Identifying a vehicle in a toll system includes accessing a set of toll
transaction entries. Each entry in the set designates a toll transaction
between a vehicle and the toll system and includes a transaction
descriptor and a transaction time stamp. A series of toll transaction
pictures is accessed. The series includes a plurality of pictures, each
of which is associated with a picture time stamp. A toll transaction
entry is identified from the set as a violation transaction entry based
on the transaction descriptor. A toll transaction picture is selected
from the series. The transaction time stamp of the violation transaction
is compared, using a processing device, with the picture time stamp of
the selected toll transaction picture. The selected toll transaction
picture is identified as a violation picture corresponding to the
violation transaction entry based on a result of the comparison.