Reviewing Footage When You Don't Know the Exact Time

Often nobody knows when something happened. A box is missing, a door is damaged, or a car has a new dent. Watching eight hours of video at normal speed takes eight hours. This guide shows a faster, careful method. Any operator can use it with SSMS timeline playback.

Step 1 — Build a time window from facts

A time window has a start and an end. The incident happened somewhere between them. Collect facts that fix the two ends.

• Last time seen: when was the item last seen in place, or the door last seen undamaged?
• First time noticed: when did someone first notice the problem?
• Shift logs: did a guard note anything on patrol?
• Visitor logs: who came in, and when?
• Receipts and records: a sale, a delivery note or a stock count often shows a time.

Ask people for times, and write down who said what. A window such as "between 10 pm and 6 am" is a good start.

Step 2 — Choose the best camera and a marker

Pick the camera with the clearest view of the place where the change happened. Then choose a marker. A marker is a fixed thing you can check quickly. Examples are the box on the shelf, the closed door, or the parked car.

At any moment, the marker shows one of two states: before (still fine) or after (changed). That simple question drives the whole method.

Step 3 — Halve the window

This is called the halving method. Each check cuts the window in half.

1. Go to the middle of your window on the timeline.
2. Look at the marker. Is it before or after?
3. If it is still before, the change happened later. Keep the second half.
4. If it is already after, the change happened earlier. Keep the first half.
5. Repeat with the new, smaller window.
6. Stop when the window is a few minutes long. Then play it at normal speed.

The table shows how fast an eight-hour window shrinks.

Seven quick checks turn eight hours into about four minutes. Then you watch those few minutes carefully.

Step 4 — Follow the path across cameras

Once you find the moment, note the person or vehicle involved. Then follow them.

1. Think about the route they must have taken, such as entrance, corridor, room.
2. Open the next camera on that route, around the same time.
3. Move a little earlier or later on the timeline until they appear.
4. Note the camera and the time. Then go to the next camera.
5. Do the same backwards, to see where they came from.

If the route crosses into another site, its cameras are in the same console. Check that the clocks agree before you compare times between cameras.

Step 5 — Keep notes as you go

Write a row for every check, even when you find nothing. "Nothing seen" is useful information too.

Work in pairs for long reviews

Long reviews are tiring, and tired eyes miss things. For reviews longer than about an hour, work with a colleague if you can. One person moves along the timeline. The other person watches and writes the notes. Swap jobs now and then.

When to stop and escalate

Stop and tell your supervisor when:

• you have found the moment and the people involved;
• the footage you need is missing, or the camera was offline;
• you cannot see the marker clearly, so before and after are unclear;
• the incident looks serious, for example theft, injury or damage that may involve the police.

For serious incidents, follow Incident response: preserving footage and chain of custody.

Note: automatic event or motion search is not among SSMS's confirmed capabilities. If you need it, ask Skyline to confirm in writing whether your deployment covers it.

Quick checklist

• I built a time window from facts, and noted who gave each time.
• I chose the clearest camera and a fixed marker.
• I halved the window until only a few minutes were left.
• I followed the person or vehicle across cameras, forwards and backwards.
• I wrote a note for every check, including "nothing seen".
• I asked a colleague to help with a long review.
• I told my supervisor when I found the moment, or hit a problem.