Investigations & evidence · deleted recorder footage
The key factor is how much recording the machine has done since. When you remove a clip through the menu, the recorder takes one line of data from its storage database. Any video records are left alone until continuous recording works its way back round to that area of the disk. When you shut down early then most of your recording can be retrieved as well as the camera number and timing information (clock) with the footage. When new video has been added to the area on the disk, this will be lost forever.
Go through it with an engineer
0800 6890668
| The symptom | The likely cause | Start here |
|---|---|---|
| A user deletes clips from either the menu or application | One line in the database is removed by deletion but none of the video records are affected by this action | Switch off the recorder at this time |
| After a problem occurred, the recorder reformatted its hard drive | The formatting process is merely creating an entirely new index and nothing else | This is what carving does; we have a fair chance of getting them back |
| It was able to continue for another three days | Every additional hour of recording will eat into your oldest data | You should get a quote first, then post the hard drive to us without delay |
| Nothing in the memory of the disk occurred prior to the incident | These files probably were overwritten; our free evaluation will settle this | At no charge, we can advise you as to whether they exist |
| Video clips run, however there are no names or times associated with them | In the event that the video is carved from your disk, you will be left with all of the images, but lose all of the title information | Normal, and flagged prior to payment |
| Files from previous attempts cannot be opened | Streams were removed but not turned into files | We re-wrap these streams in MP4 files |
Nothing is chargeable until you say yes. Every item gets a case number of its own immediately upon receipt, an engineer determines what has failed, and you get a clear picture of which files have a real possibility of being recovered. The single quote that follows is fixed, written down and does not cost anything.
The unit is powered down, the disk is removed and a write-blocked image is taken. After this point, there is nothing else that can be lost; whatever was spared by the loop exists on our copy.
Working on the copy, we seek out the manufacturer's own table(s): HIKBTREE on Hikvision units, DHFS structure(s) on Dahua units. When sufficient detail has been obtained in either one of these, the export will contain the true name(s) of channels, date and time: format(s) accepted by insurance companies.
If no usable index remains, the entire image (from beginning to end) will be searched for the start code used to begin each H.264 and H.265 frame. These frames will then be compiled together in a series of clips that can be played back. A file listing will indicate which of the clips contained timing data and which ones did not.
You don't get charged anything until you've confirmed and authorised that everything is fine after seeing the entire list of what was recovered. Any recovered items are returned via brand-new storage media and the postage costs for these are covered by us. We do not consider a project complete here until we receive confirmation that you have been able to successfully access and review every item you received back.
The way the recorder works: the recorder has a set number of blocks of a certain size which get filled up in order. When the last block fills up, the recorder goes back to the first block and uses it next, whatever is held there. This means a deleted clip survives exactly as long as it takes the recorder to come back round to it, which is why switching off the recorder is not a precaution but the recovery process itself.
Four of the five lost days remained listed in the recorder's index, complete with their original timestamps, while the fifth day showed up via carving as completely usable video without any metadata. It was recovered because the recorder had been switched off that same afternoon, after a staff member had deleted a whole bunch of old clips, and one of those old clips contained footage of a theft.
Yes, in most cases. When you delete a recording you are only deleting the catalogue listing that has been made by the recorder about the recording. Therefore, the images remain in their original location until the loop reaches those locations on the disk. Cutting the power will keep them there as long as no other activity occurs.
The newer recording takes up the same space physically occupied by the previous recording; hard disks retain nothing behind them. Any statement to the contrary is sales talk rather than engineering.
Most of the time, assuming the index of images from the manufacturer is sufficient to be able to interpret. Once it goes back to carving individual frames out of sectors, you can usually get the images to play again, however the labelling associated with these images does not always go along with them, and the file listing shows which clips arrived unlabelled.
There are three main factors that affect this: how many cameras are recording, at what resolution, and onto how large a disk. This determines how long recordings are retained, which can run from a few days to several months, and the busier the site, the sooner the oldest recordings will be lost.
Recording in a loop is already overwriting your needed evidence, and the deadline will not move. There is no cost associated with opening a case today: diagnoses are free and remain completely confidential.