Dashcams · body cameras · memory card · footage · timestamps · loop recording
Dashcam and body camera forensics. A dashcam loops like a CCTV recorder; the clip you need is on a card and on a clock.
A dashcam or body camera records to a memory card, usually in a loop that overwrites the oldest footage once the card is full, exactly like a CCTV recorder on a smaller scale. When footage of an incident is needed, the priorities are the same: take the card out so the loop stops overwriting it, and have it examined properly. We image the card behind a write blocker, recover the surviving footage, including clips that may have been partly overwritten or that the camera marked as deleted, present them with their timestamps, and check the camera's clock against real time, because these clocks drift. Footage the loop has already overwritten is gone; what survives is recovered and presented credibly.
Rather talk it through? An engineer answers the bench line
0800 6890668
How a dashcam card is examined.
A dashcam or body camera writes to a memory card in a loop: when the card fills, the oldest footage is overwritten to make room. So footage of an incident is lost not by deletion but by being overwritten as the camera keeps recording. The first step, when footage is needed, is to take the card out, or stop the camera, so the loop stops.
We image the card behind a write blocker and hash it, then recover the surviving footage, including clips the camera marked as protected or deleted and clips in the card's unallocated space, present them with their timestamps, and check the camera's clock against real time, because dashcam clocks are often inaccurate and the offset matters when the footage is relied on.
The honest limit is overwriting: footage the loop has already overwritten is gone. What survives is recovered and presented under an integrity record, credible for an insurer, a solicitor or the police.
What to know for this exhibit.
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send it
- Take the card out the moment you need footage; leaving the camera running overwrites the clip you want.
- Send the card, and tell us the exact date and time of the incident.
- Do not keep using the card; every new recording overwrites more of what survives.
Dashcam clocks are often inaccurate, so the camera's clock is checked against real time and the offset recorded when the footage is relied on.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the situation and the questions you have
What sets us back
- Letting anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Sending us a mobile phone; they are not examined
Questions answered before you instruct.
Can you recover dashcam footage of an incident?
We can recover the footage that survives on the card, including clips the camera marked as protected or deleted, with their timestamps, from a write-blocked image. Footage the loop has already overwritten is gone, which is why taking the card out the moment you need footage matters.
The dashcam is still recording. What do I do?
Take the card out, or stop the camera, as soon as you realise you need the footage. A dashcam overwrites the oldest footage once the card fills, so every clip recorded after the incident overwrites more of what you need.
The dashcam's clock was wrong. Does that matter?
It can, which is why we check the camera's clock against real time and record the offset. Dashcam clocks are often inaccurate, and knowing the true time of a clip matters when the footage is relied on in a claim or a dispute.
Is this different from CCTV recovery?
It is the same principle on a smaller scale: a memory card instead of a recorder's hard disk, but the same loop, the same priority to stop the overwriting, and the same forensic imaging, timestamps and clock check. Our memory card service covers card recovery in depth.
What does it cost?
The standard forensic report recovering and presenting the footage from the card is £800 + VAT. The first conversation is free, and the priority is to take the card out before footage is lost.
Preserve it, and let us image it first.
The first conversation is free. Tell us the exhibit and the situation, and who owns it, and we will tell you what can be examined, what authority we need, and whether we can take it on. Until then, stop using it and preserve it as it is.