A critical camera clip can be overwritten within days, a mobile recording can be altered with one careless share, and a screenshot may omit the detail that later proves decisive. Knowing how to preserve surveillance evidence promptly can protect the integrity of an investigation, insurance claim, employment matter, civil dispute or personal safety case.
The priority is not simply to obtain footage. It is to retain the original material, establish where it came from, record every person who handles it, and ensure it can be properly understood when reviewed weeks or months later. A disciplined approach gives legal advisers, investigators, insurers and decision-makers confidence that the material is reliable.
Act before the recording is lost
Most CCTV, dashcam, access-control and alarm systems record over old data automatically. Retention periods vary significantly. A small business system may overwrite footage in 24 to 72 hours, while a larger cloud-based system may retain video for longer. Do not assume footage will still exist because an incident has been reported.
As soon as an incident is identified, make a written record of the date, approximate time, location, cameras or devices involved, and the reason the material may be relevant. Include a wider time window than the event itself. Footage from 10 to 30 minutes before and after an incident can show arrivals, departures, interactions, vehicles, clothing, or events that give necessary context.
Where a third party controls the system, contact them quickly and request that the relevant material be preserved. This may include a retailer, neighbour, building manager, transport operator, employer, school, venue or local authority. Keep a record of who you spoke with, the time and date, what you requested, and their response. A clear preservation request is often more useful than a vague request to “check the cameras”.
If there is an immediate threat to safety, suspected criminal offending, stalking, violence or intimidation, contact Police. Avoid confronting a person believed to be involved merely to obtain evidence.
Preserve the original before creating copies
The original file or recording is the most valuable version of surveillance evidence. It may contain embedded data, a system-specific format, timestamps, camera identifiers, audit information or other technical details that do not survive a screen recording, social media upload or edited export.
Where possible, obtain an export directly from the recording system using its native format as well as a playable copy, such as MP4, where the system permits it. Native files can require specialist viewing software, but they may preserve information that a standard video file does not. Retain both versions and document which is which.
Do not trim clips, add captions, adjust brightness, slow footage down, combine files or use filters on the only copy. These actions may be useful later for explanation or review, but they create a derived version rather than preserving the source. If an enhanced clip is required, keep it clearly labelled as a working copy and retain the untouched original separately.
Screenshots have a role, particularly when reporting an urgent concern. They should not be treated as a substitute for the underlying footage. A still image cannot show duration, movement, continuity or what occurred immediately before and after the captured frame.
Check the date and time settings
Camera timestamps are useful, but they are not automatically accurate. Systems can be set to the wrong date, run several minutes fast or slow, or change after a power interruption. Record the displayed time and compare it with a known reliable time, such as the time shown on a mobile or computer connected to a trusted network.
Do not correct the footage itself. Instead, note the observed difference. For example: “Camera time displayed 14:07. Actual observed time was approximately 14:12.” This allows an investigator or legal representative to assess timing without compromising the original record.
Create a clear chain of custody
A chain of custody is a practical record of what happened to evidence from the moment it was identified. It does not need to be complicated, but it must be accurate. Its purpose is to show that the material was not lost, substituted, altered or handled carelessly.
For every file, device or storage medium, record the source, date and time collected, the person who collected it, the method used, and the location where it is stored. If footage was downloaded by a building manager, identify them and record the camera system details if known. If a USB drive was supplied, label it with a unique reference rather than writing over any original label.
A simple evidence register should also record every transfer. Note who released it, who received it, why it was transferred, and when. This is particularly important where material moves between a client, investigator, insurer, solicitor, employer or Police.
Keep factual notes separate from assumptions. Write what the footage appears to show, but avoid making conclusions that go beyond the visible evidence. A useful note might state that a dark-coloured ute entered a car park at a specified time. It should not state who was driving unless that identification can be properly supported.
Store digital footage securely
Evidence can be compromised by accidental deletion, unauthorised access, file corruption or uncontrolled sharing. Store originals in a secure location with access limited to people who need to handle them for the matter.
Maintain at least two preserved copies in separate secure locations. One should remain a protected master copy that is not used for routine viewing. The other may be used as a working copy for investigators, legal advisers or authorised reviewers. If cloud storage is used, confirm the account is protected with strong access controls and that sharing permissions are restricted.
When practical, calculate and record a file hash for significant digital evidence. A hash is a technical fingerprint of a file. If the hash remains the same, it provides a strong indication the file has not changed. This is especially valuable in commercial disputes, litigation and matters where footage may be challenged.
Avoid sending original files through informal messaging services or posting material online. Messaging platforms can compress video, remove metadata and make onward distribution difficult to control. Public sharing can also affect privacy, prejudice an investigation, expose vulnerable people, or create unnecessary legal risk.
Preserve more than video
Surveillance evidence rarely stands alone. Supporting material can establish whether the footage is complete, where a person or vehicle travelled, or why an event occurred. Preserve relevant incident reports, visitor logs, swipe-card records, delivery records, photographs, emails, text messages, call logs, repair records and system maintenance reports.
For vehicle-related incidents, retain dashcam footage in its original form and photograph the vehicle, number plate, damage, road conditions and surrounding area where safe to do so. For workplace or premises incidents, record the camera positions and any blind spots. A floor plan or basic sketch can help establish what a particular camera could reasonably capture.
If physical equipment is relevant, such as a damaged camera, recorder, mobile, storage drive or access card, do not attempt repairs or investigations that may change its condition. Photograph it, record where it was found, and secure it. Specialist examination may be required.
Lawful collection and privacy matter
The value of surveillance evidence can be undermined when it has been obtained through trespass, unauthorised access to an account, covert recording in a place where privacy is reasonably expected, or improper disclosure. The fact that footage appears useful does not automatically give someone the right to access, copy or distribute it.
Businesses should follow their privacy obligations, internal policies and any legal advice relevant to the matter. Private individuals should be particularly cautious with footage involving children, neighbours, employees, tenants or people in sensitive circumstances. Preserve what is relevant, disclose it only to appropriate parties, and avoid unnecessary circulation.
There are situations where speed must be balanced with process. A family concerned for someone’s safety may need to preserve a threatening message immediately. A commercial client dealing with suspected fraud may need to secure access logs before alerting staff who could interfere with records. The appropriate method depends on the risk, the source of the evidence and the purpose for which it may be used.
When professional assistance is justified
Professional support is often warranted where evidence is spread across multiple locations, a system owner refuses access, footage may be overwritten, the matter involves alleged dishonesty or misconduct, or there is a risk of confrontation. It is also valuable when detailed reporting, verified observations and a defensible evidence trail are required for legal or commercial action.
The Neill Group can assist clients requiring discreet, licensed investigative capability, secure evidence handling and nationwide field support. Early instructions give an investigator the best opportunity to identify relevant material before it disappears.
Treat surveillance evidence as time-sensitive and potentially fragile. Preserve the source, document each step, limit access and seek appropriate assistance before an avoidable action turns useful footage into an unanswered question.