Matthew Diakonov, Written with AI

Published May 7, 202611 min read

For property managers, asset managers, and on-call ops

Your DVR keeps 30 days. Trespass charges take 90. Do the math.

Most rental property managers learn this the hard way. A trespasser is captured on camera at 2 AM. A police report is filed the next morning. A detective picks up the case three weeks later. By the time they call to ask for the clip, the property has already recorded over it. The case dies in intake, and the same person shows up the following month.

The retention math on a typical multifamily DVR is shorter than the charging timeline of a misdemeanor criminal trespass case. That gap is what this guide is about. Below is what actually goes in a prosecutable rental property trespass packet, why a saved clip on its own is incomplete, and how to lock the documentation at the moment the event fires so it survives the ring buffer.

Direct answer, verified 2026-05-07

A complete rental property trespass evidence packet has six pieces: (1) the original incident clip with timestamp, camera identifier, and zone tag; (2) the served trespass notice with date and manner of service; (3) the repeat-entry clip showing the same subject after the notice; (4) a chain-of-custody log naming who exported each clip and when; (5) the lease and access policy plus any posted signage at the entry; (6) prior-pattern entries from the camera event log. Pieces one through three are what gets a prosecutor to charge. Pieces four through six are what survives an opposing attorney's motion to exclude. Notice element references vary by state; Texas Penal Code 30.05 is the most cited template. (statutes.capitol.texas.gov, PE 30.05)

The retention math nobody warned you about

A 4 channel residential-grade DVR with the included 1 TB drive keeps roughly 14 days of continuous recording at 1080p, 15 fps. A 16 channel property-grade unit with a 4 TB drive keeps closer to 30 days at the same settings. Push the resolution to 4 MP or the framerate to 30 fps and those numbers fall by half. The hard ceiling on most multifamily installs is 30 days, with a long tail of properties at 7 to 14.

The criminal trespass charging cycle, on the other hand, is measured in months. The pattern in a typical multifamily case looks like this: incident captured Day 0, police report filed Day 1, detective contacts the property between Day 7 and Day 30, the property pulls and exports the original clip, the detective requests evidence of the notice element (a served warning, a posted sign, a prior contact), the property serves a written trespass notice if it had not already, the subject returns at some point in the following weeks, and the second incident is what actually triggers a charge. Total elapsed time from the first incident to a filed misdemeanor: 30 to 90 days, sometimes longer if the docket is backed up.

That window is wider than the DVR's retention. If you do not export the original Day 0 clip on Day 0 (or Day 1), it is gone. The case gets reduced to whatever you have left, which is usually an undated tenant complaint and a vague description of the subject. Most rental property trespass cases die at this seam, not in court.

What you have on Day 60 of a trespass case

The original 2 AM incident from Day 0 has been overwritten on the DVR roughly 30 days ago. The most recent visit you can prove is whatever happened to land inside the current ring buffer window. The chain-of-custody log was not started until Day 14 when the detective called. The prior-pattern entries that would have shown five earlier visits are also gone. The packet you can send to the prosecutor is one short clip plus a verbal account of what came before.

Day 0 clip overwritten by approximately Day 30
No structured timestamp metadata on the export
No zone or camera location field on the clip
Prior pattern is a memory, not a record
Chain of custody starts mid-case, not at the source

The six pieces of the packet, in the order a prosecutor reads them

A complete packet is not a folder of clips. It is a sequenced argument. Below is the order a charging prosecutor or the property management company's outside counsel reads through, and what each piece is doing in that sequence.

Trespass packet, top to bottom

1
1. Original incident clip
Date, time, camera, zone. Subject visible enough to identify.
2
2. Served trespass notice
Date served, manner of service, name of server. Template approved by counsel.
3
3. Repeat-entry clip
Same subject, after the notice. Cross-track match to piece one.
4
4. Chain-of-custody log
Who exported what, when, to where. Started at the moment of capture.
5
5. Lease + signage
Access policy, posted entry signage photographs, lease termination if relevant.
6
6. Prior-pattern log
Every earlier event row for the same track or description. Demonstrates pattern.

Pieces one, two, and three are what the assistant district attorney reads to make the charging decision. Pieces four, five, and six are what the property's counsel uses if the defense moves to exclude the footage or to challenge the notice element at trial. Skipping any of pieces four through six does not stop the charge from being filed; it raises the odds the case is dismissed or reduced later.

What an event-level export actually is

A clip from a DVR is a video file. That is it. There is no zone tag, no notice context, no prior-pattern pointer, no operator name, no time window classification. A prosecutor opens the file, sees sixty seconds of footage, and immediately asks the questions the file does not answer.

An event-level export pairs the clip with a small structured row that does answer them. Side by side, the difference is small in bytes and large in evidentiary value.

Same incident, two evidentiary postures

// What an event-tagged export adds alongside the same clip.
// The clip is still the canonical record. This is the index row
// that travels with it and answers the prosecutor's questions.

{
  "event_id": "evt_2026-05-04T02:13:47Z_cam03_track_A91",
  "clip_pointer": "camera_03_2026-05-04_02-13-47.mp4",
  "property_id": "prop_river_oaks_180",
  "camera_label": "Rear gate, west side, fixed",
  "zone_tag": "rear_gate",
  "zone_notice_type": "posted_sign",   // see Texas PC 30.05(b)(2)(A)
  "time_window": "after_hours",
  "object_class": "person",
  "track_id": "A91",
  "dwell_seconds": 73,
  "badge_state": "unknown",            // not a known tenant or vendor
  "posture": "leaning",                // hands toward gate latch
  "intent_classification": "high_threat",
  "prior_warning_track_match":
    "evt_2026-04-29T18:02:11Z_cam01_track_A91",
  "exported_by": "j.alvarez@oakridge-pm.com",
  "exported_at": "2026-05-04T08:11:02Z",
  "export_destination": "s3://oakridge-pm-evidence/2026/05/"
}

13% fewer evidentiary fields on the raw export

The right column is roughly two kilobytes of JSON sitting beside a two megabyte clip. The fields that matter for a trespass case are zone_tag, zone_notice_type(which state statute subsection the zone's posted notice satisfies), dwell_seconds, badge_state, posture, and prior_warning_track_match, the pointer back to an earlier event where the same subject was warned. None of those are in the DVR's native export. All of them survive even after the underlying minute on the DVR has been overwritten because the event row and the 60-second clip live outside the ring buffer.

Mistakes that quietly kill rental property trespass cases

Treating the DVR as the archive.

The DVR is a recording device, not an evidence store. The day an incident happens, an export needs to leave the DVR. Not next week, not when the detective calls. Same day, ideally automatically.

Skipping the written notice because the verbal one happened.

A leasing office staffer telling a former tenant to leave is weak documentation. Three months later, in a deposition, that staffer may not remember the date, the time, or the exact wording. A written notice with a date, a service method, and a signature does not depend on memory.

Exporting clips in the DVR's proprietary format.

Police departments can rarely open vendor-specific .h264 or .dav files. Always export to mp4 or include the vendor's free player on a thumb drive next to the clip. A clip that cannot be opened on a desktop is a clip that gets returned with a request to re-export.

No zone label on the camera.

A clip from "camera 03" is not actionable until someone confirms what camera 03 covers. A short text label attached to each camera (rear gate west, mailroom north, stairwell B) on the export saves a meeting's worth of back and forth with the detective.

Letting the prior pattern stay in someone's head.

The leasing manager often knows the subject has been around before. That knowledge is not evidence. If it lives in their head and not in the event log, it is not in the packet, which means at trial the defense gets to argue the incident was a one-off.

What an event-tagged camera layer actually adds

A property manager does not need new cameras to fix the retention problem. The cameras and the DVR are recording the right pixels already. What is missing is the layer that decides which moments are worth saving outside the DVR and writes a structured row at those moments.

The Cyrano edge unit plugs into the DVR or NVR over HDMI and reads the multiview composite the recorder is already drawing for the wall display. It runs detection plus event tagging on each tile and writes one event row per real event (zone, time window, dwell, badge, posture, intent classification) plus a 60-second clip parked on cloud storage. One unit handles up to 25 cameras. Install on site is roughly two minutes. The DVR stays the canonical recording, which is the chain that has been holding up in court for decades. The event log is the index that lets you assemble a packet without scrubbing tape, on Day 60 of a case instead of Day 1.

Pricing is $450 one-time for the hardware and $200 a month from month two. The framing most operators land on is not against another camera system, it is against an overnight security guard ($3,000 a month for one shift, no event log) or against an unfilled trespass case (the cost of the next incident).

See the event log on a property with your existing DVR

15 minutes. We open the dashboard live, plug an edge unit into a multiview, and walk an exported event row end to end. If your DVR is already installed, this is a same-week pilot.

Rental property trespass documentation, common questions

Why does a rental property DVR usually lose the trespass evidence before the case is filed?

Because the retention window on a typical 4 to 16 channel DVR at a multifamily property is 14 to 30 days, and the timeline from incident to charging decision on a misdemeanor criminal trespass is 30 to 90 days. The original incident clip rolls over before the detective ever asks for it. The fix is not a bigger hard drive (which only buys you a few extra weeks), it is exporting a clip plus a structured event payload at the moment the event fires, and storing those small files outside the DVR ring buffer. The event payload is a few kilobytes. The clip is a few megabytes. Both can sit on a property management cloud share or an evidence drive forever.

What goes in a complete rental property trespass evidence packet?

Six pieces. (1) The original incident clip, exported with timestamp, camera identifier, and zone tag. (2) The served trespass notice, with the date served, the manner of service (in person, certified mail, posted), and the name of the person who served it. (3) The repeat-entry clip showing the same subject on the property after the notice was served. (4) A chain-of-custody log naming who exported each clip, when, and to what storage location. (5) The lease, the property's access policy, and any signage that was posted at the entry the subject used. (6) The prior-pattern entries from the camera event log, showing the subject's earlier visits and their pattern (same hours, same entry point, same dwell behavior). A prosecutor reads pieces one through three to charge. Pieces four through six are what an opposing attorney challenges if the case goes to trial.

Can a single saved clip be enough on its own?

It can support a civil ban or a no-trespass letter, but on its own it usually does not clear the bar for a criminal charge. Most state criminal trespass statutes have a notice element: the subject had to know, or have constructive notice, that entry was not permitted. A clip showing a person on the property does not automatically prove the notice element. A clip showing the same person on the property after a documented warning does. That is why the packet has to pair the incident clip with the notice and the repeat entry. The pieces are load-bearing together; individually they are weaker than they look.

What is the difference between footage retention and event retention?

Footage retention is how long every minute of every camera sits on the DVR's hard drive before being overwritten. It is bounded by storage and is rarely longer than 30 days on a property-grade unit. Event retention is how long a structured record of a specific detected event lives, separate from the underlying full-video archive. The event record carries metadata (camera, zone, time, classified intent, dwell, badge state, posture) and a short clip pointer. It is small and can be retained indefinitely. The distinction matters for trespass packets because what you need months later is the event, not the full archive. A camera system that only does footage retention forces you to choose how many days back you can defend; a system that also does event retention does not.

Does the property manager have to involve a lawyer to serve a trespass notice?

No, in most states a property owner or an authorized agent (which a property manager usually is, by lease or management agreement) can serve a trespass notice without an attorney. The notice typically names the person, names the property, states that entry is no longer permitted, and is served either in person, by certified mail, or by posting at the address. Some states accept a verbal warning given by an owner or police officer. Because state law varies, the safe pattern at a multifamily portfolio is a written notice template approved by counsel once and reused with the camera-derived identification of the subject pasted in. The lawyer's hour is spent on the template, not on each notice.

What does chain of custody mean for camera footage at a rental property?

Chain of custody is the record of every person who touched the footage from the moment it was recorded to the moment it lands in a courtroom. For a rental property the chain usually has four hops: the DVR recorded it, the property manager exported it, the management company stored it, and the prosecutor or insurer received it. Each hop should have a date, a time, and a name. A simple log file or a one-page form is enough. The point is not to be elaborate; the point is to be able to answer the question 'how do we know this footage was not edited' under cross-examination. A clip that nobody can account for between recording and trial is a clip an opposing attorney will move to exclude.

How long does it actually take to assemble a packet from a typical 16-channel DVR?

On a plain DVR, six to ten hours per packet is normal. The bulk of the time goes into scrubbing for the original incident and for the prior pattern (if you had to find five earlier visits across two months of footage, you scrubbed for each one), waiting on slow USB exports, converting proprietary file formats so the police department can actually open them, and writing the chain-of-custody log by hand. With a tagged event log on top of the DVR, the same packet drops to under an hour because the prior pattern is one search instead of five scrubs and the export already includes the metadata fields a prosecutor names in the affidavit. The time savings is the practical difference between assembling a packet at all and giving up on the case.

Does this work with the cameras and DVR I already have?

Yes, that is the whole point. The Cyrano edge unit plugs into the DVR or NVR over HDMI, reads the multiview composite the recorder is already drawing, and runs detection plus event tagging on top. No camera replacement, no rewiring, no cloud upload of raw footage. One unit indexes up to 25 camera feeds. Install on site is roughly two minutes. Properties keep their existing DVR as the canonical recording (which is the chain courts have been accepting for decades), and the event log sits alongside it as the index that lets you build a packet without scrubbing tape.

What if the trespasser is a former tenant whose lease was terminated?

Former tenants are the most common trespass case at multifamily, and they require the most care. The notice element is usually clean (the lease termination itself is documentary notice, and a follow-up trespass letter at termination is a defensible belt and suspenders), and the repeat entry is what the camera captures. The pattern that gets prosecutors to charge is consistent: termination dated, trespass notice served at termination, the former tenant returns once and is captured on camera, the management company sends a second written warning, the former tenant returns again, charges are filed. Three documented pieces (termination, return, second return) is the floor most jurisdictions want.

What does $200 a month buy that the included DVR alerts do not?

DVR built-in motion alerts fire on any pixel change, which means a single ceiling fan, a passing car at the perimeter, or a tree branch in wind produces tens to hundreds of alerts a day. Operators stop reading them in the second week. The Cyrano layer ($450 one time, $200 a month from month two) replaces the motion-on-pixel layer with detection-on-class plus zone, time, dwell, badge, and posture, then writes a structured event row per real event. The event row is what becomes the trespass log months later. The dollar comparison most operators make is to a security guard, where $200 a month is the equivalent of about $7 a day for 24 by 7 coverage on existing cameras, against $3,000 a month for a single overnight guard.