Why video evidence falls apart.
Most security footage never makes it to the people who need it. Recorders overwrite on a loop, and by the time the client asks, the night in question is gone. The footage that survives is often a phone video of the monitor, a screenshot pasted into an email or a clip trimmed and re-encoded by three different people. Timestamps disagree, nobody knows which file is the original, and the incident report says “see attached” about an attachment that proves very little.
The fixes are not complicated. They just need to happen at the time of the incident, not a week later.
Capture: get it while it is happening.
- Mark the moment. Note the camera name and time as soon as you see the event, before you do anything else.
- Save the first and the best. The first frame the person appears, the clearest frames of each face, person, vehicle and plate, and what they did.
- Cover before and after. Export from shortly before the person arrives to shortly after they leave, on every camera they crossed.
- Export from the source. Use the recorder or VMS export, not a phone pointed at the screen. Keep the native format and the player if the system requires one.
- Beat the overwrite. Know how long each site’s recorder keeps footage, and export before it rolls over. Many clients have far less retention than they assume.
Preserve: originals, timestamps and hashes.
Keep the original untouched
Save the export as it came out of the system and never edit it. Make copies for marking up, cropping, enhancing or adding arrows, and label them clearly as working copies. If anyone asks later, the original is still there to compare against.
Get the time right
Camera clocks drift, and many are set to the wrong time zone or never adjusted for daylight saving. Record the offset between the camera’s on-screen time and real time on the day of the incident, and note it in the report. When several cameras are involved, a consistent time reference is what lets you reconstruct the sequence.
Hash the files
A cryptographic hash such as SHA-256 is a fingerprint of a file’s exact contents. Change one pixel and the hash changes. Recording the hash of each original when you export it lets anyone confirm later that the file they have is the one you saved. It costs seconds and answers the most common challenge to digital evidence: “how do we know this wasn’t altered?”
Chain of custody basics.
Chain of custody is, in the words of Wikipedia’s definition, the chronological documentation that records the sequence of custody, control, transfer, analysis and disposition of evidence, including electronic evidence. For a guard company that does not need to be heavy. It needs to answer four questions for every piece of footage:
- Who exported it, from which system and camera.
- When it was exported, and what time range it covers.
- Where it has been stored since, and who could access it.
- To whom it was handed over — client, police, insurer — when and how.
A simple evidence log per incident, with the file names and hashes, covers most of it. Police and prosecutors will have their own requirements; ask the investigating officer what format and media they want, and log the handover.
Capture now
Camera, time and the key frames, during the incident. Export originals from the recorder before they overwrite.
Fingerprint and store
Hash each original, store it in one controlled location and keep marked-up copies separate.
Log every handover
Who, when, what and to whom. Attach the log and hashes to the incident report.
Where Semaphor fits.
Semaphor builds evidence discipline into the alert itself. Start with what Semaphor is. Every processed frame and camera crop keeps the original image with an exact SHA-256 hash and perceptual hashes (pHash and dHash), plus source timestamps. The original evidence sits beside every AI assessment, never replaced by it, and a session exports as a JSON manifest that links the saved images. That is the evidence and audit trail your incident report can point to.
Guard-mode retention is automatic and bounded, so export what a case needs — the frames are already hashed and waiting in the guard inbox card. The same evidence makes alarm verification calls stronger and shift handoffs cleaner. See it on your own cameras: start a pilot, or book a live demo on your own camera screens.
Video evidence FAQ
How do you preserve CCTV footage for an incident report?
Export the original from the recorder as soon as possible, before it overwrites, keep it unedited, record camera names, time ranges and clock offsets, hash the files and log every handover.
Why hash video evidence?
A hash such as SHA-256 is a fingerprint of the exact file. Recording it at export lets anyone verify later that the footage has not been changed.
What is chain of custody for video footage?
A record of who exported the footage, when, where it has been kept, who could access it and every person it was handed to. It shows the footage presented is the footage captured.
Is a phone recording of the monitor good enough?
It is better than nothing when nothing else is possible, but it loses quality and timing information. Export from the source system whenever you can.