CCTV · DVR · NVR · recorder drive · footage · overwriting loop · timestamps
CCTV, DVR and NVR forensics. A recorder is a computer with a drive and a loop; the loop is overwriting the footage you need while you read this.
A CCTV, DVR or NVR recorder is a computer with a hard disk, and it keeps a loop: once the disk is full it overwrites the oldest footage to record the newest. So the single most important thing, when footage of an incident is needed, is to stop the recorder recording immediately, because every hour it runs overwrites more of what you want. We examine the recorder's own drive, which usually uses a non-standard file system, recover the surviving footage for the time in question with its timestamps, check the recorder's clock against real time, and keep the integrity record throughout. We cannot recover footage the loop has already overwritten; that is gone.
Rather talk it through? An engineer answers the bench line
0800 6890668
How a recorder is examined, and the race against the loop.
A recorder stores footage on a hard disk in its own, usually non-standard, file system, and it runs a loop: when the disk fills, it overwrites the oldest footage. This is by design, to keep recording indefinitely, and it is why footage of an incident is lost not by deletion but by being overwritten as the recorder keeps running.
The priority, before anything else, is to stop the recorder, power it down or take the drive out, the moment footage may be needed. We then image the recorder's drive behind a write blocker, interpret its file system, recover the surviving footage for the date and time in question with its timestamps, and check the clock against real time, because recorder clocks drift and the offset matters. The whole is kept under an integrity record, so the footage is credible if relied on.
The honest limit is overwriting: footage the loop has already overwritten is gone, by us or anyone, which is why stopping the recorder quickly matters more than anything we do afterwards.
What to know for this exhibit.
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send it
- Stop the recorder recording the instant you need footage; this matters more than anything else, because the loop overwrites what you want.
- Take the drive out or power the recorder down, and send the drive or the recorder; the cameras stay.
- Tell us the exact date and time of the incident, so we recover the right footage before it is lost.
A recorder overwrites the oldest footage to record the newest, so the footage you need is being overwritten while the recorder keeps running.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the situation and the questions you have
What sets us back
- Letting anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Sending us a mobile phone; they are not examined
Questions answered before you instruct.
Can you recover deleted or overwritten CCTV footage?
We can recover footage that survives on the recorder's drive for the time in question, with its timestamps, from a write-blocked image. Footage the recorder's loop has already overwritten is gone, by us or anyone, which is why stopping the recorder the instant you need footage matters more than anything.
The recorder is still running. What do I do?
Stop it recording at once, power it down or take the drive out, and do it now. A recorder overwrites the oldest footage to make room for the newest, so every hour it keeps running after the incident overwrites more of the footage you need.
Why not just export the footage from the recorder?
For a simple need, exporting may be enough, but a recorder can re-encode or limit what it exports, and footage copied off a live recorder can be questioned. A forensic recovery from a write-blocked image, with the timestamps and the clock checked, is credible where the footage is to be relied on by an insurer, a solicitor or the police.
Can the footage identify someone?
Footage shows what was in the camera's frame; whether that identifies anyone depends on the camera, the angle and the lighting. We recover and present what was captured with the timestamps; identification is for those viewing it.
What does it cost?
The standard forensic report recovering and presenting the footage from the recorder's drive is £800 + VAT. The first conversation is free, and the priority is to stop the recorder before footage is lost.
Preserve it, and let us image it first.
The first conversation is free. Tell us the exhibit and the situation, and who owns it, and we will tell you what can be examined, what authority we need, and whether we can take it on. Until then, stop using it and preserve it as it is.