Reviewing security camera footage is three different jobs. Your DVR only ships the one you rarely need.

Because the DVR interface leaves them no alternative to describe. The consumer DVR has a Playback screen with a date picker, a channel dropdown, and a scrub bar. That is the full expressive surface. Every walkthrough therefore becomes: pick the channel, pick the date window, scrub. Some add 'set the playback speed to 4x or 8x.' Some add 'enable motion-based skip if your DVR supports it.' None of them say the true thing, which is that this workflow only serves forensic lookup (you already know exactly what you are looking for) and is actively wrong for the other two review jobs (did anything just happen, and did anything happen overnight).

Live triage is 'is something happening right now that I should respond to.' Shift triage is 'since I last looked, did anything cross a threshold that needs action.' Forensic lookup is 'a specific incident at a specific time is being investigated, find and export the clip.' Consumer DVRs are built for forensic lookup. The live view is there, but it is a 16-tile wall of noise with no attention hooks. There is no shift-triage screen at all; the feature does not exist on the recorder. So two out of three jobs have no interface on the box, and review becomes impossible for anything except 'I already know when this happened, show me the tape.'

It is a reverse-chronological list of classified events across every tile on the multiview, loaded in the morning and read top-down. On a 25-tile multiview across an 8-hour overnight window, a quiet property produces 8 to 15 thumbnails. Each row is a timestamp, a tile.label (the camera name the DVR stamps on the multiview strip), an event_class (person_in_zone, loiter, vehicle_dwell, tamper, or package_tamper), and a thumbnail. Scan the strip, flag what looks interesting, click to open the full clip. Typical attention cost on a quiet night is under 2 minutes. On a busy property it is maybe 15 minutes. Compare that to 4x scrubbing 25 channels across 8 hours, which is 50 real-time viewing hours even at the elevated speed.

person_in_zone (an actor crossed a configured detection polygon), loiter (an actor's bounding box persisted inside a zone past a dwell threshold), vehicle_dwell (a vehicle remained stationary inside a zone past a threshold), tamper (the HDMI frame from a tile suddenly lost structure, usually because the camera was blocked, rotated, or unplugged), and package_tamper (a package-sized object disappeared from a zone that previously contained it). Those five labels are the full filter surface of the shift-triage dashboard. Nothing else writes rows. If a class is not on that list, the full DVR recording is still there to review by hand for the rare case it matters.

Because the shift-triage workflow only works if last night is fully indexed by the time the morning reviewer sits down. If the indexing is a batch job that runs at 4 a.m., the review queue is behind by hours, and anything that happens between 4 and 6 a.m. is invisible until tomorrow. Cyrano's median capture-to-reviewable latency is 7 to 8 seconds off the DVR's HDMI output with a 5 to 15 second envelope. That is end-to-end: HDMI frame grab, per-tile crop, overlay mask, classifier, event-row write, thumbnail render, push to dashboard. It is short enough that the queue is never behind; every event from the past hour is already in the list when the reviewer opens the dashboard.

Live triage on a consumer DVR is a 16-tile wall of motion. Humans cannot attend to 16 scenes simultaneously; a 1974 study by Tickner and Poulton pegged useful human attention at 9 to 12 minutes before accuracy collapses, and that is on a single-scene task, not a 16-tile mosaic. Live triage works when the tiles that do not need attention stay quiet and the tile that needs attention lights up, with an audible cue and a named event class. The review surface for live triage is therefore not the multiview. It is a notification stream. Same event table as shift triage, filtered to the last 60 seconds, auto-refresh on.

It is acceptable if you know the exact channel and the exact time. It collapses if either of those is approximate. A lawyer asks 'do you have anything from around 9 p.m. last Thursday in the lobby,' and now you are scrubbing an 8-hour window across a channel that got renumbered last month. An event index makes forensic lookup trivial, because the iso8601_ts and the tile.label are the filter. The index also ties each event back to the DVR recording: click a thumbnail and the full clip opens, seeked to iso8601_ts minus a 5 to 10 second pre-roll so the approach is visible, not just the moment the classifier triggered.

It reads them off the multiview pixels. Every DVR paints the camera name onto each tile of its HDMI output as a small text strip. Cyrano OCRs that strip once at install, per layout, and stores the result as the tile.label on the event record. That is also why the review dashboard's camera filter chips say Mailroom Interior and Loading Dock NE instead of Channel 4 and Channel 7. The names are stable across channel swaps, because a property manager renames the painted label on the DVR UI before re-cabling. Reviewing by painted name is the review model that survives real-world property operations. Reviewing by channel number is not.

Yes, and this is where the separation matters. On the phone: live triage is the notifications tab, filtered to the last 60 seconds; shift triage is the event list with a tile.label chip and an iso8601_ts window; forensic lookup is the same list with a tighter time window and an event_class pin. All three use the same underlying event record on the same underlying dashboard. What makes it usable on a phone is that none of them require video scrubbing. Scrubbing is a desktop-only motion because it demands a scrub bar and a mouse. Event triage fits in a single scrolling thumbnail strip.

First, name which job you are doing. If the incident is ongoing and you want to see what is happening now, that is live triage and the DVR cannot help you; the multiview is not a live-triage tool. If last night had a reported problem and you are hunting for it, that is shift triage, and 4x scrubbing for 50 hours is the wrong answer; the right answer is any tool that produces a reverse-chronological event list across all your tiles (Cyrano does this in under 2 minutes of install off the HDMI). If a lawyer or cop is asking for a specific clip, that is forensic lookup, and your DVR's Playback screen is actually fine once you have the time and the channel; the problem is usually you have neither. Naming the job first saves hours on every one of them.