Managing surveillance video and photos

A day of surveillance can produce hundreds of photos and hours of video spread across two cameras, a phone and a dash camera. Three weeks later the adjuster asks for “the clip where he lifts the tire,” and the answer is somewhere in a folder called DCIM_0412.

Good file management isn’t glamorous, but it decides whether your footage can be found, explained and checked when it matters. This guide covers a routine that works for a solo investigator with ordinary equipment: clock discipline, naming, originals versus working copies, storage, backup and handover.

Start before you record: set the clocks

Every later step depends on knowing when something was recorded. Modern cameras store the recording time in the file’s metadata, but only as accurately as the camera’s own clock. Pursuit Magazine’s piece on authenticating video time stamps notes that most current cameras don’t burn a visible timestamp into exported video the way older analog equipment did, so the metadata is often all you have.

Before each assignment:

• Set every device’s clock against a reliable reference, such as your phone’s network time or the official US time at time.gov. Do it at the start of the shift, not “when you remember.”
• Check time zones and daylight saving. A camera still on standard time is an hour off for half the year.
• Photograph a reference clock (your phone’s lock screen showing the time) with each camera at the start of the shift. It takes five seconds and records any drift.
• Note the settings in your surveillance log: device, clock checked at, any offset found.

If you find a camera was off, don’t edit the files to “fix” it. Record the offset in your log and report, and let the reader apply it.

Name files so they explain themselves

Camera file names like MVI_0341.MP4 tell nobody anything and will repeat across devices. Rename copies (never the only original; see below) to a consistent pattern:

2026-09-14_1422_CASE-0417_CAM2_front-entrance.mp4

That’s date, 24-hour time, case reference, device and a two- or three-word description. Dates in year-month-day order sort correctly in any file browser. Keep descriptions factual (“front-entrance”, “subject-loading-truck”), not conclusions (“proof-of-lifting”).

Whatever pattern you choose, use it on every case. Consistency is what lets you, a subcontractor or an attorney find a clip without calling you.

Keep the original, work on copies

The most important habit: the file that came off the camera stays exactly as it came off the camera. The Scientific Working Group on Digital Evidence (SWGDE), whose documents are widely used as vendor-neutral practice references, explains that most video is stored with lossy compression, and that once a file has been compressed, “care should be taken not to compress them any further.” Each re-encode throws away detail you can’t get back.

In practice:

1. Offload the originals from the card to your computer at the end of each shift, in their native format. Don’t let a phone app or editing program “optimize” or convert them on import.
2. Fingerprint the originals. Compute a SHA-256 hash of each file as soon as it’s offloaded and record it. Our guide to verifying an evidence file hash shows the one-line commands for Windows, Mac and Linux. If anyone later asks whether a file has changed, the hash answers it.
3. Make working copies for everything else: trimmed clips for the report, stills pulled from video, smaller versions for email-sized delivery, redacted versions. Name them so they can’t be confused with the original (add _clip, _still or _redacted) and note which original each came from.
4. Only then format the card. Not before the offload has been checked and backed up.

A trimmed clip for a report is fine and often expected. What matters is that the full original still exists and that anyone can see how the clip relates to it.

Log as you go

Your surveillance log and your media should point at each other. Each log entry that has footage should name the file (or files) that shows it, and each clip should be traceable to a log entry. If you log “14:22, subject exits front door carrying a toolbox,” the clip starting at 14:22 should be easy to find by its name.

This cross-reference is what turns a folder of footage into something an adjuster or attorney can use. Our surveillance report guide and the free surveillance log template are built around it.

Organize by case, then by day

A simple structure that holds up:

CASE-0417/
  01_originals/
    2026-09-14/
    2026-09-15/
  02_working-copies/
  03_stills/
  04_delivered/
  hashes.txt

• Originals by day make it easy to answer “what did you get on the 14th?”
• Delivered holds exactly what went to the client, as sent, so you can answer “what did you give us?” without guessing.
• hashes.txt lists each original’s name, size and SHA-256 value.

Don’t mix cases in one folder, and don’t keep footage in your phone’s camera roll longer than it takes to offload it. A camera roll syncs to places you may not have thought about.

Store it where a stolen laptop isn’t a disaster

Surveillance footage shows real people, often including bystanders who have nothing to do with the case. Treat it as sensitive:

• Encrypt the drives it lives on. Turn on full-disk encryption on your laptop (BitLocker or device encryption on Windows, FileVault on Mac), and use encrypted external drives for archives. Our guide to protecting your laptop in the field covers the setup.
• Be deliberate about cloud sync. Consumer sync services are convenient, but by default the provider holds the keys. If footage goes to the cloud, know which service, who can open it and how long it stays.
• Limit who has it. Subcontractors should get the footage they need for their part, and return or delete it when they’re done (see subcontracting safely).

Back up with a plan

Cards fail, laptops get stolen and drives die. A common rule of thumb is three copies, on two kinds of storage, with one kept somewhere other than your office or vehicle. For a small practice that might be: the laptop, an encrypted external drive kept at the office, and an encrypted offsite or cloud copy.

Test a restore now and then. A backup you’ve never opened is a hope, not a backup. And when you check a restored file, compare its hash with the one in hashes.txt.

Hand over the right files, the right way

When the client needs footage:

• Send what they asked for, usually the relevant clips plus access to the full originals on request, rather than every file from every day.
• Include the hash of each file you deliver, so the recipient can check it arrived intact.
• Use a delivery method built for it. Large video doesn’t belong in email attachments, and “anyone with the link” folder links tend to stay live for years. Our guide to sharing files securely with clients compares the options.
• Keep a record of what went to whom and when, in the case file.

Redaction and bystanders

Footage often captures neighbors, children and other drivers. Some clients will ask you to blur faces or plates before the footage goes further. If you do, redact a working copy, never the original, and label it clearly as redacted. SWGDE publishes separate redaction guidelines if you do this regularly.

When the case closes

Decide how long you keep footage and write the decision down, following your retention policy (see case file retention). When the time comes, delete all copies, including working copies, delivered copies and backups, not just the folder you look at most.

Spotted an error? Tell us by email and we'll correct it.