Stop Collecting Ring and Doorbell Footage Over Email

Most agencies still collect Ring and doorbell footage over email. A neighbor pulls a clip off their phone, attaches it to a message, and sends it to the detective they spoke with at the door. The detective opens the file, watches it, drops it on a shared drive, and moves on. It feels efficient. It also breaks the chain of custody for that piece of digital evidence in at least four ways that any defense attorney will find.

Doorbell footage is now the most common form of digital evidence in residential investigations. The tooling around how it gets collected has not kept up. This piece is for the detectives, supervisors, and digital evidence techs who keep finding the same problem on the same kinds of cases — and want a defensible workflow they can run today.

Why email looks fine, and isn’t

Email is convenient. The witness already has it open on their phone. The video just goes. There is no upload portal, no app, no friction. From the resident’s perspective, their job is done in thirty seconds.

For the investigator, the trouble starts the moment the file arrives in the inbox.

• The file lives in a personal or shared inbox, not the case file. The fact that you can search for it is not the same as it being attributed to a case.
• Email systems strip and re-encode attachments routinely. Audio compression, frame-rate normalization, and HEIC-to-JPG conversion are all common at intermediate mail relays.
• The send timestamp is the email’s timestamp, not the recording’s. Embedded metadata may be partially stripped during transit.
• The chain from the resident’s phone to the case file runs through the resident’s mail provider, your agency’s mail server, the detective’s local mail client, and the shared drive. Every hop is a possible alteration point.
• There is no hash recorded at receipt, so re-verifying the bytes later — to prove what you have is what the resident sent — is impossible.
• If the email is forwarded to a colleague or a prosecutor, you have lost track of who has the file.

What chain of custody actually requires

Courts care about four things with digital evidence.

1. 01Origin — who collected it, from whom, when.
2. 02Integrity — proof the bytes are unchanged from the moment of collection to the courtroom.
3. 03Custody — who has touched the file, accessed it, and modified it.
4. 04Process — how each handoff happened, with timestamps and attribution.

Email satisfies origin in a weak sense — you know who sent it — but breaks every other requirement. There is no integrity check, no immutable custody log, and no documented handoff process. Each of those gaps is recoverable in isolation. None of them are recoverable when the file has already been emailed.

How email breaks the chain — three specific failures

1. Compression and re-encoding

Mail relays do all sorts of things to attachments. Some compress for size. Some re-encode video to a different codec. Some convert HEIC images to JPG. None of this is malicious. All of it changes the bytes. By the time the file lands in the detective’s inbox, its hash is different from what the resident sent — and there is no clean way to prove what the resident actually had on their device.

2. Personal accounts and forwarding

Detectives forward files to colleagues, to forensics, to prosecutors. Each forward creates another copy, each in a different inbox, none of them attributed in a single chain. When the defense subpoenas the file, the agency may have to produce multiple copies — and the differences between them, even small ones from re-encoding, become the basis for a motion to suppress.

3. Lost metadata

Modern phones embed substantial metadata in video and image files: GPS coordinates, capture time with timezone, device model, and in some cases motion data. Email transit strips most of this. By the time you have the file, you have already lost evidence about how it was captured — and that metadata can corroborate or contradict the resident’s story.

A defensible alternative

The fix is not complex. It is process change, and it takes about ten minutes to teach an officer on the porch.

1. 01Generate a single-use, time-bound upload link scoped to the case from your evidence intake system.
2. 02Send the link to the resident over SMS or email. The link itself is just a URL — it does not contain evidence.
3. 03The resident clicks the link on their phone, picks the file from their camera roll, and uploads. They never need an account.
4. 04The file goes directly from the resident’s device to your intake system. Your system computes the SHA-256 hash before the file is ever served to a human.
5. 05The upload event is recorded with timestamp, IP, user-agent, and the upload link’s case scope. The hash is stored alongside the asset.
6. 06Subsequent access — view, download, comment, tag, export — is logged against the same case file with full attribution.

The chain now has integrity, custody, and process baked in from the first byte. Origin is the resident’s phone, with cryptographic proof the file is unchanged from upload to courtroom. The defense can challenge what the resident captured — they always could — but they cannot challenge what your agency received.

What to ask of your evidence intake system

If your agency is evaluating tools — or wondering whether the platform you already have meets this bar — these are the questions that matter.

• Can the system generate single-use, time-bound upload links scoped to a specific case or address?
• Are uploads hashed automatically with SHA-256 at the moment of receipt, before any human sees the file?
• Is the hash stored alongside the asset and re-verified at every transfer and download?
• Are all access events logged with user, timestamp, IP, and user-agent — and is that log tamper-evident?
• Can the agency produce a signed export package that includes the original hash chain and full audit log for discovery?
• Can a witness upload from their phone in under two minutes without creating an account or installing an app?

If the answer to any of these is no, the system is collecting evidence the way email does — with a nicer interface. Intelintake meets this bar by default; so do the other modern intake platforms. The lift to move off email-based collection is smaller than most agencies assume — usually a short training session, a couple of canned text-message templates, and a willingness to spend ninety extra seconds at the front door so the rest of the case has a chance in court.