Evidence work · hard disks from CCTV recorders
A DVR records continuously until the disk is full, then wraps around to the beginning of the disk and overlays the oldest footage with new recordings. The age of each clip decides the order; nothing else does. It cannot tell an hour containing a break-in from an hour of an empty yard. To stop this, simply disconnect the power supply from the recorder, wherever it is in Plymouth. Once disconnected, it becomes bench work using a copy of the disk.
A quiet word first?
0800 6890668
| What turns up | What that points to | Where to start |
|---|---|---|
| Clips wiped through the recorder's menu | The catalogue entry went; the pictures stayed | Unplug it, today |
| The installer reformatted the drive | An empty index written on top of the footage | Frames get carved out of the image |
| No lights, no picture, no response | Footage exists on the disk, not on the circuit board | Take the disk out; we image it |
| The incident was a fortnight ago | The loop may have already reached it, and this can be determined | The free diagnosis answers that |
| It plays back but will not export | Export firmware has failed or USB port has malfunctioned | The clips come off our image instead |
| A solicitor or an insurer wants a copy | Exhibit bundle: native clips, MP4 versions, hashes, notes | Say so when you book it in |
Whatever is delivered is booked in using a unique reference (case number) on the date it arrives at the bench. The engineer will identify the actual fault at no charge. This gives a straightforward answer on what can be recovered from the drive and what cannot, plus one written quotation. There will be no further activity until you have read and accepted the quotation.
The same sentence appears at the start of every footage call we receive. Either pull the power lead out of the recorder or remove the disk from the unit. Everything else on this page carries less weight than this, because while a recorder is still running, it is continually writing over the clip you are calling about.
The drive is fitted behind a hardware write blocker. Each sector on the drive is read, and not one byte is written back to the drive. Once a copy exists, the recorder becomes irrelevant and all remaining work is performed against the image.
Each make lays down its own index: Hikvision uses a HIKBTREE index, whilst Dahua creates its own DHFS tables. Where these remain intact, clips are returned bearing the camera name and time stamps associated with them. Where they fail to parse, H.264 and H.265 frames are carved out of the image and compiled into playable files.
Give yourself time to consider it. It costs you nothing. We list all of the files we recover for you before sending out an invoice, and we only ask for payment once you have authorised it. We also buy media specifically for your recovery and send it back to you, with the return postage paid by us. The case stays here on our bench until we have your confirmation that the files open properly on your own machine.
Retention (CCTV): there is no general statutory minimum for holding CCTV recordings in the UK. The figure people quote comes from data protection guidance about not holding footage beyond the purposes for which it was collected, and it applies to no specific storage device. How long the footage is stored depends upon how many cameras are recording onto the storage device, what bitrate is used and how large the storage medium is. In most cases assume the shorter answer.
The insurance company didn't request footage until nine days after the break-in, and during this time the recorder recorded continuously without stopping. The disk was removed, imaged and its index read. The important minutes were still in blocks the loop had not yet reached. Two copies were sent out, one to view and one to store with the claims file.
Yes, frequently. It depends on whether the recorder was powered down before the loop reached that point again. When you delete a segment of video you are deleting a reference entry in the catalogue. The video itself remains in the same location until overwritten.
Then they are gone for good. New frames will have replaced them and there will be nothing left underneath them. No lab anywhere can recover overwritten video, ours included. That is why the first thing we will always ask is that you unplug it.
Rarely. A DVR consists of a housing, a circuit board and a hard drive. The video resides on the hard drive. If the board fails it doesn't really matter, since the hard drive can be removed, imaged and the work done directly on the image.
There are three factors determining how quickly this happens: how big is the disk, how many cameras feed into it, and what bitrate are they using? A forecourt with movement all day can recycle its video within a few days. While the DVR is still recording, take it for granted that time is working against you.
Every single minute the recorder continues to record, the clip you want becomes more and more likely to be recorded over for good and your deadline does not change. Begin here. Your first look is free of charge and any information we receive from you is held in confidence.