Best Practices for Creating Incident Video Clips

A defensible incident video clip is one a recipient can actually open, that preserves the original timestamps and frame data, and that comes with a documented record of who created it and from what source. Most of the technical pitfalls in producing one come down to format choices, trim conventions, and timestamp handling — covered below, with the specifics security operators actually run into. If you're new to the broader workflow, start with our practical guide to incident video management.

1. Know your recipient before you export

Different recipients need different things from the same source footage:

| Recipient | Typical needs | | --- | --- | | Local police, patrol officers | Plays on a phone or in-car tablet. MP4 / H.264, under ~500 MB, no proprietary player. | | Detective bureaus, prosecutors | Original quality where possible, original timestamps preserved, chain of custody record. | | Insurance adjusters | Clear view of the incident plus 30–60 s of context on each side. Often want still frames too. | | Property managers, tenants | Trimmed to the moment of interest. Often shared via a branded portal. | | The customer themselves | Either of the above, depending on what they're doing with it. |

Confirm the intended use before you export. A clip exported for an officer in the field is not the same clip you'd hand to a prosecutor, even though they come from the same source.

2. Use a portable container and codec

The single biggest source of "I can't open this file" tickets is proprietary export formats:

• Prefer: MP4 container, H.264 (AVC) video. Plays on every phone, tablet, and browser. H.265 (HEVC) is better for storage but has playback compatibility gaps — especially on older Windows machines and some browsers.
• Avoid sending: .dav (Dahua), .cam (Lorex / some Hikvision), .bsf, .exe-wrapped self-playing exports, or proprietary player ZIPs. Convert these to MP4 first.
• Audio: Strip it unless you're sure it's needed and legal in your jurisdiction. Audio recording rules vary by state; consult counsel rather than guessing.

3. Keep the original; deliver a derivative

Operators sometimes export, trim, transcode, and overwrite the source — leaving no original to fall back on if the trim was wrong or a longer window is requested.

Treat the original VMS export as the source of truth and always work from a copy:

• Store the unedited export with its filename intact (camera ID, date, time range).
• Derivatives (trimmed clips, stills, transcodes) reference the original by ID, not by re-export.
• If you need a different trim later, derive it from the original — not from a previous derivative.

4. Include context on both sides of the incident

A common mistake is trimming so tightly that the incident appears without explanation:

• Pre-incident: 30–60 seconds of normal conditions. Establishes the scene and rules out edits.
• The incident itself: the entire event, without internal cuts. Do not cut even brief pauses.
• Post-incident: the immediate aftermath — response, departure, anything law enforcement might ask about next.

If you can, include the entire clip and let the recipient seek to the moment, rather than trimming aggressively. Storage and bandwidth are cheap relative to the cost of a re-request.

5. Preserve original timestamps

Timestamps are the single piece of metadata that turns a clip from "footage" into "evidence":

• Embedded burn-in: if your VMS supports burning the timestamp into the frame, leave it on. Officers in the field don't have time to read EXIF or container metadata.
• Time-zone: record what time zone the camera is set to. Most systems run on local time but some integrators set everything to UTC.
• Drift: if a camera's clock has drifted (NTP misconfigured, replaced battery), note the actual time vs. recorded time when you deliver the clip.

6. Create still frames from the clip, not separately

When a recipient asks for a still — for an insurance form, a BOLO, or a print exhibit — grab it from the same source clip you're delivering, not from a separate VMS pull. This keeps the still and the video derivable from the same chain.

Practical details:

• Export the highest-resolution single frame your source supports.
• Include the timestamp in the filename and ideally in a visible burn-in on the image.
• Avoid de-noising, sharpening, or any "enhancement." Anything that alters pixels can be challenged.
• Hand over the original frame alongside any annotated version, never instead of it.

7. Package related artifacts together

A clip is rarely the entire deliverable. A complete incident package typically includes:

• The trimmed clip (MP4, streaming-friendly).
• Any relevant still frames at original resolution.
• A short description of the incident, time range, and the camera(s) covered.
• A reference to the original VMS export(s) the package was derived from.
• An access log produced automatically by the system you used to share it.

8. Avoid the common mistakes

A short checklist of things we see most often:

• Sending the proprietary player. The recipient does not want to run a .exe from an email.
• Over-trimming. The clip starts with the incident already in progress and ends before the aftermath.
• Mixing original and edited files in the same folder. Forces the recipient to guess which one to use.
• Re-exporting from the VMS for every variant. Slow, and produces multiple "originals" that diverge over time.
• Forgetting the time zone. A 02:14 timestamp means very different things depending on what zone the camera was set to.
• Sharing with "anyone with the link" permissions. Investigative footage shouldn't outlive the investigation.

Where Incident Clips fits

Incident Clips handles the workflow above as a single product: ingest the original export, derive clips and stills inside the tool, package them with a description, and share via a branded portal with an access code and a built-in audit log. See pricing or contact us for a walkthrough.