How to investigate a vehicle incident on your site, step by step

By Gankya · 4 October 2026 · 6 min read

A car scrapes another in the basement and drives off. A two-wheeler disappears from a tower parking. A truck leaves through a gate it should never have used. In each case the security team has a few hours, sometimes less, before the useful footage starts to disappear.

This is a step-by-step method that works on any site, with or without special software. Print it and keep it in the control room.

Step 1: Secure the footage first

Most recorders overwrite the oldest footage when the disk is full. On a busy site that can mean only a few days of history, and some cameras may keep even less. Before anyone starts investigating, protect what exists.

• Note the time window: the earliest and latest time the incident could have happened. Add a margin on both sides.
• Export that window from every camera that could be relevant: gates, the incident location and the routes between them. Exporting too much is better than exporting too little.
• Save exports to two places, for example a pen drive and the control-room PC, and label them clearly.
• If the recorder has a "lock" or "protect" option for a time range, use it.
• Do not rely on a phone video of the monitor as your only copy. It loses detail and is harder to defend later.

Step 2: Write down what you know

Open an incident sheet before memories fade. Record:

• Who reported it, when, and how (call, intercom, in person).
• What happened, in the reporter's own words.
• The vehicle: type, colour, make if known, any stickers or damage, and the number, even partly. Write partial numbers exactly as remembered, for example "XX 00 AB 12__".
• The location and the time window.
• The name of the person leading the investigation.

Step 3: Check the gate records

The gate is usually the best starting point because every vehicle passes it twice. Look at:

• The visitor register or visitor app entries for the window.
• Boom barrier or RFID logs, if your site has them.
• Delivery and cab entries, and contractor vehicle passes.
• Guard notes from the shift, including anything unusual.

Compare the register with the gate camera. Registers have mistakes: wrong numbers, missing exits, entries filled in later. The camera is a check on the register, and the register is a check on the camera.

Step 4: Check the recorder clocks

This step is skipped more than any other, and it causes the most confusion. Recorders drift. On a large site with several recorders, one may be two minutes fast and another seven minutes slow. A vehicle can then appear to reach Tower 5 before it left the gate.

• Take a reference time, for example a phone's network clock.
• For each recorder, note the difference between its clock and the reference, with a "+" or "-".
• Write the offset on the incident sheet and correct every time you record.
• Afterwards, ask your CCTV vendor to set all recorders to sync automatically, and check them weekly.

Step 5: Go camera by camera

With the footage safe and the clocks known, trace the vehicle. A simple method:

1. Start from a firm sighting. Usually the gate entry, or the incident spot if a camera covers it.
2. Use a site map. Mark every camera and the roads between them. If you do not have one, draw it now; you will use it again.
3. Move to the next likely camera. From the firm sighting, which cameras could the vehicle reach next? Estimate the driving time and search a window around it.
4. Record each sighting in a table: camera, corrected time, direction, what is visible, and who checked it.
5. When you lose it, widen the search. Check the other branches of the road. A gap usually means a camera blind spot, a parked vehicle, or a camera that was offline.
6. Find the exit. Did the vehicle leave? Through which gate, and when? If there is no exit sighting, it may still be on site.

Two people work better than one: one watches, the other writes. Swap every half hour, because tired eyes miss things.

Step 6: Document as you go

An investigation is only as good as its record. Keep:

• The incident sheet and the sighting table.
• Still images of each key sighting, named with camera and corrected time.
• A list of exported files, where they are stored, and who exported them.
• A note of everyone who viewed the footage and why.

If the footage may go to the police, record a hash value (a digital fingerprint, such as SHA-256) for each exported file, and keep the original exports untouched. Our guide to handing CCTV evidence to police explains this.

Step 7: Know when to call the police

An internal investigation should never delay a police complaint where one is needed. Call or inform the police straight away when:

• Someone is hurt, or there is a threat to anyone's safety (dial 112 in an emergency).
• A vehicle or property has been stolen.
• A hit-and-run, assault or other serious offence may have happened.

Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), information about a cognizable offence can be given to a police station orally or by electronic communication; information given electronically has to be signed by the informant within three days. Under Section 94, a police officer in charge of a station can require, by written order, the production of documents or devices likely to contain digital evidence. Cooperate, ask for the request in writing, and get a receipt for anything you hand over.

Not legal advice. These are general points from the BNSS text; your local police station can tell you its own process.

Step 8: Close the loop

• Tell the affected resident or tenant what was found, without sharing footage of other people.
• Do not post clips on WhatsApp groups. It can harm innocent people and an investigation.
• Note what slowed you down, such as a blind spot, a dead camera or a wrong clock, and fix it.
• Release any locked footage once the matter is closed, unless the police or a lawyer ask you to keep it.

Step 5 is where most of the hours go. Gankya was built to shorten it. It is the intelligence layer on top of the CCTV system you already have: it connects to your recorder, so you can type a full or partial number to follow a vehicle across cameras in order, see which camera to check next, and see whether it is still inside. Every search needs a reason and is logged. If you would like to see this on your own cameras, ask about a 30-day pilot.