Evidence work · disks out of DVRs, NVRs and CCTV units
The recorder writes in a circle. After the recorder fills the disk it goes back to the start of the disk and records new video over the oldest record, based solely on how old each recording is, and the recorder doesn't know what information (or value) is stored in the older recordings. If you remove power from the recorder, the circle will stop where it is. Everything after that would be performed at the workbench.
Go through it with an engineer
0800 6890668
| The symptom | The likely cause | Start here |
|---|---|---|
| A member of staff erased the clips | An index entry was erased but the video itself was not affected | Shut it down immediately |
| An engineer formatted the disk while fixing it | Now there is an empty index sitting on top of the old video | Video frames are scanned for |
| Unit is dead. No light, no video. | Footage remains on disk. Not lost to bad board. | Disk removed, imaged |
| Incident occurred three weeks prior | Loop may have reached it by now. Diagnosis will tell us. | Free assessment will tell you if so |
| Playback of video works but exporting of video fails | Bad USB port or broken export firmware | Using an image of a disk means avoiding this altogether |
| Either an insurance company or Thames Valley Police are asking for it | Formatted like an exhibit: MP4 video file, native export, hash values, report | Mention this when the case is logged |
Nothing is chargeable until you say yes. Every item gets a case number of its own immediately upon receipt, an engineer determines what has failed, and you get a clear picture of which files have a real possibility of being recovered. The single quote that follows is fixed, written down and does not cost anything.
In each telephone conversation we give the same advice. Turn off the unit completely at the wall socket or remove the disk. Nothing you do after that counts for as much. While the recorder remains active it continues to overwrite your evidence.
The disk is removed and imaged sector by sector using a write blocker, so nothing can be written back to it. At this point, the image will be used as the source for all subsequent actions, and the original recording device becomes moot; all future action is performed on the clone.
Hikvision has the HIKBTREE index and Dahua has the DHFS table of its own. Clips will be returned (with channel number and timestamp) if those indexes survive. Otherwise, the image will be scanned for H.264 and H.265 video frames and rebuilt into playable files.
You don't get charged anything until you've confirmed and authorised that everything is fine after seeing the entire list of what was recovered. Any recovered items are returned via brand-new storage media and the postage costs for these are covered by us. We do not consider a project complete here until we receive confirmation that you have been able to successfully access and review every item you received back.
About that thirty days: there is no statute in UK law which specifies a minimum retention period for CCTV. The familiar 31-day figure comes from the storage-limitation principle in data protection law and states an intention rather than measuring a disk. Camera count, bitrate and capacity decide what you keep. Use the lower number.
Nine days had passed since the break-in when the insurer requested the footage, with the recorder still running. The disk was imaged, the index unpicked and the minutes that mattered were extracted from blocks that the loop had yet to reach. Two exports were returned: one to review the evidence, one for the claim.
It usually is if the recorder was stopped before the loop returned to this point in the disk. When deleting files, all that happens is the index entry is removed and no other data is deleted; the video will remain on the disk until new recording overlays it.
No. Once new recording has physically replaced the original recording, nothing of the original will remain on the disk for any laboratory to find. That is why our first instruction is always to stop the recorder.
Rarely. The video is stored on the disk inside, not in the electronics, therefore the disk is removed to be imaged & the process continues with this duplicate. A recorder generally is a container for a hard drive.
This is based on disk size, how many camera feeds are being recorded and how high each feed's bit rate is; busy installations can have their entire loop filled up within days. As long as the recorder is working, every single open footage request is an emergency.
Recording in a loop is already overwriting your needed evidence, and the deadline will not move. There is no cost associated with opening a case today: diagnoses are free and remain completely confidential.