PDR / Legal and insurance work / Footage erased on a recorder

Investigations & evidence · recorder disks that were wiped

Erased CCTV recovery, Plymouth. It is still stored on the disk; what removes it is the loop writing over it.

The recorder continues to write as you are reading this, and that is basically the problem. A delete from the menu removes one row from the unit's catalogue; otherwise, the blocks of video remain in place and wait. Remove the mains power early enough and most of what you need comes back with camera and clock attached. After the loop goes over those blocks, nothing does.

On most jobs, no files means no fee An exhibit from the start The recorder is overwriting it

A quiet word first?
0800 6890668

Two ways through, and one wall.

The job the index doesA DVR contains a table which ties each camera and time to a location on the drive. A delete from the menu eliminates an individual row from this table. What the row was pointing at is still located on the disk.

Parsing it, which is bestWhere the table remains unaltered, the video comes out in order, and each clip is labelled with the name of the camera that created it and the time on the recorder. Nothing about it needs any further explanation.

Carving, which is second bestWith no table left, the image is scanned for the markers preceding each compressed frame. Those frames are then combined into clips that can be played. You get the pictures, but camera names and the clock usually do not come with them.

Overwritten, and that is finalWhen you have new footage sitting in those blocks, the footage from before it is gone, because there is no copy of the original below it. No software and no lab can restore this.

What each symptom points to.

Not on this list? Call us →

What turns up	What that points to	Where to start
Somebody deleted the recordings at the box	A line of the index goes, but the images do not	Switch it off now
The unit reformatted itself after a fault	All that a format lays down is an empty index and little else	Carving handles that, so the chances are reasonable
It went on recording for several days	Every additional hour of filming erodes the oldest materials.	Get the disk to us today
The earliest recording postdates the day you need	It will likely be overwritten, but the free check will tell you if it is.	The check itself is free
Clips play but carry no channel or time	Carved video holds the picture and loses the labels	Expected; it is noted on the file list
Files left by an earlier recovery attempt will not open	Raw video streams were taken out and never placed in a container	They get wrapped into MP4 files that will play

Sending it to us: once you have your quote, our intake lab in Bristol takes tracked, insured post, and we pay to send it back to you. If you'd like to talk packing through with an engineer before you post it, give us a call. There's more detail on our contact page.

Each stage, in turn.

Every job written up →

A number on arrival, then the free diagnosis Free

Whatever is delivered is booked in using a unique reference (case number) on the date it arrives at the bench. The engineer will identify the actual fault at no charge. This gives a straightforward answer on what can be recovered from the drive and what cannot, plus one written quotation. There will be no further activity until you have read and accepted the quotation.

Diagnosis at no chargeA single written figureYou owe nothing yet

Halt the disk

Turn off the recorder, remove the hard drive, and take an image using a hardware write blocker. At that point nothing else can be lost. Every block that the loop had not touched at that point is locked away in the image.

Unplugged at the startCopied behind a blocker

Look for the maker's tables

All searches and analysis are conducted on the image. The first thing searched for is the manufacturer's file system: HIKBTREE in a Hikvision, DHFS in a Dahua. When enough of that exists, clips come up with their correct channel names and actual time of recording. Loss adjusters will accept that version without questioning it.

Times still attachedCamera names returned

With no index left at all

Without an index to reference, the entire image is scanned for the byte markers that open each frame, in both H.264 and H.265 formats. Whatever is identified is then combined into clips playable by any standard player. Whether or not the timing was maintained in each case is also documented in the file listing.

The whole image scannedClips without labels flagged

You give the word, and it ships back

Give yourself time to consider it. It costs you nothing. We list all of the files we recover for you before sending out an invoice, and we only ask for payment once you have authorised it. We also buy media specifically for your recovery and send it back to you, with the return postage paid by us. The case stays here on our bench until we have your confirmation that the files open properly on your own machine.

You see the list and decideWritten to fresh mediaWe pay the postage home

What the work keeps showing

A delete is a bookkeeping action: the unit crosses one line out of its index and continues to record. There are no bytes removed from the disk.
Each compressed frame begins identically: whether the compression is H.264 or H.265, each frame starts with a fixed sequence of bytes, and a scan will find them. That is why you can carve out a usable clip even when there is no index left.
Labels save the need for explaining: when a clip still carries its channel name and time stamp, little needs to be said about what it represents, which is why labelled clips appear on a different listing from unlabelled clips.
Work out the arithmetic first: cameras, bitrate and disk capacity work together to fix how far back your unit can reach. Once you have measured this against the date you are looking for, you will know your position before discussing cost.

Loop recording in simple terms: the drive is broken up into equal-sized blocks, which are recorded sequentially from start to finish. When all the blocks have been filled, the unit begins again at the beginning and records over any data found. Therefore, once a clip has been erased, it remains recoverable only until the heads move back around to where it resides. Pulling the plug is not something you do before a recovery. It is most of the recovery itself.

A job out of the casebook.

PL · PLY-2026-0552FILED ✓

Cleared off the recorder, and four of five days back

A member of staff had removed what they believed to be unneeded video from the recorder. The theft was in the middle of what was removed. Fortunately, the unit was switched off within a few hours, so four of the five days still had their index entries and time stamps. This allowed those clips to come back labelled by name and date. The remaining day was carved out of the blocks; it does play back, but nothing labels it.

4 of the five missing days, timestamps intact72 hours on the bench

Before you seal the box.

Get these done

Pull the plug as soon as you know
Write down the date, the time and which cameras were involved
Send the disk exactly how it was when it came out of the box
Say at the outset who the video is for

What to avoid

Waiting to see, with the loop still going
Formatting the disk so the box will start
Pointing shop-bought undelete software at it
Accepting the installer's opinion before anything is imaged

The questions callers ask most.

Can deleted CCTV footage still be recovered?

Yes, usually. When you delete something, it removes the recorder's catalogue listing and doesn't go any further. The pictures remain in their blocks until the recording head returns to those areas of the disk, and if you remove the power to the recorder, nothing shifts.

Why can overwritten video not be recovered?

Once new recording is written over those original blocks, there is nothing underneath to recover, and no guarantee anything can be done. If anyone tells you otherwise, they are selling.

Do channel names and timestamps come back too?

Most times, as long as enough of the maker's index remains readable. Where it does not, we carve frames from raw sectors. This way the pictures come back, but usually not the labels. Our file listing marks all the clips that came back without labelling.

How quickly does the loop reach it?

That depends on the number of cameras, the bitrate they are set to and the capacity of the disk, and all of these affect how long your old video stays on the hard disk. There is no standard length for this, whatever anyone has told you. If you connect more cameras to the system, or if the cameras record more motion, then the oldest recording will go faster.

Pages people open after this.

Footage off a recorder → Footage for a claim or the police → Files sent to the bin → Evidence and reports →

Every minute it runs, less is left.

Every single minute the recorder continues to record, the clip you want becomes more and more likely to be recorded over for good and your deadline does not change. Begin here. Your first look is free of charge and any information we receive from you is held in confidence.

0800 6890668

Get a price Sending it in to us

Media and machines we take in

Listed by symptom

Evidence, CCTV and courts

How the job runs