The Color Data Your Videos Quietly Throw Away
Episode 2 of this series nailed down the vocabulary, pixels, sampling, frame rate. This one goes a level deeper into how color and tonal detail actually get digitized, how interlacing works and breaks, and then pivots into something genuinely useful for casework: the different categories of video a forensic examiner is likely to run into, from CCTV to bodycams to dashcams, and what makes each one behave differently as evidence.
Quantization and Bit Resolution
Sampling tells you where to measure. Quantization tells you how finely to measure it. Once a frame is spatially sampled into a grid of pixels, each pixel’s color or intensity still has to be represented as a specific numeric value, and quantization is the process of mapping the effectively infinite range of real-world intensity values down to a finite set of discrete levels.
Reduce the number of quantization levels and you lose detail. Reduce it enough and you get a specific, recognizable artifact: false contours, visible banding where there should be a smooth gradient, because the image no longer has enough distinct levels to represent one.
Bit depth is what determines how many quantization levels are available. A frame with n bits per pixel can represent 2^n distinct values.
• 1-bit, bitonal. Strictly black or white, 2 possible values.
• 8-bit, grayscale. 256 possible values.
• 24-bit, color. 16,777,216 possible values, the industry standard for RGB.
At 1 bit the cottage-lined street is reduced to stark black and white shapes, barely recognizable. At 8 bits the grayscale version recovers the full tonal range but no color. Only at 24 bits does the scene actually look like what a camera saw.
There’s a useful analogy for why this still matters even past the point of visible banding: dynamic range versus bit depth is like a staircase. More steps, more bits, means a smoother, more gradual climb between the darkest and brightest points in a scene. Fewer steps means bigger, more visible jumps, even if the top and bottom of the staircase are in the same place.
More About Color Frames
An RGB frame isn’t really one image, it’s three: a red channel, a green channel, and a blue channel, corresponding roughly to the three types of color receptors in the human eye. Split any color frame into its constituent channels and each one is its own grayscale image.
If the frame is 24-bit, the standard since roughly 2005, each of the three channels gets 8 bits, 256 brightness levels per channel. A 48-bit frame, a much higher color depth used in some professional and scientific applications, gives each channel a full 16 bits instead.
Progressive and Interlaced Sampling: Frames and Fields
Temporal sampling isn’t always a clean one-complete-frame-at-a-time process. A video signal can be sampled progressively, as a series of complete frames, or as a sequence of interlaced fields. In interlaced video, only half the data in a frame, one field, is captured at each sampling interval. A field is either the odd-numbered or even-numbered horizontal lines of a complete frame, and an interlaced video is really a continuous alternating sequence of top fields and bottom fields.
The advantage is data efficiency. It’s possible to transmit twice as many fields per second as the number of frames in an equivalent progressive sequence running at the same data rate, giving the appearance of smoother motion. A PAL sequence sends 50 fields per second, and played back that can look smoother than an equivalent 25 fps progressive sequence, despite using the same amount of data.
The disadvantage is the part that actually matters for forensic work: motion artifacts. If an object moves fast enough to be in meaningfully different positions between one field and the next, you get a visible combing or interlacing artifact where the two half-resolution fields don’t line up.
This isn’t a minor rendering glitch, it’s genuinely useful signal. A close crop on a moving vehicle wheel makes the pattern unmistakable, horizontal tearing that tracks directly with how fast the object was moving between fields.
Progressive video doesn’t have this problem, since the entire frame is captured and displayed at once rather than split across two time-offset fields. That makes combing artifacts themselves a useful forensic signal: they’re evidence that a source was interlaced in the first place, and the degree and direction of the combing can say something about the motion that produced it.
1080p and 1080i
This is where terms like 1080i, 1080p, 720p, and 480i actually come from. The integer is the spatial resolution, specifically the height of the frame in pixels. The suffix is the scanning method. ‘p’ means progressive, the entire frame displayed on screen at once. ‘i’ means interlaced, half the frame appearing first and the other half 1/60th of a second later.
A 1080p video is progressively scanned at 1920x1080. A 1080i video is also nominally 1920x1080, but it’s interlaced, meaning each of the even and odd fields that make it up only actually carries 1920x540 worth of information at any given instant. Same headline resolution, meaningfully different actual information content per captured instant.
Categorization of Digital Videos
From a forensics standpoint, the most useful ways to categorize digital video come down to two things: what kind of device recorded it, and what kind of scene it captured.
Both matter because each category comes with its own typical resolution, frame rate, compression behavior, and failure mode. Knowing which category you’re dealing with tells you what to expect, and what to be suspicious of if the footage doesn’t match that expectation.
Security and Surveillance Camera Videos
Surveillance cameras are genuinely everywhere now, convenience stores, malls, traffic intersections, transit systems, banks, ATMs, schools. The footage they generate often serves directly as proof an event occurred, an evidence repository for post-incident analysis in both criminal and civil cases.
CCTV and IP surveillance are the two dominant options. IP surveillance is essentially a digitized, networked version of CCTV. IP cameras, unlike analog CCTV cameras, can send and receive data over a computer network or the internet directly, at a real cost difference, IP systems are considerably more expensive to deploy.
An important distinction: the resolution at which a surveillance camera records footage isn’t necessarily the resolution it ends up stored at. Because most surveillance systems run 24/7, footage typically undergoes heavy compression to manage storage, and that compression is usually the primary cause of visual quality loss in recovered footage, not the original camera resolution.
Get Awais Ahmed’s stories in your inbox
Join Medium for free to get updates from this writer.
The storage medium has its own history. VCRs were the original recording method, fully analog. DVRs replaced them by the mid-1990s, converting analog CCTV to digital and enabling remote monitoring and faster search, eventually gaining Ethernet connectivity as network DVRs. Hybrid DVRs, supporting both analog CCTV and IP cameras at once, came after. Magnetic hard disks are still dominant today, though solid state storage is gaining ground and optical storage is fading out. For networked systems, NAS, SAN, and DAS are all in active use.
Frame rate is a deliberate choice, not a fixed property of the category, typically 1 to 30 FPS depending on the scene. There’s an inverse relationship between how fast objects move and how low a frame rate still looks acceptable, and there are industry guidelines for it:
• Casino tables: 30 FPS
• Cash counting / bank tellers: 12–15 FPS
• Vehicular traffic: 15 FPS
• Pedestrian traffic: 5 FPS
• Parking lots, overview scenes: 1–3 FPS
• Low-activity settings: 1 FPS
Recording frame rate and playback frame rate aren’t necessarily the same number either. Playback is bound by the display system, 29.97 FPS for NTSC and 25 FPS for PAL, regardless of what rate the footage was actually captured at.
Personal Camera Videos
If a surveillance camera doesn’t catch an event, there’s a good chance somebody’s phone did. Camera phones, camcorders, and standalone digital cameras carry a much wider range of recording preferences and user-dependent settings than surveillance footage does, because an individual is actively choosing how to shoot.
Phones can now offer anything from VGA up through 720p, 1080p, and 4K, with frame rates as high as 120 or 240 FPS for slow motion. Standalone camcorders typically record at 30 FPS by default, with an option to step up to 120 FPS or higher, and standard HD resolutions of 720p, 1080i, and 1080p (4K at 24 or 30 FPS for ultra HD models). Digital cameras cover a wide range, from as low as 256x256, largely obsolete now, up to full 1080p HD, at frame rates spanning 5–7 through 60 FPS.
Lighting performance is a genuine forensic variable. Camera phones generally offer an inferior video light compared to camcorders, which shows up directly as weaker low-light performance. Phones with a Xenon flash tend to outperform those with LED, and high-end phones with back-illuminated sensors handle low light meaningfully better.
User controls have also become increasingly granular across all three device types: focus, white balance/exposure, ISO, zoom, frame rate, storage resolution, compression type. That’s a lot of user-adjustable variables standing between what the scene actually looked like and what got recorded, worth keeping in mind when evaluating how representative a clip is.
Dashcam and In-Car Video
Police in-car video (ICV) systems are, functionally, CCTV: a dash-mounted camera paired with a wireless mic worn by the officer. Consumer dashcams work the same way, an onboard camera continuously recording the view through the windscreen or the cabin.
Older analog ICV systems recorded to VHS tape. Modern digital systems record HD video at 15, 24, or 30 FPS, storing compressed video with synchronized audio on hard disks or solid state drives. Dashcams have moved well past law enforcement use at this point, they’re a mainstream consumer electronic product now.
Sousveillance Videos
Sousveillance is the recording of an activity by a participant in that activity, typically through small wearable or portable personal technology. The term is a deliberate linguistic inversion: ‘surveillance’ comes from the French sur (over) and veiller (watch), the eye-in-the-sky watching from above. ‘Sousveillance,’ coined by Canadian researcher and inventor Steve Mann, uses the contrasting sous (below) instead, bringing the camera down to human level, either physically, mounted on a person rather than a building, or hierarchically, an ordinary participant doing the watching rather than an authority or institution.
That distinction, above versus at human level, ends up mattering forensically. Sousveillance footage carries a first-person, participant perspective that fixed surveillance cameras structurally can’t capture, but it also inherits all the user-dependent variability of personal camera video.
Bodycams
Bodycams, or body worn cameras, are small cameras worn on the body, predominantly by law enforcement, to record arrests and other public interactions or gather evidence at crime scenes. What makes them notable forensically is placement, mounted on the front of a shirt or on the head or shoulder, providing a genuine first-person perspective along with a relatively complete, continuous chain of evidence.
Body worn video is itself a form of closed-circuit television. The first generation of modern police bodycams was introduced around 2005 in the UK, and the current generation is substantially lighter and smaller. Modern bodycams offer 640x480, 848x480, 720p, and 1080p resolutions at 30 or 60 FPS.
Hidden and Spy Cameras
A hidden or spy camera is a still or video camera used to record people without their knowledge, either because it’s not visible to the subject or disguised as another object entirely. Use cases range from household surveillance (nanny cams) to commercial or industrial security. Modern spy cameras record at 320x240 up to 1920x1080, at 25 or 30 FPS.
They can be wired, connected by cable directly to a viewing or recording device, or wireless, transmitting the signal to a receiver within a limited radius. One note that applies across handheld devices, wearables, and dashcams alike: footage from all of them is prone to jitter, a byproduct of the shaky physical movement of whoever is carrying the camera. That jitter doesn’t show up in footage from cameras mounted on solid, motionless surfaces, which makes its presence or absence a quick, informal signal about how a piece of footage was likely captured.
Categories Based on the Type of Captured Scene
The second axis of categorization doesn’t care what recorded the video, it cares what the video shows.
• Static-scene vs. dynamic-scene. Depends on whether the recording device itself was moving. A stationary camera produces a static-scene video, a camera that pans or zooms produces a dynamic-scene video.
• Indoor-scene vs. outdoor-scene. Differ in lighting conditions, illumination and exposure variation, and scene complexity. A busy intersection and the inside of an ATM vestibule are about as different as video gets along this axis. Outdoor footage shows the effects of environmental conditions, a sunny day, a rainy or foggy day, a day with thunderstorms, in a way indoor footage mostly doesn’t.
• Day-time vs. night-time. Comes down to lighting. Day-time footage is visually clearer thanks to better illumination, night-time footage loses visual information to insufficient ambient light.
The last one is where things get genuinely interesting for low-light and night work specifically: RGB, grayscale, and infrared video. For enhanced night vision, infrared cameras are an option alongside standard RGB or grayscale cameras. Rather than capturing visible light, an infrared camera detects infrared energy, heat, and converts it into an electronic signal that gets processed into a thermal image.
The same scene captured with an RGB camera versus an infrared camera looks like two completely different pieces of evidence. The RGB version shows color, texture, identifiable clothing and detail under normal lighting. The infrared version strips all of that away and shows heat signatures instead, useful specifically because it doesn’t depend on ambient light at all.
Where This Series Goes From Here
With the vocabulary, the quality fundamentals, and now the camera and scene taxonomy all in place, the series has what it needs to move into the actual forensic techniques next: source camera identification, tamper detection, and the artifacts specific to each of these video categories.
If you’ve got questions on any of this, reach out at LinkedIn.
