Service · CCTV footage analysis
CCTV footage analysis for investigations, claims and court
CCTV footage analysis is the forensic examination of security camera recordings to establish who and what is visible, when events happened and in what order. We work from native DVR and NVR exports, reconstruct events across multiple cameras, and report what the footage can and cannot show.
Expert Witness Code of Conduct
Reports prepared in line with court rules on expert evidence
SWGDE best practice
Recognised methods for digital and multimedia evidence
Repeatable methods
Documented workflow that another examiner can reproduce
Hash-verified custody
SHA-256 recorded on receipt and at every hand-off
Strictly confidential
Encrypted transfer and secure storage of evidence
Overview
What is CCTV footage analysis?
CCTV footage analysis is the documented examination of security camera recordings to answer specific questions about an incident. It establishes what each camera recorded, when, and in what sequence, and states clearly where the footage cannot answer the question.
Security cameras are designed to deter and record, not to produce evidence. Most systems record at reduced frame rates, compress footage heavily to save storage, and overwrite it within weeks. Camera clocks are often wrong, and many recorders only record when they detect movement. A forensic examination starts from the native export, verifies the file with a hash value, and checks the recorder’s settings, clock and frame rate before relying on anything the footage appears to show. Where several cameras cover the same area, we align them on one corrected timeline and follow people and vehicles from view to view. The result is an expert report that separates what the CCTV demonstrates from what it cannot show.
What we can establish
Questions CCTV analysis can answer
Each examination starts from the questions that matter to your matter. We then apply the technique that can answer them and report the result with its limitations.
Event reconstruction
A frame-by-frame account of what happened, in what order, before, during and after the incident.
Multi-camera timelines
Alignment of every camera on one corrected timeline, allowing for clock errors and differing frame rates.
Tracking people and vehicles
Following a person or vehicle from one camera view to the next, with the time they appear in each.
Visibility assessment
Whether a face, action or object is actually visible, at what resolution and for how many frames.
Clothing and vehicle comparison
Comparison of clothing, vehicle type, colour and distinctive features, with the limits of each stated.
Timestamp verification
Checking the recorder’s clock against a reliable reference before any displayed time is relied on.
Continuity and gaps
Whether the recording is continuous, and the cause of any gaps, dropped frames or motion-triggered breaks.
Stills and clips for court
Annotated frames and sequences, each referenced to the original file and timestamp.
Systems we examine
CCTV from every kind of system
The type of system decides how footage is exported, what metadata survives and what can go wrong. Knowing it tells us what to ask for before the footage is lost.
DVR systems
Digital video recorders connected to analogue or HD-over-coax cameras, common in shops, homes and small businesses.
Watch out: exports often play only in the manufacturer’s player. Keep the player files that are exported with the footage.
NVR and IP cameras
Network video recorders and IP cameras, typical of larger premises, offices and multi-site businesses.
Watch out: H.265 and proprietary exports may not play on standard software. Do not convert them before sending.
Video management systems
Enterprise software managing many cameras across shopping centres, campuses, hospitals and venues.
Watch out: request the system’s native or signed export, together with any audit log of who accessed the footage.
Cloud-hosted CCTV
Cameras that record to an online service, including many doorbell, home and small-business systems.
Watch out: retention depends on the subscription and clips may be deleted after a set period. Download the originals now.
Public and transport CCTV
Cameras operated by councils, transport operators and other public bodies, usually released on formal request.
Watch out: retention periods can be short, so make the request early and ask for the native export rather than a converted copy.
Copies of CCTV
Phone recordings of a monitor, screen recordings, and clips forwarded by email, messaging apps or social media.
Watch out: a copy can still be assessed, but detail and metadata are often lost. We will help you trace the original.
Related video forensic services
Services often used with CCTV analysis
Many CCTV matters also need clearer images, measurements or help playing the file. Each of these has its own page.
Forensic Video Enhancement
Clarification, stabilisation, deinterlacing and frame averaging of CCTV, with every step logged and kept representative of the original.
Forensic video enhancement →
Speed, Height and Distance Analysis
Photogrammetry and frame-timing analysis to measure speed, height and position from CCTV views.
Speed, height and distance →
Video Decoding
Playback and conversion of proprietary DVR and NVR exports, and recovery of corrupted or partial files.
Video decoding →
Common questions
What lawyers and insurers ask us about CCTV
Short, direct answers to the questions that most often decide how CCTV footage can be relied on.
How do you reconstruct events from several CCTV cameras?
By aligning every camera on one corrected timeline, then following people and vehicles from view to view. Each appearance is logged with its corrected time and camera, so the sequence of events can be read in order and checked against the original footage.
We first measure each recorder’s clock error and verify its real frame rate. Shared moments, such as a person passing from one camera’s view into another’s, then let us confirm the alignment. The result is a timeline showing where each person or vehicle was, and when, together with any periods where no camera recorded them.
What if the CCTV footage has gaps or missing time?
Gaps are common in CCTV and usually have an ordinary cause, such as motion-triggered recording or how the footage was exported. We identify each gap, establish its most likely cause from the recorder’s settings and file structure, and report what it means for your question.
| Type of gap | Common cause |
|---|---|
| Breaks between events | Motion-triggered recording, which only records when the camera detects movement. |
| Jumps in the timestamp | A low or variable frame rate, where the recorder captures only a few frames each second. |
| Missing minutes at the edges | The export did not cover the full period, or was split into separate files. |
| Missing days | The recorder overwrote older footage, or the system was off or disconnected. |
| Unexplained gaps | A fault, a deletion or possible editing. These need a closer look, and may call for video authentication. |
Can CCTV identify a vehicle or read a number plate?
Vehicle type, colour and direction of travel can often be established. A number plate can be read only if its characters were recorded at a usable resolution in the original file, which on most general-purpose CCTV cameras they are not.
Plates are small, often moving and frequently caught in headlight glare at night. Compression then removes the fine detail that separates one character from another. Enhancement can make recorded detail easier to see, but it cannot recover characters that were never captured. Even where a plate cannot be read, the make, shape and distinctive features of a vehicle may still be compared. More on forensic video enhancement.
What if I only have a phone recording of the CCTV screen?
We can still assess it, but it is the weakest form of CCTV evidence. Filming a monitor adds glare, distortion and extra compression, and loses all of the original metadata. If the recorder may still hold the footage, get the native export as soon as possible.
A phone recording can still show the general sequence of events, and it can help identify which camera and time period to request. It cannot support detailed analysis of faces, plates or timing, and it cannot be authenticated in the way a native export can. If you are unsure whether the original still exists, contact us quickly, because many recorders overwrite footage within 7 to 30 days. How to preserve CCTV evidence.
Instructing us
What to send us, and what you receive
The more of the original system information you can provide, the more the CCTV can establish. Please contact us before sending footage so we can arrange a secure transfer.
What to send us
- The native export from the DVR or NVR, not a converted, screen-recorded or messaged copy
- The player software exported with the footage
- Footage from every camera that may cover the incident, with time before and after it
- The make and model of the recorder, if known
- A photo of the recorder’s on-screen time next to a reliable clock, such as a phone
- A plan or photos showing where each camera is positioned
- The date, time and location of the incident
- The specific questions you need answered
The photo of the recorder’s clock lets us measure its error. Take it as soon as possible, before anyone changes the time setting.
What you receive
An independent expert report, prepared in line with the Expert Witness Code of Conduct, that sets out:
- InstructionsThe questions we were asked to address
- Materials examinedEvery CCTV file, with its hash value
- MethodologyThe examinations and processing performed
- Event timelineEach camera aligned on one corrected timeline
- Findings and opinionsOur observations and opinion on each question
- LimitationsFactors affecting reliability and interpretation
- ExhibitsAnnotated stills, clips and camera position diagrams
Our process
How a CCTV examination works
A defined workflow protects the integrity of the evidence and the weight of our opinion. You receive a written scope and quote before any work begins.
Initial discussion
We review the cameras involved, the questions to be answered and your deadline.
Secure evidence transfer
Encrypted transfer or original media by courier. SHA-256 hash recorded on receipt.
System and clock checks
Playback, frame rate and timestamp accuracy verified before analysis.
Analysis and peer review
Timeline and findings built on a working copy, then checked.
Report and testimony
Expert report and exhibits, with court attendance if required.
A single camera with a clear question can often be examined within days. Multi-camera reconstruction takes longer, and urgent court deadlines can be accommodated.
See the full process7–30
days to overwrite
CCTV footage may be overwritten within days
Many recorders automatically record over old footage within 7 to 30 days. Ask the system owner for a native export now, keep any player files, and avoid filming the screen or sending the video by messaging app or email.
Frequently asked questions
CCTV analysis FAQs
Answers to the questions we are asked most often about CCTV footage.
See all FAQsAs soon as possible. Many CCTV recorders automatically overwrite old footage within 7 to 30 days, and some much sooner. Ask the system owner for a native export of every relevant camera straight away, with time before and after the incident. If the footage may already be at risk, contact us and we will advise on the fastest way to secure it.
It varies widely. Many systems record well below normal video frame rates to save storage, sometimes at only a few frames each second, and some change their frame rate when motion is detected. The rate shown in the settings is not always what was recorded, so we verify the actual frame rate from the file before relying on any timing.
Yes. We examine the file structure, metadata, timestamps and frame sequence for signs of editing, deletion or re-encoding. Where the authenticity of the footage is disputed, this forms part of our video authentication service, which reports whether the file is consistent with an original recording.
Keep the export exactly as it is, together with any player software or extra files that came with it, and do not convert it. Many CCTV systems use proprietary formats that only play in the manufacturer’s software. Decoding these files is a core service, and we can usually play and examine them.
Yes. We regularly examine footage supplied through disclosure or formal requests. Where possible, ask for the native export rather than a converted copy, and note any information provided about the system and how the footage was obtained, as this supports the chain of custody.
Fees depend on the number of cameras, the length and format of the footage, the questions to be answered and whether court attendance is needed. We offer fixed-fee and hourly engagements, and where possible we review the footage before quoting. You receive a written quote before any work begins.
Related services
Other video and image forensic services
CCTV matters often raise questions about authenticity, still images or expert evidence. These services are provided by the same team.
Video Forensics
Analysis of dashcam, body-worn and phone video as well as CCTV.
All video forensic services →
Video Authentication
Testing CCTV for editing, re-encoding, splicing and deleted frames.
Video authentication →
Digital Image Forensics
Analysis and authentication of still images taken from CCTV or cameras.
Digital image forensics →
Expert Witness
Independent expert reports and court testimony on CCTV evidence.
Expert witness services →
Get expert advice
Discuss your CCTV footage with a forensic video expert
Tell us which cameras are involved, what you need to establish and any deadlines. We will give you a candid view of what the footage can support before you commit to any work.
Freecall
1800 865 190
Hours
Monday to Friday, 9.00 am to 5.30 pm
All enquiries are treated in strict confidence. Please contact us before sending any footage so we can advise on the most appropriate transfer method. If you do share footage with us, always use a secure method to protect the integrity of your evidence.