DV200 Digital Video Investigations with Magnet Witness

Digital Video Investigations with Magnet Witness (DV200) is a beginner-level course, designed for participants who are not yet familiar with the concepts of recovering and analyzing digital video files from commercial video recorders.

Description
After completing this three-day course, participants will have the knowledge and skills to analyze video from various sources using Magnet Witness, in addition to gaining a basic understanding of how digital video is created.
Students will learn the different ways to extract video evidence from DVR hard drives and load it into Witness for review, as well as use Witness to generate video files and reports for casework.

Course Requirements

None.

Course Objectives

MODULE 1: Course Introduction

The learning objectives, course scenario, and expected outcomes for the three days will be presented.
An overview of what each module will cover will also be given.

MODULE 2: Software Installation

Students will install and activate Magnet Witness and review the program's basic settings.
They will learn the importance of using different video players and will install several open-source players.

MODULE 3: Digital Image Fundamentals

This module focuses on how digital images are created.
The methods of capturing, transmitting, storing, and displaying image data will be discussed.
How different resolutions affect images and how infrared (IR) video alters image color will be learned.

MODULE 4: Understanding Codecs in Digital Video

Building on the previous fundamentals, this module focuses on digital video.
Various video attributes will be explained and demonstrated using Magnet Witness.
Students will understand how each attribute affects the final video quality.
They will also receive an introduction to compression methods and codecs, and their impact on video quality.

MODULE 5: Anatomy of a DVR

The types of DVR systems and their components will be reviewed.
Students will be able to distinguish between the different types of video recording devices and explain their differences.

MODULE 6: Working at the Scene

This module addresses best practices for investigating before arriving at a scene with a DVR and what to consider during the intervention.
What to document from the DVR interface and the different documentation methods will be covered.
Students will learn how to create a forensic image of a DVR hard drive and will be introduced to other potential sources of video evidence.

MODULE 7: Creating Cases in Magnet Witness

How to create a case in Witness will be taught and the different menu options will be reviewed.
The different sources of evidence will be discussed.
Students will perform hands-on exercises to create a case and add evidence in Witness.

MODULE 8: Video Review in Magnet Witness

Continuing the process from the previous module, this module shows how to use Witness to view video content.
Students will use different functions to analyze, tag, and mark videos for export.

MODULE 9: Export and Reports

How to export video data and generate reports from Witness will be explained.
Students will perform exercises to export videos and create reports.
The difference between a media container and a video stream will be analyzed.

MODULE 10: Working with Extracted Videos

This module is a discussion of considerations when performing enhancements or adjustments after video export.

MODULE 11: Viewing Basic Video Enhancements

An open-source non-linear editor will be presented.
Students will use the histogram function in KDEN Live to view common adjustments that help make video clearer or more legible.

Additional Information
Who should attend: Participants who are not familiar with the principles of computer forensics.
Prior preparation: None.
Program Level: Beginner.
Area of study: Software and computer applications.
Modality: Online group and in-person group.