Every incident investigation begins the same way, with a version of events, and the version is wrong. Not dishonestly wrong, usually, just human: assembled from what the injured person remembers through pain and adrenaline, what two witnesses reconstruct after comparing notes they should not have compared, and what the supervisor infers from where things ended up. Investigation methodology exists precisely because first versions are unreliable, and the entire craft of root-cause analysis is a discipline for working backward from bad information toward what probably happened. Camera footage changes the starting point. When the event occurred in view of a lens, the investigation begins from what did happen, and the craft goes into understanding why, which was always the valuable question. This article walks through running that kind of investigation properly, from the first hour to the file that survives external scrutiny, and it belongs to our full guide on AI for workplace safety in manufacturing.
The first hour: preserve everything
When something serious happens, the investigation's most consequential decisions occur before anyone would call what they are doing investigating, and the discipline of the first hour is entirely about preservation.
The footage hold comes first, and it is wider than instinct suggests. Not just the camera that saw the event, but every camera on the paths to and from it, for a window reaching well before the incident, because the causes of the 2:14 event are routinely visible at 1:40, the staged material that narrowed the aisle, the earlier near pass nobody logged, the guard removed two shifts ago. Where detection was running, this is largely done already: the event-based recording kept clips around every detection, timestamped, with pre-event footage baked in by configuration, and the hold is a matter of flagging them against the routine retention cycle the same day. Where only continuous recording exists, someone must find and export the relevant spans before the recorder's cycle eats them, and the clock on that is unforgiving, which is the practical argument for the reporting-triggered hold rule covered in our article on the Occupational Safety and Health Administration (OSHA) recordkeeping and camera evidence.
The regulatory clocks run in parallel and shape the same hour: a fatality reportable to OSHA within 8 hours, hospitalizations, amputations, and eye losses within 24 under 29 CFR 1904.39. An investigation team with preserved, timestamped footage in hand makes that report from facts rather than fragments, which matters more than it sounds when the facts later diverge from the first version.
One more first-hour rule, learned expensively at many sites: the footage does not travel. No phone recordings of the monitor, no clips mailed to a distribution list, no copies on the conference room laptop. Evidence handling starts at once or it never really starts, and every uncontrolled copy made in the first hour is a provenance problem in the twelfth month.
Build one timeline from every camera
The analytical core of a video-based investigation is temporal alignment, getting everything the cameras saw onto a single timeline so the event can be watched as it actually unfolded rather than camera by camera with the investigator holding the synchronization in their head.
Where multiple cameras cover the scene, reviewing them as a synchronized mosaic, tiled and time-aligned, turns four partial views into one event. This is where causation usually lives, because single-camera review shows outcomes while the adjacent cameras show inputs: the forklift entering from the blind side, the second worker whose path forced the first one's detour, the earlier delivery that left the pallet where it should not have been. Frame-by-frame advance matters at the moment of the event itself, when the difference between "slipped and grabbed the rail" and "was struck and fell against the rail" is a handful of frames and a workers' compensation dispute.
Detection data, where it exists, is the index that makes the archive searchable in the aftermath. The question "had this happened before" stops being rhetorical: the zone's event history for the preceding ninety days is a query, not a canvassing exercise, and the answer transforms the investigation's scope. One prior near pass is an anecdote. Forty are a pattern the site now must explain, and would far rather have explained proactively, which is the double edge this series keeps returning to and the reason the correction ledger exists.
For the ambiguous stretches, the newer capability earns its keep: a preserved clip can be put to a multimodal model with a written question, describe the sequence of movements before the contact, and the description that comes back is a second reading to set against the investigator's own, useful precisely because it has no stake in any version. Two cautions carry over from our article on analysis beyond fixed detection types: the answer depends on the question's wording, so the prompt belongs in the file next to the finding, and no accuracy percentage exists for open-ended readings, so they inform judgment rather than replace it.
Footage shows what happened, interviews explain why
A video-rich investigation has a characteristic failure mode, and good teams name it early: the footage is so vivid that the investigation stops at what it shows. What it shows is almost always a person doing something, and so the vivid version of every incident is a behavior story, the shortcut taken, the zone entered, the glance not thrown. The why lives off camera, in the schedule pressure that made the shortcut rational, the layout that made the safe path slow, the staffing decision that put one person where the procedure assumed two, and no lens records any of it.
The discipline that works treats footage as the anchor for exactly two things, sequence and conditions, what happened in what order, and what the physical scene was, and then interrogates every behavioral observation with the standard question of modern safety science: what made that action make sense to that person at that time? The answer comes from interviews, and here the footage changes the interview's character for the better. Shown the timeline, witnesses stop defending recollections that the video contradicts, the argument about what happened evaporates, and the conversation moves to the part only they can supply, which is what it was like to be there. Investigators consistently report that interviews conducted alongside footage are shorter, less adversarial, and more productive than memory-only ones, provided the no-discipline architecture covered in our article on worker privacy commitments is real, because a workforce that has watched footage feed write-ups will treat every interview as an interrogation and every camera as the adversary.
The file that results, timeline, synchronized clips, event history, interview notes, prompt-and-answer records where model readings were used, and the corrective actions with their dates, is the artifact the outside world eventually judges. An insurer's investigator, an OSHA compliance officer, or opposing counsel each arrive asking the same two questions: what does the evidence show, and can its handling be trusted. The first is answered by the footage. The second is answered by the system around it.
When contractors and outside parties are involved
A growing share of serious incidents involve someone who is not an employee: the contractor crew, the delivery driver, the temp agency worker, the visiting technician. The investigation immediately becomes a multi-party matter, and the footage becomes an object several organizations want, each with counsel, each with a different theory of the event. The handling rules tighten accordingly. Access stays inside the defined investigation roles, external sharing happens through controlled, logged channels rather than attachments, and each disclosure is a decision made with counsel rather than a favor done on request, because a clip released casually to a contractor's insurer is a clip whose distribution the site no longer controls.
The same multi-party reality argues for redaction capability in the toolchain. Footage of the event routinely includes bystanders with privacy interests of their own, other workers, visitors, and releasing it outward without masking them creates a second problem while solving the first. Where the deployment includes redaction alongside the evidence store, the exported clip can mask the uninvolved while preserving the event, and the original stays intact under the hold. Sites facing regular external disclosure, and any site with EU workers in frame, should treat this as a requirement rather than an accessory.
Verify the fix with the same cameras
An investigation ends with corrective actions, and most programs stop there, filing the actions as complete when the work order closes. The detection layer enables the step almost nobody has been able to take: verifying that the fix changed the exposure. The barrier installed after the forklift incident either moved the near-pass rate at that intersection or it did not, and ninety days of before-and-after events answer the question in a two-line chart. When the rate fell, the file gains its strongest page, evidence the organization not only responded but responded effectively. When it did not fall, the site has learned that the fix addressed the report rather than the cause, which is painful and priceless in equal measure, and considerably cheaper than learning it from the next incident. Investigations that close this loop stop being autopsies and become experiments, which is what a learning organization actually looks like in practice.
Practice on near misses
The best investigation teams share a habit that looks like overkill until the day it is not: they run the full process on events that injured nobody. The high-potential near misses surfaced by the detection record, the crane-radius entry, the load that shifted but held, are investigation drills with every property of the real thing except the ambulance, and working them end to end, hold, timeline, event history, interviews, corrective action, verification, keeps the machinery warm and exposes its gaps while the stakes are administrative. A team that has run six near-miss investigations knows who calls the hold, how long the mosaic takes to assemble, and which supervisor answers interview questions defensively, and none of that is being learned for the first time at 3 a.m. with a fatality report due in eight hours. The near-miss record, in other words, is not only a prevention dataset. It is the practice field for the worst day, and sites that use it that way handle the worst day recognizably better.
How VIDIZMO supports the investigation
VIDIZMO AI Live Insight and the Nexus portal it works side by side with are built for exactly this sequence. Detection running on the plant's existing cameras, processed on site, means the moments that matter were captured as discrete clips with pre-event footage before anyone knew they would matter. The clips land in the portal under role-based access control, with every view and export logged and hash-verified integrity, so the provenance question has a boring answer, which is the best kind. Investigation review happens in the same system: multiple recordings synchronized into a time-aligned mosaic, frame-by-frame advance at the moment of contact, the zone's event history queryable beside the incident, and retention holds applied per clip so the file outlives the routine cycle. Where the site licenses AI Intelligence Hub, the written-question analysis runs against preserved clips and its answers return as records alongside them.
The investment case for all of this rarely needs a spreadsheet. One contested claim resolved by footage, one citation answered with contemporaneous evidence, or one root cause found in the pre-event hour instead of guessed at, and the system has paid for its part of the program. What the spreadsheet also never captures is the quieter effect on the investigations that stop being necessary: a floor that knows events are reconstructable stops generating the category of dispute that begins with two irreconcilable stories, because there are no irreconcilable stories anymore, only the timeline and the question of why.
The readiness test is worth running before it is needed: pick a past incident, and time how long it takes the current setup to produce the synchronized footage, the ninety-day event history for that location, and an access log for who has viewed the material. Sites that run that drill discover their real posture in an afternoon, and the gap between what they found and what this article describes is the project plan.