/methodology: A conclusion will qualify as scientific knowledge if the proponent can show that it is the product of sound scientific methodology that uses the scientific method. Factors: Scientific methodology is the process of formulating hypotheses and conducting experiments to prove or disprove the hypothesis. It is necessary to provide a no dispositive, nonexclusive, flexible set of observations considered relevant in order to determine the validity of any scientific testimony. Empirical testing: Whether the theory or technique is falsifiable, refutable, and/or testable, whether it has been subjected to peer review and publication, the known or potential error rate, the existence and maintenance of standards and controls concerning its operation and the degree to which the theory and technique is generally accepted by a relevant scientific community. Testimony by Expert Witnesses- FRE 702: A witness who is qualified as an expert by knowledge, skill, experience, training, or education may testify in the form of an opinion or otherwise if: (a) The expert s scientific, technical, or other specialized knowledge will help the trier of fact to understand the evidence or to determine a fact in issue; (b) The testimony is based on sufficient facts or data; (c) The testimony is the product of reliable principles and methods; and (d) The expert has reliably applied the principles and methods to the facts of the case. Authenticating or Identifying Evidence- Texas Rules of Evidence 901/FRE 901: In general, to satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is. Authentication of evidence generally focuses on location, date, time, reliability, and integrity. Contents of Writings, Recordings, and Photographs- Texas Rules of Evidence 1001/FRE 1001: In this article: (a) A writing consists of letters, words, numbers, or their equivalent set down in any form. (b) A recording consists of letters, words, numbers, or their equivalent recorded in any manner. (c) A photograph means a photographic image or its equivalent stored in any form. (d) An original of a writing or recording means the writing or recording itself or any counterpart intended to have the same effect by the person who executed or issued it. For electronically stored information, original means any printout or other output readable by sight if it accurately reflects the information. An original of a photograph includes the negative or a print from it. (e) A duplicate means a counterpart produced by a mechanical, photographic, chemical, electronic, or other equivalent process or technique that accurately reproduces the original. FAVU Uncontrolled When Printed Page 19 of 20

20 Requirement of the Original- Texas Rules of Evidence 1002/FRE 1002: An original writing, recording, or photograph is required in order to prove its content unless these rules or other law/federal statute provides otherwise. Admissibility of Duplicates- Texas Rules of Evidence 1003/FRE 1003: A duplicate is admissible to the same extent as the original unless a question is raised about the original s authenticity or the circumstances make it unfair to admit the duplicate. Module 9 Checklist: Legal and Testimony Trainee s Trainer s Date Completed Knowledge of relevant federal and state case law pertaining to the forensic processing of forensic media Knowledge of rules of evidence in civil and criminal procedure pertinent to admissibility and authentication Knowledge of rules of evidence in civil and criminal procedure pertinent to expert witness testimony Ability to present technical data in a clear and concise manner Observed testimonies by other trained analysts (minimum of 2 and does not necessarily need to be audio/video testimony if not available) Practical Exam: Moot Court FAVU Uncontrolled When Printed Page 20 of 20