CCTV · DVR · NVR · deleted footage · overwritten · timestamps · recorder's drive
Deleted CCTV and DVR footage. A recorder overwrites yesterday to make room for today; the footage you need is on a clock, and the clock is running.
A CCTV or DVR recorder is a computer with a hard disk, and when footage of an incident is needed, the race is against the recorder itself, which overwrites the oldest footage to make room for the newest. The single most important thing is to stop the recorder recording the moment you realise you need footage, because every hour it keeps running overwrites more of what you want. We examine the recorder's own drive, recover the surviving footage segments for the date and time in question, and report what was recoverable, with the timestamps, keeping the integrity record and checking the recorder's clock against real time. We examine the recorder for its owner or the person who controls it, a business owner, a landlord, a manager, and we are honest about the limit: we recover what survives before it is overwritten, we cannot recover what the loop has already written over, and footage shows what was in frame, not the identity of the people in it. It is often enough for an insurer, a solicitor or the police.
Rather talk it through? An engineer answers the bench line
0800 6890668
Who instructs us, and the authority we need.
The instructing party is the owner or controller of the recorder, a business owner, a landlord, a site manager, and we ask for proof of ownership or control. The recorder's drive, or the whole recorder, is what we examine; the cameras stay where they are.
The one piece of advice that matters most comes before anything else: stop the recorder recording immediately. A recorder keeps a loop, overwriting the oldest footage to record the newest, so every hour it continues after the incident overwrites more of the footage you need. Power it down or take the drive out, and do it as soon as you realise footage may be required. Nothing we do can recover what the loop has already written over.
We examine the recorder's drive, which often uses a non-standard file system, recover the surviving footage for the time in question, and report it with timestamps and an integrity record. We check the recorder's clock against real time, because recorder clocks drift, and we are clear that footage shows what was in frame, not who the people are.
What the standard report typically contains.
The questions it can answer, and what it cannot.
Describe your situation →| What you want to know | What the examination shows | What it cannot prove on its own |
|---|---|---|
| What footage from the date survived | The recovered segments and their timestamps | Events outside the camera's frame |
| How accurate the recorder's clock was | The clock checked against real time | The identity of people recorded |
| That the footage is genuine and unaltered | A hashed, write-blocked recovery | What happened before or after the recording |
| How much was lost to overwriting | The recoverable against the overwritten | Footage the loop has already written over; it is gone |
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send the exhibit
- Stop the recorder recording the instant you need footage; every hour it runs overwrites more of what you want. This matters more than anything else.
- Take the drive out, or power the recorder down, and send the drive or the recorder; the cameras stay.
- Tell us the exact date and time of the incident, so we recover the right footage before it is lost.
A recorder overwrites the oldest footage to make room for the newest, so the single most important step is to stop it recording the instant footage is needed.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the questions you need answered
What sets us back
- Letting IT or anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Assuming artefacts prove who was at the keyboard
Questions answered before you instruct.
Can you recover deleted CCTV footage?
We can recover the footage that survives on the recorder's drive for the time in question, with its timestamps, from a write-blocked image. What we cannot recover is footage the recorder's loop has already overwritten, which is why stopping the recorder immediately matters more than anything else.
The recorder is still running. What should I do?
Stop it recording at once, power it down or take the drive out, and do it now. A recorder overwrites the oldest footage to make room for the newest, so every hour it keeps running after the incident overwrites more of the footage you need.
Why not just copy the footage off the recorder myself?
You can, and for a simple need that may be enough, but footage copied off a live recorder can be questioned, and the recorder may re-encode or limit what it exports. A forensic recovery from a write-blocked image, with the timestamps and the clock checked, is credible where the footage is to be relied on by an insurer, a solicitor or the police.
Will the footage identify who did it?
Footage shows what was in the camera's frame; whether that identifies anyone depends on the camera, the angle and the lighting. We recover and present what was captured, with the timestamps; identification is a matter for those viewing it.
What does it cost?
The standard report recovering and presenting the footage from the recorder's drive is £800 + VAT. The first conversation is free, and the priority is to stop the recorder before footage is lost.
The device holds the answer; preserve it first.
The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.