Extracting footage from a CCTV recorder, whether PC-based or a dedicated DVR, differs from ordinary computer evidence. The DEFR: first confirms the system recorded the sequence of interest, fixes the time window needed, checks the recorder clock against accurate time and records any offset, decides which cameras are needed and whether they can be taken separately, and notes make and model to find the right replay software; takes all relevant camera recordings for the period so later lines of inquiry are covered, recording every connected camera and whether it records; finds the storage size and when footage will be overwritten, and protects the evidence from change with write protection in place. Options for acquiring are: writing files to optical disc (impractical for large files), to external storage, or over a network port; exporting to another format such as MPEG or AVI only as a last resort, since recompression changes the data and loses detail and should not be relied on where originals exist; and, where no digital copy can be made, recording an analogue copy from the recorder's analogue output. Afterwards the DEFR checks the right file or portion was taken and that it plays on other systems (formats are often proprietary; replay software may be downloadable from the system), treats the medium holding it as the master copy, making a permanent master quickly if it was downloaded to a laptop or memory stick, and restarts a system that was switched off, in the presence of the authorised person. Where acquisition on site is impractical, the drive may be swapped for a blank or cloned one after weighing compatibility risks (a removable caddy drive may still need the system's hardware to play), and as a last resort the whole system is removed to the laboratory if physically possible, after assessing legal and insurance risks. Preservation follows 7.1.4.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.