Investigations & evidence · deleted DVR video
One question will determine whether or not your job gets done: did the recorder keep running? Stop it at the right moment and most of the time you'll have your video restored, often with channel numbers and date stamps. If you let it complete the loop, then nothing is going to bring this video back; we would much rather tell you that plainly than give you some false hope. The two possible outcomes are set out below.
A quiet word, in confidence
0800 6890668
| What's wrong | What it usually means | Step one |
|---|---|---|
| Recordings deleted using the menu or phone app | Only the catalogue was affected; the footage is likely still intact | Turn off the unit right away |
| The disk had been reformatted. Either it was done manually by an individual, or the machine did it automatically | A new empty index has been created to hold all future recording; the older video streams sit beneath it | Carving provides a fair probability of recovering the evidence |
| Recording continued uninterrupted through the deletion | Every single hour that passes, the loop erases even more of the oldest material | Do something about it now; do not wait until next week |
| Everything recorded on the disk came after this event | Likely lost; however, we check the disk before giving you a fixed quote | The diagnosis is free and the verdict honest |
| Recovered clips can be played back, however there are no timestamps on them | Carved video, which will not have the original labels from the index | Normal, and the flagging is done before you have committed |
| Recovered files from another company cannot be played back | The data was pulled off in raw stream form, but it was never reassembled | We take these raw files and convert them back into normal video |
Your device will be logged under its own case number on the day it comes into our lab. The engineer who works on your device identifies the problem with it, clearly states what we think has a good chance of coming back and provides you with one fixed quote. There are no charges for this assessment; there is no obligation for you to do anything; and paid work does not begin until you authorise us to start.
To start with, the recorder is powered down and its drive is removed (the recorder remains at your location and only the drive arrives here), and we create a read-only image of it. From that point, the loop cannot take anything further.
From the image, we search for the manufacturer's private indexing structures. If there is enough left of those indexes, then clips come back with their true channel names, dates and times, which is exactly the version evidence work requires.
When the catalogue cannot be repaired, we use sector-by-sector scanning to find H.264/H.265 video frames and then assemble them into a watchable file, and we clearly identify the recovered clips that retained the original time code information versus those that did not.
You have access to a complete list of every item recovered from your device, which you approve prior to any fees being applied. The files will be returned via new media (brand new) with the return postage paid by us, and the case remains open for as long as it takes to confirm that all the files open properly on your own machine.
The mechanism, briefly: the loop always overwrites the oldest sectors first, without regard to what data may reside in them. Therefore, a deleted file will remain recoverable only until sufficient additional recording has passed through. Powering off the device does not serve as a precautionary measure; rather, the power-off constitutes the recovery itself.
When a staff member cleaned up 'old clips', one of them included footage that captured an incident of theft. This clip survived because the recorder had been turned off that same afternoon. Four of the five missing days were recovered using the surviving index entries, with their time stamps intact. The fifth day was restored via the process of carving and was playable, but there was no label on this clip.
Most of the time. Deleting wipes the index but does not delete the video. The videos remain on the disk until the cycle repeats. Turn off the power supply to the recorder and the odds remain fair.
Newer video has actually taken the place of the older bytes, with no information underneath for it to read back. Anyone who promises otherwise will not be an engineer but someone in sales.
In most cases, if the recorder's index survived. If we have to use raw frame carving to get some of your videos, the video itself still plays, though timestamps and/or channel names may be missing, and we will indicate exactly which ones returned that way.
Days to a month (or even longer); it depends upon the number of cameras, the resolution, the size of the disk and how active your system is. The busier your system is, the quicker the recordings are going to get overwritten, therefore turn off your recorder and consider time to be ticking away.
When recorders overwrite on a loop, all recorded evidence will weaken and time limitations expire, so open your case now. The first review is completely free and confidential.