Evidence work · disks lifted from CCTV and DVR boxes
A DVR fills its disk, then goes to the beginning of the disk and starts recording over the oldest recorded data. This device has no knowledge that the hour containing a burglary is different from the hour where there is nothing but an empty yard. If you cut the power off, wherever in the City of Hull the DVR is located, this will stop. Afterwards, all forensic analysis will need to be performed on a copy.
Ring us, in confidence
0800 6890668
| What you see | What the fault is | What to try |
|---|---|---|
| Someone removed the clips from the DVR menu | Removed clip listings but did not remove video content | Turn off power now |
| The installer reformatted the disk. | Fresh empty index placed over original video content | We extract frames off of the image |
| No lights, no output, nothing. | Video exists on disk but the electronic equipment is dead. | Disk extracted and duplicated |
| This occurred about two weeks ago | It's possible that the recorder already wrote over it and we will be able to verify. | Free diagnosis resolves this. |
| Video plays on the screen but does not export anything. | Faulty USB ports or export firmware with an error. | We pull the clips from our copy instead. |
| Either an insurance company, or a solicitor wants to view it. | Exhibit pack (original clips, MP4 copies, hashes, notes) | Tell us when you make the booking. |
Every piece of gear that shows up receives a case number on the very same day it arrives. An engineer examines it and determines what is really wrong with it and there is no charge for this. We give you straight language about which files we will be able to copy from the disk and which ones we won't be able to. Then we provide you with a single price quote, in writing, based upon these findings. We don't begin working on anything until you agree to the quoted price.
We say the exact same thing on every single footage call. Turn off the recorder, or remove the disk from the box. Nothing else we do matters as much because a recorder left running is busy overwriting the clip you came for.
We place the disk on a hardware write blocker. The imager reads every sector of the disk. There is no path for any data to go back on that disk. Once we have held that copy of the disk, the recorder does not matter and all remaining work is done on the image.
Hikvision records a HIKBTREE index. Dahua records its own DHFS tables. If either still parses, every clip will return named with the camera it was recorded from, and with the time it was recorded. If not, we carve out H.264 & H.265 frames directly off of the image and rebuild them into files that play.
You will not be charged while you think about this. First, you receive a list of everything that was recovered from the drive. Once you have seen the list and given us the go-ahead, the bill comes next. Files are returned to you on media purchased specifically for this job and we cover the return postage as well. Your job is kept open by us until you can view them on your personal computer.
Retention: there is no minimum length of time that CCTV images should be retained under UK law. The month-long period often mentioned comes from data protection guidance relating to retaining images for no longer than necessary (i.e., the "purpose"), rather than being a technical limit. How long your system retains images depends upon the number of cameras, the bitrate each camera is set to record at and the size of the disk. So plan on the bottom end.
Nine days passed before the insurance company requested the surveillance footage, and the DVR was continuously operating during that time frame. We removed the disk from the unit, made an image of the disk, parsed the index, and extracted the relevant minutes from areas of the disk the DVR had not yet reached. Two copies left here; one copy was for viewing, while the other copy was placed into the claim file.
Often we can. This depends entirely upon whether the recorder was turned off prior to the write head coming back around to those blocks. A delete removes an entry from the index. Pictures remain intact until they are overwritten by new video.
Once overwritten, there's no going back. New frame images will have replaced those older ones, which will now all be lost. No laboratory can reverse this process, ours included. That's why we always tell you to switch off your device first.
Rarely. A DVR unit consists of three separate components: the case, the main PCB (board) and the hard disk. All of your video recordings are stored within the disk. Even if the board itself is finished, it changes very little. Because we need to create an exact digital copy of the contents contained on the disk, we do not need the entire DVR unit, only the disk: we take a snapshot (image) of it, and then proceed with analysing that snapshot to complete your requested service.
Disk space, number of cameras, and camera bit rate will limit how long a recorder can record. On a busy forecourt the recording can run right round the disk in a few days. As long as the recorder is operational, treat yourself as if you have no time.
The clip you wish to obtain is currently being recorded over; the deadline has not changed. Log a job. The initial review will cost you nothing; your comments remain confidential.