Evidence Lock

XProtect Corporate includes a function called ‘Evidence Lock’ that can protect important recordings from being deleted at the set retention time.

Using Evidence Lock

Evidence locks are created using the XProtect Smart Client. To create an evidence lock, select ‘Playback’ and select a time period to lock via the timeline, or enter the start/stop time manually, and then select the cameras in the view to include. Finally, click the ‘Evidence Lock’ control and select ’Create’.

Doing so will present the below dialog, where the evidence lock details can be set - including for how long to protect the recordings from being deleted by the normal retention time settings.

Note: Using the XProtect Management Client, the ‘Keep evidence lock for’ dropdown options can be configured to only present the user with the evidence lock retention times approved for the specific installation and/or user.

Once the evidence lock has been created, a status dialog is displayed showing which devices are included in the evidence and if the action has been successful.

The list of evidence locks in the system can be found by clicking the ‘Evidence lock list’ button in the XProtect Smart Client’s main window.

When an Evidence Lock is selected in the list, it is possible to directly play back or export the recordings. Furthermore, if the user has the security permissions for it, it is possible to edit parameters of the evidence lock and add or remove devices from the evidence lock

Finally, if the user has the security permissions for it, the evidence lock can be deleted. Deleting an evidence lock does not necessarily mean that the recordings are also deleted as this depends on whether the locked recordings are younger or older than the standard retention time set for the storage configuration on the recording server. If the locked recordings are older than the set retention time, the recordings will also be deleted when deleting the evidence lock.

In addition to viewing evidence locks using the XProtect Smart Client, the XProtect Management Client can be used to provide a more detailed overview of the evidence locks in the system. The XProtect Management Client cannot, however, manage the evidence locks in the system, only the XProtect Smart Client can be used for that.

Storage impact

When creating an evidence lock, the recordings in the media database for the selected devices are marked as protected by an evidence lock. This is done to let the recording server and media database process know how to handle and properly protect these recordings – even in a startup or offline scenario where the recording server might not be able to communicate with the management server.

To avoid tampering with possibly encrypted and signed media databases, as well as for performance reasons, an evidence lock will always lock and protect at least a single one-hour segment of the media database for each device – no matter how small the time span of the actual evidence lock may be.

If the selected time span for the evidence lock spans multiple one-hour segments in the media database, all segments it spans are locked and protected.

This means that every single evidence lock will protect more recordings than just the selected time span. For short sequences, like for instance an evidence lock covering a few minutes, this overhead may be quite large in terms of percentage. For longer sequences, like for instance an evidence lock spanning 24 hours, the overhead percentage will be much smaller.

If archiving is enabled, the recordings protected by the evidence lock will be moved to the next archive just as all other recordings, however they are archived without reducing the framerate – even when ‘Reduce frame rate’ has been enabled for the archive.

In case the final storage location in a storage definition becomes full of recordings protected by evidence locks, the recordings in the previous storage location are deleted rather than archived to make room for new recordings.

If all storage locations in the entire storage definition become full of recordings protected by evidence locks, the recording of new media will stop completely.

To get recording started again, some evidence locks must be deleted, or more disk space added.

Furthermore, to prevent this situation from happening, it is recommended not to protect recordings indefinitely – or at least ensure this option is used with great care and focus on disk space usage. An alternative to protecting recorded media forever by using evidence lock, is to export them to external storage for safe keeping.

Regardless of evidence lock retention settings, it is recommended to use the various disk space and archive events to trigger alarms and/or email notifications should the disk space become low.

Note: Evidence Lock is only available in XProtect Corporate.