An Exeter shop burgled, with the DVR still running
The insurance company asked to see the footage after the recorder had looped (and overwritten) for nine days. The DVR hard drive was copied in its entirety (imaged), its file directory was read (decoded), and the time frame of interest was located on sectors that were still intact, since they hadn't yet been overwritten. Two copies of this data were made; one copy is for review purposes and the other is for submission as part of an insurance claim.