Forensic search is the ability to find a specific moment in recorded footage quickly — turning months of video from an unsearchable haystack into something you can query. Instead of scrubbing timelines by hand, an investigator asks "show me every vehicle on this camera between 2 and 4 pm" or "find this person across all cameras", and the system returns ranked candidates in seconds. It is what makes a large archive actually useful after an incident.
The key mechanism is that search reads a metadata index built at record time, not the raw pixels. As video is recorded, analytics tag it (objects, classes, attributes, events), and search queries that index — which is fast but means you can only find what was indexed; anything the analytics did not capture is invisible unless you reprocess the raw video, the slow fallback. Search capability climbs in rungs: time and camera, then motion, then object class, then attributes (colour, type), and at the top appearance matching and natural-language queries. The ONVIF Recording Search Service (Profile G) standardises the lower rungs across vendors.
The pitfalls follow from that. Recall is capped by the upstream detection — if the object was never detected, search cannot find it — and results are ranked candidates to confirm, not exact answers, so it is triage, never 100%. And a searchable archive raises the privacy stakes of retention: it is personal data, cross-camera appearance search is re-identification, and face-template search is biometric (GDPR Art. 9 / BIPA), so audit logging and retention limits matter more, not less. This is engineering guidance, not legal advice.
