A phone recording of a security screen, six generations from the event
The situation
During a robbery prosecution a store employee recorded a security-monitor playback on a personal phone. The original surveillance system was later overwritten. The prosecution offered the phone recording — 22 seconds of a longer event, appearing to show someone in clothing similar to the defendant's.
What the other side said the evidence showed
That the recording showed the defendant committing the offense, and that the clothing visible in it matched.
Every hand-off in a video's history is a chance for it to change, and this file had six.
The provenance chain here ran: security camera, to surveillance recorder, to monitor playback, to an employee's phone camera, to a messaging application, to a detective's phone, to the police evidence system, to the prosecution. Each stage can alter the evidence, and two of them altered it substantially — the phone filmed a screen rather than receiving a file, and the messaging application recompressed what the phone produced.
Messaging applications are the most underestimated step. They recompress video, lower resolution, change codec and frame rate, rewrite creation timestamps, and commonly strip GPS and device identifiers. The file that reaches an investigator through a messaging app carries a creation time reflecting the download, not the recording. Absent other evidence, that file cannot establish when it was made.
Filming a screen introduces its own distortions. Automatic exposure shifts, the monitor's refresh rate produces rolling bands, and the angle changes apparent geometry. Those effects alter apparent color, brightness, object edges, movement smoothness, and perceived speed — which is why a clothing-color comparison drawn from such a recording is not a reliable identification.
What the examination involved
Mapped the full provenance chain
Identified every stage between the event and the exhibit, and which stage each observable characteristic of the file could be attributed to.
Established what the original mobile file would have shown, and that it was gone
The employee deleted the original phone recording after sending it. The surviving copy is the messaging application's recompressed derivative — lower resolution, changed codec and frame rate, altered creation time, GPS and device identifiers removed.
Examined the file's metadata for what it could and couldn't establish
The creation timestamp corresponded to the detective's download, not the recording. No reliable embedded GPS. The file did not identify the store, the security system, the camera number, the monitor, the recording device, or the original recording time.
Analyzed frame continuity
A discontinuity of roughly 1.4 seconds, which could have come from messaging-app processing, a pause during recording, a damaged file structure, editing, or variable-frame-rate conversion. The available copy does not permit distinguishing among those causes.
Assessed the visual reliability of the imagery
Angle, repeated automatic exposure changes, and screen refresh banding — the combination of which made clothing-color comparison unreliable as an identification method.
What the examination found
- The exhibit was a recording of a screen, not a surveillance export, and began after the event had started and ended before the person left
- The original phone file had been deleted; the surviving version was a messaging-app derivative
- The embedded creation timestamp reflected the detective's download, not the recording
- No reliable GPS or device identification survived
- A 1.4-second discontinuity existed with no way to attribute its cause from the available copy
- Color and timing could not be reliably interpreted for identification purposes
Outcome
A recording like this may still be authenticated through the employee's testimony — that they made it, recognized the monitor, and that it fairly represents what they observed. What it cannot bear is characterization as a native or complete surveillance recording, or an identification resting on color comparison.
Takeaways for counsel
- Ask how the file reached the investigator. If the answer includes a messaging application, the metadata you are looking at was rewritten in transit.
- A creation timestamp is only meaningful if you know which event created it. Download time and recording time are routinely confused.
- When the original device file is gone, testimony carries the authentication — which means the witness's memory, not the file, is what's being tested.
- Screen-filmed video is unsuitable for color-based identification. Exposure changes and refresh banding alter apparent color directly.
- Ask what the beginning and end of the clip omit. A 22-second excerpt of a longer event is defined as much by its edges as its content.
Services involved
Have a case that turns on digital evidence?
Tell us the case, the device, and your deadline. The scoping call is free, and we'll tell you honestly whether an examination is worth it.
Appointed counsel: see our Colorado public defender program.
More case studies
Deleted files in an employee-theft prosecution: what the artifacts proved, and what they couldn't
Deleted texts and edited screenshots: the one-hour timestamp error that moved a message before the order took effect
The video played at trial wasn't the video in discovery: PowerPoint, transcoding, and normalized audio
This case study is illustrative. It is written to show how digital evidence is examined, challenged, and presented in court; it is not an account of any client matter, and any resemblance to a specific case is unintended. The techniques and failure modes described are real. Nothing on this page is legal advice, and no result is a prediction or guarantee of the outcome of any other matter.