Investigations & evidence · recorder disks that were wiped
While you read this the recorder is still writing, and that is the entire difficulty. A delete from the menu strikes one row out of the unit's catalogue; the blocks of video sit exactly where they were, waiting their turn. Take the mains off early and the bulk of what you want comes back with camera and clock attached. Once the loop has passed across those blocks, none of it does.
A quiet word first?
0800 6890668
| What shows up | What that points to | What to do |
|---|---|---|
| Somebody deleted the recordings at the box | A row of the index went; the pictures did not | Switch it off now |
| The unit reformatted itself after a fault | A format lays down an empty index and little more | Carving handles that, so the chances are reasonable |
| It went on recording for several days | Each further hour of recording eats deeper into the oldest material | Get the disk to us today |
| The earliest recording postdates the day you need | Almost certainly overwritten, though the free check will confirm it | The check itself is free |
| Clips play but carry no channel or time | Carved video holds the picture and loses the labels | Expected; it is noted on the file list |
| Files left behind by an earlier attempt will not open | Raw video streams were extracted and never put in a container | They get wrapped into MP4 files that will play |
Whatever arrives is booked in under a case number on the day it reaches the bench. An engineer then works out the actual fault, and that part is free. You get a plain answer on what can come off the drive and what cannot, followed by one price in writing. Nothing further happens until you have read it and agreed.
Switch the recorder off, lift the drive out, and copy it behind a hardware write blocker. Nothing further can be lost once that is done: every block the loop has not yet visited is held safe inside the image.
Everything that follows is done on the image. The first search is for whatever filesystem the manufacturer wrote — HIKBTREE in a Hikvision, DHFS in a Dahua. Where enough of that survives, the clips emerge with their genuine channel name and the true time of recording. A loss adjuster takes that version without argument.
Where there is no structure to follow, the entire image gets scanned for the byte markers that begin every compressed frame, in H.264 and in H.265, and whatever is found is put together into clips that any ordinary player can run. Which of them kept their timing, and which did not, is recorded on the file list.
Thinking it over costs you nothing. Everything the drive gave up is listed for you before any invoice exists, and the bill only follows your go-ahead. Files travel back on media bought in for your job, with return carriage paid at this end, and the case stays on the bench until you confirm they open on your own computer.
Loop recording, in plain terms: the drive is cut into equal-sized blocks, which get filled from the first through to the last. Having filled the last one, the unit starts again at the front and records over whatever it finds. So an erased clip stays readable only for as long as the head takes to come round again. Pulling the plug is not something you do before a recovery. It is most of the recovery itself.
A member of staff had cleared out footage that looked well past its use. The theft sat in the middle of what went. What saved it was the recorder going off within a few hours: four of the five days that had gone still held their index entries and times, so those clips came back named and dated. The fifth was carved out of the blocks — it plays, but nothing labels it.
In most cases, yes. Deleting strikes out the recorder's catalogue entry and goes no further. The pictures themselves are still in their blocks, and they stay there for as long as the recording head has not returned to that part of the disk. Take the power off and nothing shifts.
The fresh recording occupies the very blocks the earlier one held, and a platter keeps one state per block, not two. Once that has happened nobody can promise a result, and anybody who does is selling.
Frequently, provided enough of the maker's index can still be read. Where the work has to fall back on carving frames out of raw sectors, the pictures return while the labelling generally does not. Our file list marks the clips that arrived without it.
That turns on how many cameras there are, the bitrate they are set to, and the capacity of the disk. No standard figure exists, whatever anyone has told you. Put more cameras on it, or give them more movement to record, and the oldest material goes sooner.
Every minute the recorder runs, the clip you need moves closer to being written over, and your deadline has not moved. Start it here. The first look is free, and what you tell us goes no further.