Magnet Witness – Training Session Notes
Introduction to Magnet Witness
Purpose-built tool from Magnet Forensics for mass CCTV/DVR footage viewing & triage.
Strengths:
Decodes many proprietary DVR/CCTV formats (including non-standard “hidden” MP4 variants).
Works directly with physical DVR drives, E01 images, loose video files, cloud-camera accounts.
Emphasis from product team: no official, exhaustive “supported device list” – investigators are encouraged to try unsupported formats.
Designed as a simplified review environment (fewer options than Magnet REVIEW/REFINE; focuses on ingest, browse, basic analytics & output).
Common law-enforcement challenges solved:
Multiple proprietary systems seized in one case.
Need to sift through "thousands of hours" efficiently.
Producing court-ready, standard-codec exports without native players.
Licensing & Installation
Windows installer (forensic workstation recommended).
Two licensing modes:
Dongle (most customers) – activate via Magnet License Manager.
License key (trial) – paste key inside Witness ➜ Help > Manage Licenses.
Typical Use Cases
Large-scale surveillance review in major incidents.
Quick acquisition/preview of DVR disks when native player unavailable.
Rapid production of stitched "movement story" videos for court.
Supported Acquisition Sources
Physical DVR drive (through hardware write-blocker).
E01 / Raw / DD image import.
Folder / individual file import (standard or proprietary containers).
Cloud cameras (Arlo, Ring, Blink, Wyze): requires username + password and MFA token if enabled.
Creating a Case
Launch Witness ➜ "Create New Case".
Required field: Case Name (all other metadata optional but recommended).
Optional Incident Details (name, date, time-zone, notes).
Add Evidence Sources:
Physical drive → select target → (Advanced Config only with Tech Support guidance; set custom Start Sector if required).
Image file (E01) → Witness auto-detects file-system & proprietary container; shows validation status.
Folder/File list → Witness enumerates contained clips.
Cloud cameras → supply creds/token.
Configure Scan Type:
Standard vs Carve Deleted/Inaccessible (slower; expect overnight for 10 GB+).
Channel filter (e.g.
only 1 & 2 of 4).Time-range filter (e.g. Yesterday 12:00 → Today 08:00).
Post-Scan Jobs (optional):
Auto-export report (PDF/XLSX) & re-encoded videos.
Generate thumbnails.
Run analytics (Person / Vehicle detection) with confidence slider (Low = more false-positives, High = fewer).
Finish ➜ processing queue begins; progress visible top-right.
Processing & Scan Considerations
Witness extracts every frame → large jobs take time; night-long processing common.
Carve & Analytics add substantial overhead; consider running analytics after manual triage on selected clips.
Basic Analytics Engine
Two models: Person & Vehicle.
Output: Flags clip-level presence; does NOT draw bounding boxes or timestamps.
Confidence slider: Low / Medium / High.
Can be invoked per-clip via right-click ➜ Perform Analytics.
Main Interface Overview
Clip List (center): all ingested videos & sub-clips.
Case Explorer (left): Case, Evidence Sources, Channels, Reports, Playlists.
Details Pane (right): Tags, Notes, Properties.
Column tips:
Start Date/Time (raw metadata).
Adjusted Date/Time (after offset applied).
Tags, Bookmarks, Notes indicators.
Review & Navigation Features
Double-click clip ➜ media viewer:
Standard playback bar, speed control, timestamp display.
Mark-In / Mark-Out ➜ create Bookmark (optionally auto-generate Sub-Clip).
Save Selected Frame → exports still to \Exports with MD5.
Gallery Preview: View clip as contact-sheet.
Interval choices: every i-frame (~60 frames), N frames, 5-min, 9,000 frames, etc.
Allows rapid eyeballing when analytics only says “Person detected”.
Export gallery directly to PDF report.
Multi-Clip Preview:
Select up to 4 clips ➜ right-click ➜ Multi-Clip.
Synchronous playback across cameras to trace suspect movement.
Tagging, Notes & Collaboration
Tags: quick labels; multiple allowed per clip (e.g. "Of Interest", "Suspect", "EntryDoor").
Notes: free-text comments timestamped per user; visible via right-hand pane; filterable (has Notes = True).
Current limitation: tags & notes are separate; no “template note per tag” feature (submitted to Product Team as request).
Filtering:
Right-pane drop-downs for Tags.
Top filter bar: date, channel, notes, person/vehicle analytics, etc.
Playlists
Curated list of clips or sub-clips (e.g. "For Court").
Right-click selected clips ➜ Add to Playlist ➜ new or existing.
Playlists support Concatenate action.
Concatenate (Video Stitching)
Found only inside Playlist view.
Steps:
Select desired order ➜ Concatenate.
Choose output container (MP4/AVI); encoder (CPU or NVIDIA GPU).
Quality slider (Low ↔ High) & Resolution (Original/Highest).
Optionally export accompanying report (PDF/XLSX) & hashes.
Result: single standard-codec video (court-ready) + report & MD5/SHA.
Exporting & Reporting
Manual Export Dialog (camera icon):
Export selected or all footage.
Re-encode proprietary to open formats: MP4, MOV, AVI.
Generate Report (PDF or Excel).
Include: Thumbnails, Tags, Bookmarks, Hashes (MD5/SHA-1/SHA-256).
Tools > Generate Reports: create report without re-exporting video; allows custom logo.*
Branding:
PDF: default Magnet footer; can change top-left logo but footer remains.
Excel: fully editable; agencies often sanitize branding & convert to PDF themselves.
Time Offset Correction
Essential when DVR time mis-configured (common in small businesses).
Options:
Calculated Offset (enter actual vs DVR delta).
Explicit Offset (Ahead/Behind; days + hh:mm:ss.ms fields).
Apply to:
All clips, selected clips, or per-evidence source.
Formula displayed: (\text{Adjusted Time} = \text{Original Time} + \text{Offset})
Frame Math & Rounding
Bookmark editor shows Frame ID & millisecond precision.
Investigators can "round" in/out points by altering frame numbers or ms values to zeroes for neat timing.
Best-Practice Workflow (suggested)
Install & license Witness.
Create Case ➜ ingest E01/DVR drive with carve disabled for speed.
Tri-age via Clip List + Gallery Preview to locate relevant segments.
Apply analytics only on narrowed clips.
Bookmark critical moments; create sub-clips.
Tag & write Notes for shift hand-over.
Assemble Playlist ➜ Concatenate for story video.
Export open-format videos + Excel report; replace logo; lock to PDF for court.
Optionally re-run case with Carve Deleted overnight for completeness.
Limitations & Known Gaps
No frame-level bounding boxes from analytics.
No built-in search by text (e.g. license plates).
Tag ↔ Note linkage not yet implemented.
Processing speed can be slow on large proprietary files (tens of GB ⇒ overnight).
PDF branding footer non-removable; use Excel export for unbranded.
Feature Requests Mentioned
Auto-attach default note when applying certain tag categories for multi-shift continuity.
Option to hide Magnet branding entirely.
Practical & Ethical Considerations
Always use write-blocker on physical DVR drives.
Maintain chain-of-custody: store original E01 & Witness export hashes in case folder.
Respect privacy: only extract channels/time-ranges relevant to warrant.
Multi-factor cloud extractions require legal authority + user credentials.
Connections to Other Magnet Products
Witness ≈ "front-line triage & viewing"; Magnet REFINE/AXIOM Video provide deeper media forensics (object detection, hashing, tamper analysis).
Workflow: Witness (quick browse) ➜ export clips ➜ feed into REFINE for advanced analytics if needed.
Quick Reference Shortcuts & UI Pointers
Right-click clip: Perform Analytics, Gallery Preview, Multi-Clip, Tag, Note.
Bottom-right status ➜ shows active/completed jobs.
Column chooser (gear icon) ➜ add Notes, Offset Time columns.