Public Safety & Body-Worn Camera Hardware 2026:
Evidence Storage, Retention & Chain of Custody

A body-worn camera is not a camera with a hard drive bolted to it. It is the front end of an evidence system whose output will be subpoenaed, replayed in a hearing, and attacked on integrity by whichever side the frame does not favour. The lens and sensor decide what the image looks like; everything downstream of the lens decides whether that image survives the trip from a shirt pocket to a court exhibit unchanged, with a defensible record of every hand it passed through.

That downstream chain is a hardware problem, and it is a different problem from the storage-specification questions asked in a data centre. Here the constraints arrive from retention law, from the shift-change rush at a docking bay, and from a vehicle cabin that bakes in summer sun and freezes in February.

The Chain, Stage by Stage

An evidence system has four stages, and each one has a characteristic way of failing. Capture produces the file. Ingest moves it off the device and verifies it. The evidence store keeps it immutable for years. Review and disclosure read it, redact it, and export it — and every read is itself a record.

The Retention Schedule Sizes the System, Not the Budget

Start with volume, because it is the number nobody estimates correctly. A 1080p H.265 body-camera stream at roughly 1.5 Mbit/s is about 11 MB per minute, so a twelve-hour shift lands near 8 GB. An agency fielding 200 officers across 250 shifts a year therefore produces on the order of 50,000 shift recordings and about 400 TB of new video annually — before duplicated court copies, in-car video, interview-room capture and the redacted derivatives that legal disclosure generates. Hold that figure for the retention period the applicable schedule imposes and the archive is measured in petabytes, not terabytes.

That is why the storage decision is a governance decision. Retention rules are set by statute, by the courts, and by the record schedule the jurisdiction publishes; they are not uniform, and they change. Hardware that assumes a fixed three-year window will be re-litigated every time the schedule moves. Design for growth and for policy change instead.

The Docking Window Is a Bandwidth Problem

Cameras do not stream to the store; they accumulate locally and drain at the dock. At a 100-officer station, shift change can return 100 units, each holding about 8 GB, inside a 30-minute window. That is 800 GB in 1,800 seconds, or roughly 3.6 Gbit/s sustained — comfortably beyond a single 1 GbE link, and enough to saturate a modest NAS long before the last camera is docked. The practical answers are a 10 GbE (or bonded) path from the dock to the store, staged ingest that drains bays as they fill rather than synchronising every bay at once, and a documented rule that a unit may not be reissued with un-drained video still on it.

Ingest speed also has a floor that no network upgrade fixes: the transfer rate between the camera and its bay. A dock built on USB 3.2 Gen 1 moves the same 8 GB in a little over a minute per bay; a dock sharing one slow backplane across sixteen bays moves it in ten. Bay-level channel count, not switch port speed, usually sets the real shift-change bottleneck.

Integrity Is Hashing and Logging

Admissibility arguments rarely turn on image quality. They turn on whether anyone can show the file is the file that was recorded. The defensible pattern is unglamorous and cheap: compute a SHA-256 digest on the device at write time, carry that digest through ingest, verify it on landing, store the object write-once so no later process can alter it, and log every read, export and transcode against the digest. A redacted derivative is a new object with its own digest, explicitly unrelated to the master until an auditor links the two.

Two hardware details keep that chain intact. First, the evidence store needs power-loss protection: an uncleaned shutdown in the middle of an ingest can leave a truncated object that fails its digest, which in practice means re-ingesting from a device that may already have been wiped. Second, agents that handle criminal justice information typically operate under the FBI's CJIS Security Policy, which expects FIPS-validated cryptography — so specify storage encryption whose module holds a FIPS 140-3 validation, not just an "AES-256" label.

Vehicle, Dock and Station Conditions

The station side is often treated as benign, and it is not. Locker rooms are humid, dusty and lint-heavy; a fan-cooled tower on a shelf beside a dock ingests exactly the material it cannot afford to. A fanless wide-temperature industrial PC with a wide-temperature SSD and power-loss protection removes that whole class of failure, and the same unit survives a cabinet mounted in a vehicle bay where the temperature swings thirty degrees a day.

Six rules for specifying public-safety evidence hardware:

1. Read the retention schedule before the datasheet. The archive size is a legal input, not an IT preference.
2. Size the dock window, not the average day. Assume every unit returns at once, because it does.
3. Require per-file hashing end to end. A digest computed at capture and verified at ingest is what makes every later integrity claim argument-proof.
4. Store write-once. Object lock or WORM, with legal hold overriding scheduled expiry, and an audit log that lives somewhere other than the video server.
5. Put power-loss protection on every device that writes evidence — camera, dock controller, ingest server and archive node.
6. Check the sourcing conditions. Federally funded programmes frequently apply Trade Agreements Act and Section 889 constraints; confirm origin and component disclosure before quoting.

QSCompute supplies the hardware layer of these systems — fanless wide-temperature industrial PCs and rack servers for ingest and evidence storage, industrial NVMe and SSD with power-loss protection and FIPS-validated encryption options, wide-temperature M.2 storage for camera and gateway platforms, and industrial DRAM sized for always-on ingest services. We quote against a stated retention volume, docking-window concurrency and environmental envelope rather than a bare capacity figure. DDP shipping to 85+ countries.