“Save the video” leaves important questions unanswered. Which camera, what time period, whose system, and who confirms that the request was carried out? A property manager needs a request that an authorized operator can execute and a record that distinguishes a sent request from preserved material.
This guide concerns administrative coordination for a system your organization is authorized to use. It is not an instruction to access someone else's recorder, alter evidence or conduct a forensic investigation. For an active emergency, follow the response plan first. Use the broader incident-record handoff playbook to connect the request to the rest of the incident package.
Define the location before choosing a camera
Describe the observed location using the building's normal naming scheme: entrance, vestibule, desk, corridor or loading area. Include the direction of travel only when it was actually observed. Let the authorized camera operator identify the relevant views; the reporting officer should not invent camera numbers from memory.
Ask whether the proposed views cover the relevant area and whether there are known gaps. If the incident was reported rather than witnessed, say so. A request can explain uncertainty without guessing what a recording will show. The purpose is to preserve potentially relevant material for authorized review, not to establish guilt from an initial complaint.
State the time basis and uncertainty
Record the date, local time zone, approximate event window and source of that estimate. A guest's recollection, a desk log and a recorder display may not use the same clock. Keep the reported event time separate from the time the request was made.
Request enough context for the designated reviewer to assess the event, according to the property's procedure and the known circumstances. Do not prescribe a universal number of minutes. If the operator discovers an apparent clock offset, have that fact documented through the approved process rather than changing the recorder clock during preservation.
Send a request that has an owner
A practical request form can include:
- Incident reference, requester and authorized manager.
- Location and relevant views, confirmed or still to be identified.
- Event window and its source, with uncertainty clearly labeled.
- System custodian and approved contact channel.
- Preservation action requested and any known overwrite concern.
- Requested acknowledgment and escalation contact.
Ask the custodian to confirm what can be preserved and any limitations. Do not assume a standard retention period across recorders, cloud services or buildings. Avoid changing settings or interrupting recording as an improvised solution. If the requested material is unavailable, record the custodian's explanation and the time checked.
The NIST forensic-response guide treats digital forensics as a specialized organizational process and recommends management and legal consultation. It does not define a NYC CCTV retention rule. Technical extraction and integrity verification should be performed by appropriately authorized, competent personnel using the relevant system procedure.
Confirm the deliverable without replacing the original
The authorized recipient should check that the delivered package corresponds to the request: correct incident, stated views, time range, filenames, and any required playback instructions. An unreadable file is an unresolved delivery issue. Record the problem and ask the custodian to correct it through the approved channel; do not represent an untested attachment as usable footage.
A phone recording of a monitor is not interchangeable with a system export. A shortened clip, still image or annotated copy should be labeled as a derivative, with a reference to its source. Keep the original material under the custodian's controls and follow preservation instructions. Use the transfer register for the package and the chronology guide when recorder and desk times differ.
Close the request with a specific status
Choose a clear outcome: acknowledged and awaiting export, delivered and checked, partially available, unavailable, or escalated. Name the person responsible for the next action. Do not close a request simply because an email was sent.
Before an actual incident, test the contact route with a fictional request that does not export real footage. Confirm after-hours ownership, who may authorize release, and how technical failures are reported. That rehearsal can reveal a missing custodian without distributing anyone's personal information.