Body-worn camera storage: retention, chain of custody, and CJIS

Ask a department’s IT lead what keeps growing and the answer is almost always video. Body-worn cameras, in-car systems, fixed cameras on buildings, and interview rooms produce footage every shift, and very little of it can be thrown away on a schedule that suits the storage budget. That footage is also evidence, which means four questions follow it everywhere: where it lives, who has touched it, what it costs to keep, and whether it comes back after an attack.

This guide works through each one, with the CJIS Security Policy v6.1 requirements that apply and how RackTop deploys BrickStor SP for this workload.

Not by definition. CJIS v6.1 defines Criminal Justice Information as the data provided through FBI CJIS systems: biometric data, identity history, biographic data, property data, and case and incident history. Footage an officer records is agency data, not data from a CJIS system.

In practice the line is hard to hold. Video gets filed into the same case folders as criminal history returns, incident reports, and evidence exports that are CJI, and the people and systems that touch one touch the other. That is why many agencies, and many state CJIS Systems Agencies, treat the whole evidence repository as in scope rather than sorting it file by file. Your CSA and your state’s public records and retention laws decide where your line sits. The storage should not make you choose.

Retention schedules for recordings come from state law and agency policy, and they usually split two ways. Footage with no evidentiary value can age out on a fixed schedule. Footage tied to an arrest, a use-of-force review, a complaint, or a prosecution is held for the life of the case, which can include appeals, and can be frozen by a legal hold at any point.

The practical result is an archive that only grows. Every year adds a new layer of evidentiary footage that cannot be deleted, on top of the routine footage still inside its window. Planning storage for this workload means planning for years of growth, not for this year’s cameras.

A defense attorney does not ask how the storage array is configured. They ask who had access to a recording, whether anyone copied or altered it, and how the department knows. The answer has to come from a record that already exists, written at the moment each file was opened.

CJIS asks for the same thing in its audit controls. AU-3 requires each audit record to establish what happened, when, where, the source, the outcome, and the identity involved. AU-9 requires that audit information be protected from unauthorized change or deletion, including by the people who run the system. AU-11 requires keeping audit records for at least one year, and for evidence the right answer is usually as long as the evidence itself.

BrickStor SP writes that record for every file operation. User Behavior Auditing captures each read, write, rename, and delete with the user, the client address, the protocol, the full path, and a UTC timestamp, and forwards it to the agency’s SIEM over TLS-protected syslog, where no storage administrator can quietly edit it. Policy-driven immutable snapshots preserve every version of a file, and ImmutaVault keeps isolated, manifest-backed copies that survive an administrative compromise. The access history of a recording becomes a query instead of a reconstruction.

Most footage is watched in the first days or weeks and then rarely opened again, but it still has to be retrievable on demand, at the same path a case file or evidence system points to. Moving it to cheaper storage usually breaks those links, which is why many departments end up keeping everything on their most expensive tier.

BrickStor SP scales from a single terabyte to multiple petabytes on the same platform. Patented Transparent Data Movement moves aging footage to lower-cost storage on a policy, while every file stays at its original path and keeps the same encryption, access control, and audit. Tiering to external storage or cloud S3 is licensed separately per GB. If a cloud tier is used, CJIS SC-28 requires that CJI stored in the cloud stay within the United States or another APB-member jurisdiction and under the legal authority of an APB-member agency.

CJIS v6.1 requires FIPS 140-3 cryptography with 256-bit keys under SC-13, and SC-28 applies that standard to CJI at rest outside a physically secure location. The policy also states that FIPS 140-2 certificates are not acceptable after September 21, 2026. Footage leaves the building more often than people expect: drives go out for repair and disposal, and replicas sit at an alternate site.

BrickStor SP encrypts each dataset with AES-256. Version 23.9 and later uses a FIPS 140-3 Level 1 validated software module, CMVP certificate #5423, and RackTop appliances shipped since 2022 with FIPS drives add FIPS 140-3 Level 2 validated self-encrypting drives as a second, independent layer. Keys stay with the agency, in the built-in key manager or the agency’s own KMIP server.

Ransomware crews do not skip the evidence room. An encrypted video archive stalls prosecutions, and a stolen one becomes leverage. The recovery plan has to assume the attacker already holds an administrator credential, because that is how most file-share attacks reach scale.

Active Defense watches file activity inline and terminates a session that starts mass-encrypting, mass-deleting, or bulk-copying files, in under a second. Immutable snapshots taken in the minutes before the attack cannot be deleted by any credential, including an administrator’s, and Intelligent Bulk Remediation restores only the files the attack touched, so investigators are not waiting for a whole share to roll back.

Sheriff’s offices and local municipalities already run BrickStor SP for forensic evidence, body-worn camera footage, and video from fixed cameras on buildings, and several of those deployments have been in production for more than five years. A typical department deployment looks like this. BrickStor SP runs in the agency’s own data center, as a RackTop appliance or as a gateway in front of storage arrays the department already owns. RackTop does not host the data and has no remote connectivity to it.

Video, evidence exports, and case files each get their own dataset, with their own encryption key, snapshot policy, retention, and access rules, so the detective unit, the records unit, and the evidence technicians see only what they should. User Behavior Auditing is on for every dataset and forwards to the agency’s SIEM. Snapshots replicate to a second BrickStor system run by a different administrator group, so a single compromised admin account cannot reach both copies, and ImmutaVault holds the copies that must survive anything. Aging footage tiers to lower-cost storage with its path unchanged.

The result is one platform the evidence unit, IT, and the CJIS auditor can all work from: every file encrypted, every access recorded, and every recording recoverable.