Evidence work · disks out of DVRs, NVRs and CCTV units
A recorder writes in a circle. Once the disk is full it returns to the beginning and lays new video over the oldest, choosing by age alone and knowing nothing of what the older footage holds. Take the power away and the circle stops where it stands; what follows is done at the bench.
Go through it with an engineer
0800 6890668
| The symptom | The likely cause | Start here |
|---|---|---|
| A member of staff deleted the clips | The index entry disappears, the video does not | Switch it off there and then |
| An engineer formatted the disk while repairing it | A new empty index now sits above the old video | We scan for the video frames |
| Dead unit: no lights, no output | The footage is on the disk, not in the failed board | The disk comes out and is imaged |
| The incident was three weeks ago | The loop may have reached it already; the diagnosis tells us | A free assessment answers that |
| Playback works, the export does not | A failed USB socket, or broken export firmware | Working from a disk image avoids that entirely |
| An insurer or Thames Valley Police has asked for it | Exhibit format: MP4, native export, hashes, a report | Say so when the case is booked |
Nothing becomes chargeable until you have said yes to it. Each item takes a case number of its own the moment it arrives, an engineer establishes what has actually failed, and you are given a candid view of which files stand a realistic chance of returning. The single quote that follows is fixed, written down, and costs nothing.
The advice we give on the telephone never varies: switch the unit off at the socket, or lift the disk out. No later step counts for as much, because a running recorder is still writing over your evidence.
The disk comes out and is copied sector by sector behind a write blocker, so nothing can be written back to it. From then on the recorder is beside the point: every stage of the work is done on the copy.
Hikvision keeps a HIKBTREE index; Dahua uses DHFS tables of its own. Where those structures survive, clips return with channel numbers and timestamps attached. If not, the image is swept for H.264 and H.265 video frames and rebuilt as playable files.
Nothing is billed until you have seen the recovered file list in full and told us to go ahead. What comes back arrives on new media, with the return journey at our cost, and the case stays open at this end until you have opened every file yourself.
About that thirty days: no UK statute sets a minimum retention period for CCTV. The familiar 31-day figure comes from the storage-limitation principle in data-protection law, and states an intention rather than measuring a disk. Camera count, bitrate and capacity decide what you keep. Assume the lower number.
Nine days after the break-in the insurer asked for the footage, with the recorder still running. The disk was imaged, the index unpicked, and the minutes that mattered lifted from blocks the loop had not yet reached. Two exports went back: one to watch, one for the claim.
Usually it is, so long as the recorder stopped before the loop returned to that part of the disk. Deletion takes away the index entry and nothing else: the video sits there until new recording is laid over it.
No. Where new video has physically replaced the old recording, nothing of the original is left for any laboratory to find. That is why the first instruction is always to stop the recorder.
Seldom. The video is held on the disk inside, not in the electronics, so the disk comes out, is imaged, and the work goes on against that copy. A recorder is mostly a box around a hard drive.
It depends on disk size, the number of cameras and the bitrate they record at: a busy installation can come full circle within days. While the recorder runs, every footage case is urgent.
Loop recording is already writing over what you need, and the deadline will not move. Open a case today: the diagnosis costs nothing and stays confidential.