Forensic Digital Analysis For CCTV Video Recording

The background of this research is how to make a video that can be analyzed as forensic data to prove the truth of the video, therefore with forensics it can be used as evidence if the video contains incorrect data or contains data capable of crime so that it can be used as data forensics. The method used in this study is to use the literature review method which uses the basis of many previous studies. From journals and books based on similar research, so that it can help develop existing problems to the latest problems so that they can find novelty in this research. The problem raised in this research is how to make a video from a CCTV that can be proven, by certain methods in order to make the video as forensic data, that can be proven so that it can be developed into data containing crimes that can be used as evidence. The purpose of this study is how to find the right method in order to analyze a CCTV video, so that it can be used as evidence on forensic data with the NIST method, it can be proven that this method is the right method in analyzing a video, so that it can be used as evidence and as data forensics.

recording file that provides information in the form of data or commonly known as metadata, where metadata can be recorded on a computer automatically when a file is created, so it can be known when the file was created. Who the author is, what is the file size, and also the extension. Metadata information functions to store, maintain, and manage sources in order to maintain the integrity and integrity of files obtained from CCTV (Closed Circuit Television) cameras [4].In addition to metadata in handling CCTV (Closed Circuit Television) camera digital evidence, there is an essential thing called Chain of Custody. Chain of custody is an effort to maintain and ensure integrity in digital evidence and procedures for documenting evidence chronologically since it was first found at the crime scene (TKP) to explain 5 characteristics (4W and 1 H) of Chain of Custody, namely fingerprint of evidences (why) , digital signing (who), time stamping (when), geo location (where) and procedures (how). The problem to be developed from this journal is the analysis of the application of Digital Forensic Analysis of CCTV (Closed Circuit Television) Camera Recordings Using the NIST (National Institute of Standards Technology) Method. As for the previous method metadata and hash [5].

II. THEORETICAL BASIS
In his book entitled Computer Security Systems, defines Computer Forensics as a science that discusses findings in the form of digital evidence after events related to computer security occur. Digital Forensics can be said to be the application of science to recover digital evidence from a device, be it a computer or smartphone, with certain methods that aim to collect data that can be accepted by the court as one of the evidences. Professional Computer Ethics defines that Cyber Crime is one of the negative impacts of technological developments that cause extensive losses for all modern life today [6].The variable of this development is the NIST method for CCTV (Closed Circuit Television) video recording. Institute of Standards and Technology (NIST). NIST is a method that has four stages in resolving and investigating Cyber Crime cases, the first stage is Collection (Data collection), Examination (Examination of evidence), Analysis, and the last is Reporting (Creating reports based on analysis results) [7].

III. METHODS
In the old research, it was a hacking method, the research method would be acquired based on the guidelines and requirements in the Indonesian National Standard (SNI). Several previous studies have used acquisition procedures in accordance with SNI 27037:2014 with the NIST (National Institute of Standards Technology) investigation process method used to analyze the metadata of CCTV (Closed Circuit Television) camera recordings as digital evidence. Figure 1 is the stage of inspection and analysis that will be carried out.The NIST process which consists of several stages, namely the collection (labeling) stage or the collection stage is a series of activities to collect data to support the investigation process in the context of searching for evidence of digital crimes.
At this stage there is a process of collecting data from relevant data sources and maintaining the integrity of evidence from changes, examination (data processing) or this inspection stage is the stage of examining data collected forensically, either automatically or manually, and ensuring that the data obtained in the form of the original file according to what was obtained at the scene, for that digital files need to be identified and validated with hashing techniques, in this examination process testing is carried out using forensic tools, namely Media Info and exif tools used to find camera metadata information CCTV (Closed Circuit Television). Furthermore, the analysis stage (analysis of examination results) or the research stage is carried out after obtaining the desired digital file or data from the previous examination process, then the data is analyzed in detail and comprehensively with methods that are technically and legally justified to be able to prove the data. The results of the analysis of digital data are hereinafter referred to as being used as digital evidence and can be justified scientifically and legally, as valid evidence.

IV. RESULT AND DISCUSSION
The NIST process which consists of several stages, namely the collection (labeling) stage or the collection stage is a series of activities to collect data to support the investigation process in the context of searching for evidence of digital crimes. At this stage there is a process of collecting data from relevant data sources and maintaining the integrity of evidence from changes, examination (data processing) or this inspection stage is the stage of examining data collected forensically, either automatically or manually, and ensuring that the data obtained in the form of the original file in accordance with what was obtained at the scene, for that digital files need to be identified and validated with hashing techniques, in this examination process testing is carried out using forensic tools, namely MediaInfo and Exif tools used to find metadata information on CCTV (Closed Circuit Television) cameras.Furthermore, the analysis stage (analysis of examination results) or the research stage is carried out after obtaining the desired digital file or data from the previous examination process, then the data is analyzed in detail and comprehensively with methods that are technically and legally justified to be able to prove the data. The results of the analysis of digital data are hereinafter referred to as being used as digital evidence and can be justified scientifically and legally as valid evidence.
The NIST process which consists of several stages, namely the collection (labeling) stage or the collection stage is a series of activities to collect data to support the investigation process in the context of searching for evidence of digital crimes. At this stage there is a process of collecting data from relevant data sources and maintaining the integrity of evidence from changes, examination (data processing) or this inspection stage is the stage of examining data collected forensically, either automatically or manually, and ensuring that the data obtained in the form of the original file in accordance with what was obtained at the scene, for that digital files need to be identified and validated with hashing techniques, in this examination process testing is carried out using forensic tools, namely MediaInfo and Exif tools used to find metadata information on CCTV (Closed Circuit Television) cameras . Furthermore, the analysis stage (analysis of examination results) or the research stage is carried out after obtaining the desired digital file or data from the previous examination process, then the data is analyzed in detail and comprehensively with methods that are technically and legally justified to be able to prove the data. The results of the analysis of digital data are hereinafter referred to as being used as digital evidence and can be justified scientifically and legally. as valid evidence.After identifying and labeling the evidence the main thing is to hash it. Where hasing is done to maintain data integrity from data originating from digital evidence. Hashing in this section is an algorithm technique used in the data section to create a unique data set with fixed variable length conditions. Flowchart Hash The picture 2 shows the hashing results from digital evidence of CCTV (Closed Circuit Television) camera recordings obtained with files with the extension MD5 (Message Digest algorithm 5) with a length of 32 characters.Next is the examination process which is the stage of testing and processing data collected using forensic tools from MediaInfo and ExifToll. This stage can be seen in Figure 4 with the process of acquiring physical evidence from CCTV (Closed Circuit Television) cameras to obtain video recording files which will then be tested on digital evidence. Enlarge image 3, it will be given an explanation that there is an actor in a use case diagram, namely there is a use case diagram of physical imaging, use case diagram collection, examination use case diagram, use case diagram analysis and the last is use case diagram reporting, the following system is describing how to do this, identification of data in the forensic analysis of a video.  Figure 4 above, there is an activity diagram that describes how the process has been able to identify data on a CCTV (Closed Circuit Television) video. The explanation is as follows, the system starts with a start method on the activity diagram, then the system starts asking for files to be inputted after that the system gives a choice between yes. Further or calculating the HASH system after that it will produce Expedia output which contains the results of the video extracted by the HASH.

V. CONCLUSION
The development of this research is an attempt to obtain digital evidence of CCTV (Closed Circuit Television) camera recordings that are applied using the NIST (National Institute of Standards Technology) method for forensic digital investigations related to CCTV (Closed Circuit Television) camera recordings in order to obtain file metadata information to be implemented and to process a source of information to be used as a source of information. as evidence that is implemented using the Chain of Custody document so that the integrity of digital evidence is maintained intact from the beginning it is found to the analysis of the information contained in the CCTV (Closed Circuit Television) camera, thus information on evidence obtained from CCTV (Closed Circuit Television) camera recordings can be accepted and used to strengthen evidence in the judge.