Something Happened. What to Do With Your Footage in the First 24 Hours.

Your oldest footage is being overwritten while you read this. In the first hours after an incident the instinct is to review the video. That is the wrong first move, and it is the one that costs people the clip they needed.

A recording system is a rolling window. It holds a certain number of days and then it begins writing over the oldest material, continuously, without asking anybody. On the day something happens, that quiet process becomes the most important fact about your building, because the clock started before you knew there was a clock.

What I see repeatedly is an organization spending the first day reviewing footage on the recorder, discussing it, showing it to people, and getting authorization to act. Meanwhile nothing has been exported. By the time somebody thinks to preserve it, the beginning of the sequence, the part showing how somebody got in, has already gone.

Preserve first. Review second. Everything below follows from that.

01 The clock you are already on

Understand the mechanism, because it changes what you do first. Your recorder is not storing footage indefinitely and then deleting it on a schedule somebody set. It is writing continuously into a fixed amount of storage, and when that storage is full it begins overwriting the oldest material to make room for the newest.

Which means the loss is not a future event you can plan around. It is happening at this moment, from the far end of the window inward, at exactly the same rate the cameras are recording. Every hour you spend deciding what to do is an hour of the oldest footage gone permanently.

That matters more than it first appears, because the oldest footage is frequently the most valuable. The incident itself is usually the part somebody noticed and can date. The reconnaissance, the earlier visit, the pattern of somebody being where they should not have been three weeks ago, all of that sits at the vulnerable end of the window.

So the correct sequence is preserve, then review, then act. Not review, then decide, then preserve. Reviewing on the recorder feels productive and costs you nothing visible, which is exactly why it is the default and exactly why it does damage.

02 Find out how long you actually have

Almost nobody knows their real retention figure. They know the number they were told at installation, which was calculated for a system that has since had cameras added, settings changed, and in some cases a drive fail without anybody noticing.

Check it directly on the recorder rather than from memory. And check it per camera, because retention is rarely uniform. A camera recording at higher resolution or a higher frame rate consumes storage faster and will roll off sooner than the others. On many systems the entrance camera, the one you most want, is also the highest quality one and therefore the shortest lived.

Two other things change the number in ways people do not expect. Cameras set to record only on motion will hold far more calendar days than continuously recording ones, but they will also have gaps, and the gaps are precisely where a still, patient person does not trigger anything. And a failed or failing drive in a multi-drive recorder can silently reduce capacity while the system continues to appear healthy.

If you cannot answer this question today, that is the finding. Answer it now, while nothing is happening, and write the number somewhere the person who will need it can find it.

03 Locate the event, do not hunt for it

Scrubbing manually through footage looking for a moment you cannot date is the slowest possible approach, and it is what most people do because it is the only tool they think they have.

You almost certainly have better ones. Access control logs will tell you when a door opened and which credential opened it. Intrusion panel history will tell you when the system was armed, disarmed, and by which user code. A point of sale system, a time clock, a gate controller, a visitor log, a delivery record: each of those is a timestamped index into your video.

Work from the data to the video rather than the reverse. If a rear door opened at 02:14 and no credential was presented, you now have a timestamp and a camera. That is a two minute exercise instead of a two day one.

This is also, incidentally, the practical argument for integration that no product brochure manages to make. Systems that share a timeline turn an investigation into a query. Systems that do not turn it into an archaeology project, conducted against a clock that is actively destroying the site.

04 Widen the window before you narrow it

When you export, be far more generous than feels sensible. This is the single most common mistake and the one people regret most.

The instinct is to export the ninety seconds containing the event, because that is what happened. But what makes footage useful is rarely the event itself. It is the approach: the vehicle that circled the lot twice an hour earlier, the person who walked past the door three times before trying it, the same face on a different day. It is also the departure, the direction of travel, the vehicle leaving.

So export hours on either side, not minutes. Export from every camera that could conceivably have seen any part of the sequence, including ones pointed at areas that seem unrelated, and including exterior and parking cameras. Storage is inexpensive and a second export attempt may not be possible.

Then, separately, consider whether to preserve a longer period from a small number of key cameras. If there is any possibility this was not a first occurrence, the previous weeks matter and they are the part rolling off first.

05 Exporting so the file is usable later

An export that nobody else can open is not a preserved recording. It is a file.

Most recorders offer a choice between their own native format and a common video format. The native export usually carries more information, including embedded timestamps and camera identification, and it is often the version an examiner would prefer. It also frequently requires the manufacturer's player, which means whoever receives it needs that software. Many systems will export the player alongside the file, and if yours does, include it.

The common format is easier to open and easier to circulate, which is both its advantage and its risk. Re-encoding can lose detail, and it may strip the metadata that makes the footage verifiable. The practical answer is usually to export both: the native version for preservation, a common format for everyday viewing.

Then do the thing almost nobody does. Open the export on a different computer, one without the recorder software installed, and confirm it plays. Check the timestamp is visible and correct. An export that failed silently looks identical to one that worked until the moment somebody needs it.

06 Preserve the original, work from copies

Once you have a good export, treat it as untouchable.

Put it somewhere that is not the recorder, because the recorder is the one device guaranteed to be overwriting things. Put it in more than one place. Then make a separate working copy and do all reviewing, trimming, clipping, and sharing from that. The original export should never be edited, renamed in a way that loses information, or converted.

Do not delete anything, including material that appears irrelevant. What looks irrelevant on day one has a habit of becoming central on day forty, when somebody asks a question nobody had thought of. If storage is the constraint, buy a drive. It is the cheapest item in this entire situation.

Restrict who has the original. Not out of suspicion, but because a file that has been copied to six people's desktops and back has a history nobody can describe, and describing its history may turn out to matter.

07 Write down who did what

Keep a simple contemporaneous record of the handling. Not a formal document, just notes made at the time rather than reconstructed afterward.

What is worth capturing: who performed the export and when, which system and which cameras it came from, what period it covers, where the original is stored, who has been given a copy and when, and who has viewed it. A page of notes is sufficient. The value is entirely in it being written while it happened.

Be clear about what this is and is not. Formal chain of custody, in the sense that matters in a legal proceeding, has requirements that come from law enforcement and from your counsel, and they vary by the nature of the matter. I am not the person to define them for you and this article is not the place. What I am saying is that a contemporaneous handling record costs you ten minutes and its absence cannot be fixed later.

If there is any prospect of a legal proceeding, ask that question early rather than late. The handling decisions that matter get made in the first hours, by whoever is closest to the recorder, usually without knowing that they are decisions at all.

08 What law enforcement usually needs

If police are involved, ask them what they want before you produce anything further. Requirements differ between agencies and between the kinds of matter involved, and a five minute conversation prevents you exporting the wrong thing twice.

Some things come up consistently enough to be worth anticipating. Native format exports are frequently preferred over re-encoded ones. Investigators generally want more surrounding footage rather than less, which reinforces chapter four. And in some circumstances they may want access to the recorder itself rather than a copy, so do not do anything drastic to the system before asking.

Then there is the item that undermines everything else if it is wrong, and which almost nobody checks: the recorder clock. If your recorder's time is off by eleven minutes, then every timestamp on every export is off by eleven minutes, and reconciling your footage against a phone record, a transaction, an access log, or a witness account becomes an argument rather than a corroboration.

Check the recorder clock against a reliable time source right now, and note the difference if there is one. If it is wrong, document the discrepancy rather than silently correcting it, because the exports you have already made carry the old time.

09 Insurers, counsel, and internal matters

Different audiences want different things from the same footage, and a couple of them carry considerations that are easy to walk into.

Insurers generally want the event, its context, and evidence about conditions rather than identification. For a slip and fall, the hour beforehand showing the floor, the signage, and the traffic is often more useful than the fall itself. Notify them promptly, because policies commonly carry notification requirements and preserved footage is worth more when it arrives early.

Where the matter involves an employee, stop and involve HR and counsel before the review goes any further. Reviewing footage of a named employee for a disciplinary purpose is a different activity from reviewing footage of an unknown intruder, and it engages workplace privacy considerations and, in New York, notice requirements around electronic monitoring of employees. Have somebody qualified tell you what is permitted under your own policies and applicable law before anybody watches, rather than afterward.

In every case, restrict internal circulation. Footage of an incident tends to travel through an organization quickly because it is interesting, and each additional copy makes the handling record harder to describe and raises the chance of it reaching somebody it should not.

10 What to fix before the next one

An incident is an expensive audit of a system nobody had tested. Do not waste the findings.

Whatever went badly, write it down while it is fresh. Common ones: the retention window was shorter than anybody believed. The camera covering the entrance was backlit at that hour and produced a silhouette. Nobody knew how to export. The export would not play. The clock was wrong. The parking area was not covered at all. Only one person had recorder access and they were on holiday.

Then fix the cheapest ones immediately, because most of them cost nothing. Write down the retention figure. Train a second person to export. Test an export end to end. Check the clock and whatever synchronizes it. Name who is allowed to view footage. None of that requires a purchase.

The expensive findings are usually about placement, and they are worth taking seriously because they will repeat. A camera that produced unusable footage once will produce unusable footage every time, in the same conditions, until the position or the equipment changes. That is a design conversation, and the useful thing about having it after an incident is that you now know exactly which shot you needed.

Best of all, run the whole procedure once as a drill when nothing has happened. Pick a random door and a random hour last month, and have somebody produce a verified, playable export with a correct timestamp. If that takes an afternoon and three phone calls, you have learned something valuable at no cost.

Nineteen items, and the first one carries most of the weight. Preserve, then review. Everything else is easier to fix afterward than the footage is to recover.