Security cameras are excellent at recording and terrible at retrieval. The moment you actually need one, you discover that "we have footage" and "we can find the incident" are completely different things — and the gap between them is measured in hours of your evening.
This is a practical workflow, in the order you should do it. Step one matters most, and most people skip it.
Security systems overwrite oldest footage first. Typical retention is 7–30 days on a local drive and as little as 1–3 days on free cloud tiers. If the event might be near the edge of that window, export the footage before you start investigating. People routinely lose evidence by spending two days deciding what to do.
Step 1: Bracket the time window
Before touching any footage, narrow the search space using things you already know. You are looking for two timestamps:
- The latest moment it was definitely normal. The parcel notification said "delivered 14:12". You walked past the car at 18:30 and it was fine.
- The earliest moment you knew it wasn't. You opened the door at 19:40 and the parcel was gone.
Everything outside that bracket is irrelevant. This routinely turns "72 hours of footage" into "five and a half hours", before you have watched a single frame. Pull the bracket tighter with anything timestamped: phone notifications, card payments, message timestamps, smart-lock logs, when the dog started barking.
Beware of clock drift
Camera clocks drift, and many get daylight saving wrong. Before trusting the overlay timestamp, check it against something known — find your own arrival home on camera and compare it to your phone. If the camera is nine minutes fast, every conclusion you draw afterwards is nine minutes wrong. Add a generous margin to your bracket on both sides.
Step 2: Check motion events — and know what they miss
Your camera's app almost certainly has a list of motion-triggered clips. Start there: if the event triggered a clip, you are done in two minutes.
Frequently, it didn't. This is the single most common frustration with consumer security cameras, and it is worth understanding why, because it tells you when to stop trusting the event list.
| Motion detection commonly misses | Why |
|---|---|
| Slow, deliberate movement | Detection thresholds are tuned to filter out gradual pixel change, which is what shadows and clouds look like |
| Distant figures | A person at 30 metres occupies too few pixels to cross the threshold |
| Night-time events | Infrared footage is noisy and low-contrast, so sensitivity is often reduced to prevent constant false alerts |
| Rain, snow, insects, spider webs | These generate so many false triggers that people lower sensitivity — and then real events stop registering |
| Anything in an excluded zone | Masked-out areas like a pavement or a neighbour's drive are ignored entirely, by design |
| Events during a cooldown | Many cameras enforce a gap after a clip; an event in that gap is never recorded as an event |
If the camera records continuously to an SD card or NVR, the footage almost certainly exists even when no alert fired. The alert list is a summary someone else's algorithm wrote — it is not the recording. This is the point at which most people give up, and they shouldn't.
Step 3: Export the bracketed window
Get the continuous footage for your bracketed window out of the camera system and onto your computer as ordinary video files. How depends on your setup:
- SD card cameras: remove the card and copy the files, or use the app's download function for a time range.
- NVR / DVR systems: use the export or backup function, selecting the time range and the relevant cameras. Export to MP4 rather than a proprietary format if the option exists.
- Cloud cameras: download the clips covering the window. Note that many cloud plans only store event clips, not continuous footage — if so, the motion list is genuinely all you have.
Export all cameras that could plausibly see the area, not just the obvious one. The side camera that only caught someone walking past is often what establishes direction and timing.
Step 4: Search the footage instead of watching it
Now you have several hours of video and a specific thing to find. Watching it at 4× speed takes over an hour and your attention will lapse — this is exactly the kind of task humans are bad at and computers are good at.
The alternative is to index the exported footage so it can be searched by description. You type what you are looking for in plain English, and get back the matching frames with their timestamps.
Queries that work for security footage
Describe appearance and position, since that is what a camera records. Useful patterns:
| What you want | Query to try |
|---|---|
| Anyone approaching the door | a person standing at the front door |
| The delivery itself | a person carrying a box · a delivery van parked on the street |
| A specific individual you glimpsed | a person wearing a red jacket · man in a dark hoodie walking |
| Vehicle activity | a white van · a car reversing on a driveway |
| A dropped or missing item | a black handbag on the floor · a parcel on the doorstep |
| An animal | a cat in the garden at night · a dog on the lawn |
Two habits make a real difference:
- Search the absence as well as the presence. Looking for
an empty doorstepbrackets the theft from the other side: the last frame with the parcel and the first without it are minutes apart, and that gap contains your answer. - Search for context, not just the subject. If
persongives too many results, search what they were doing or near —a person crouching next to a caris far more selective thana person.
Visual search returns results ordered by how well they match. The top result is not guaranteed to be the incident — scan the first dozen. Security footage is low-contrast and often poorly lit, so match percentages run lower than they would on clean photos. Low scores across the board are normal; the order is what carries the information.
Step 5: Preserve it properly
Once you have the timestamps, handle the evidence in a way that stays useful to insurers and police:
- Keep the original, unedited file. Re-encoded, trimmed, or screen-recorded clips are far weaker as evidence. Save the export exactly as it came off the system.
- Write down the timestamps separately. A short text note — camera name, date, the times of the relevant moments, and any known clock offset — is more useful than a folder of clips.
- Copy it off the camera system immediately. Retention windows do not pause because you have opened a claim.
- Note the clock drift you measured in step 1. If the overlay is nine minutes fast, say so explicitly. Nobody else can discover that later.
A note on other people's privacy
Home security footage records neighbours, passers-by, and delivery workers who did not consent to it. In many countries, cameras covering public pavements or a neighbour's property carry legal obligations, and how you store and share the recordings matters.
Two practical implications. First, keep the review local where you can — analysing footage on your own computer means it is not being uploaded to a third-party service that never needed to see your street. Second, share only the specific clip relevant to the incident, with the people who need it (police, your insurer), rather than posting it publicly. A local neighbourhood group is not a lawful destination for footage of an identifiable person you suspect of something.
Frequently asked questions
My camera only saves short event clips. Can I still search them?
Yes — and it is often more effective than continuous footage, because there is less to process. Export the clips covering your bracketed window into one folder and search across all of them at once. The advantage over clicking through them individually is that you get ranked results rather than a chronological list.
Will this work with night vision or infrared footage?
Partially, and expect it to be weaker. Infrared footage is greyscale, low-contrast, and grainy, which strips out colour cues entirely — so red jacket is meaningless at night. Search for shapes and actions instead: a person walking, a car in a driveway. Scan further down the results than you would for daytime footage.
How much footage can I realistically process?
Indexing is a one-time cost per file that runs in the background, so the practical limit is patience and disk space rather than a hard cap. The sensible approach is the one above: bracket the window first so you are processing five hours rather than seventy-two. If the first pass finds nothing, widen the bracket and index more.
Is this facial recognition?
No, and the distinction matters legally in many places. Description-based search matches what is visible — clothing, vehicles, posture, objects, setting. It does not identify who someone is or match them against any database of people. You are searching for "a person in a red jacket", not for a named individual.
Find the incident in minutes, not evenings
Vision Search indexes exported security footage on your own computer and finds moments by description — with the exact timestamp. Nothing is uploaded, which matters when the footage shows your home and your neighbours.