HDR / Evidence and legal work / Recordings deleted off a DVR

Investigations & evidence · erased recorder disks

Deleted CCTV recovery, Hull. The disk still holds it; the loop is what takes it.

The unit is still recording as you read this and that is the complete issue. Deleting via the menu removes one row from the unit's index; video blocks remain where they were, in the queue for the loop. Remove power early, and most of the footage will be returned along with their cameras and clocks. Once the loop has processed those blocks, none of it will.

Only pay if we recover your data, on most jobs An exhibit from day one It is being written over now

Ring us, in confidence
0800 6890668

Two routes in, and one dead end.

What the index doesA DVR maintains an index table which correlates each camera id / time / physical location on drive. When deleting via the menu, one line of that table is struck out. That means what that line pointed to is still on disk.

Reading it — the best outcomeWhere the entire table remains, footage is output in sequence, every clip tagged with source camera & minute recorded. None of this information needs qualifying.

Carving — the second bestWith no table remaining, the image is scanned for markers embedded in each compressed frame, and results are reassembled into clips which play. Pictures are provided. Generally, camera names & clock do not remain associated with these clips.

Overwritten — the hard stopAs soon as new video occupies those same blocks of space, the older recording is gone from the platter. There is no second copy below it. Neither software nor a lab can change this fact.

Putting a name to the symptom.

Not one of these? Ring us →

What you see	What the fault is	What to try
Someone deleted recordings off the unit	An index row went away; picture data did not.	Shut down now!
Unit reformatted after fault occurred	Formatting writes a blank index and only a little more than that	Carving takes care of that, so odds should be decent
It continued recording for days	Every hour of additional recording eats further into the oldest material	Obtain a quote first, then send the disk today
Oldest recording is later than the date desired	This has almost certainly been written over (likely due to subsequent use), although the free check confirms it.	That check doesn't cost anything.
The clips are playing without either a channel number or timestamp.	The video was carved: the original footage remains intact; however, the carving does not keep the labelling.	As expected, this has already been documented and listed on the file list.
All files from previous attempts cannot be opened.	Although raw video streaming data was pulled, it was not ever converted into a containerised format.	So we put them in an MP4 wrapper which plays.

Sending it to us: ring first or fill out the form to request a quote. Send the recorder disk (or camera card) via post to the Leeds intake laboratory (insured and trackable). Alternatively, drop the recorder disk (or camera card) off there, Monday to Friday, 9am to 5:30pm. No appointment needed. We pay for its return journey. Call prior to sending if you would like one of our staff to check the packaging with you. All information about how to send is on the sending page.

The stages, one by one.

The casebook in full →

A case number first, then a free diagnosis Free

Every piece of gear that shows up receives a case number on the very same day it arrives. An engineer examines it and determines what is really wrong with it and there is no charge for this. We give you straight language about which files we will be able to copy from the disk and which ones we won't be able to. Then we provide you with a single price quote, in writing, based upon these findings. We don't begin working on anything until you agree to the quoted price.

The diagnosis is freeOne price, put in writingNothing to pay yet

Stop the disk

Switch off the recorder, remove the drive, and use a write blocker to create an image. At this point no further loss is possible: all blocks that had been written onto at the time of the loop recording (but which had not yet cycled) are now preserved in that image.

Unplugged firstWrite-blocked copy

Read the index

From that point forward, everything else is done on that image. We go looking for the maker's own filesystem: a Hikvision's HIKBTREE, a Dahua's DHFS. If sufficient of that filesystem survives, then the final output will include the true channel name and the actual recording date/time. This is the copy which can be taken by a loss adjuster without any question.

Timestamps intactCamera labels restored

When no index is left

Since we don't know where anything goes, we search the entire image for those byte patterns which identify when each compressed frame begins (H.264 and H.265). And then we assemble these compressed frames into clips which your standard media player will be able to run. Then the file list will also show whether any of the recovered clips contained valid timestamps or if they did not.

Whole-image frame scanUnlabelled clips flagged

You sign it off, then it comes back

You will not be charged while you think about this. First, you receive a list of everything that was recovered from the drive. Once you have seen the list and given us the go-ahead, the bill comes next. Files are returned to you on media purchased specifically for this job and we cover the return postage as well. Your job is kept open by us until you can view them on your personal computer.

You approve the listing firstCopied onto new mediaReturn postage at our cost

What we see on the bench

A deletion is just an accounting record: the unit removes one line from its directory listing and continues recording. Nothing ever leaves that disk!
Frames always start the same way: H.264 and H.265 frames all start with a fixed byte pattern; therefore scanning for these is how we are able to carve out individual frames from an otherwise completely unstructured collection of bytes. This is why carving works even without having access to an index table.
Labels save you explaining: a clip that still contains its channel name and/or timestamp requires virtually no explanation, hence labelled and unlabelled clips are returned on two separate lists.
First do the maths: camera(s), bitrate and disk size collectively determine how far back a device can capture. Compare this to the date you require and you'll know if you can recover prior to even discussing cost.

Loop recording, plainly: the disk is divided into equal sized blocks that are filled sequentially from first to last. Upon reaching the final block, the recorder begins writing over the contents of the first block. Therefore deleted clips exist solely until the write head reaches that location on the disk. Disconnecting power is not just a precaution before the recovery. In fact, disconnecting power is most of the recovery.

One case from the casebook.

HU · HUL-2026-0552LOGGED ✓

A wiped week, and most of it back for a Newland Avenue shop

Someone behind the counter deleted footage that appeared to be long past use. However, the theft itself appeared in the middle of it. What preserved it was the recorder being stopped in the next several hours. For four of the five missing days the index entries for each day and their timestamps remained intact. The fifth day returned as "carved" video; it played, however, none of the video indicated its name.

4 of the 5 missing days, timestamps and all72 hours of bench time

Before you box it up.

Do these first

Power off immediately upon learning of loss of video content
Document date/time and camera number(s)
Obtain a quote prior to sending the disk exactly as it came out of the unit
Identify ahead of time who the recovered video content is for

What not to do

Waiting to recover while allowing the loop to continue writing
Initialising or formatting media to allow unit operation
Using commercial undelete software to attempt restoration
Accepting the installer's claims regarding recovery without having first captured a copy of the contents

What we get asked on the phone.

Can you get back CCTV that has been deleted?

Usually, yes. A delete will remove a recorder's catalogue listing for an item (and do nothing with the image) and leave the images in place on the disk until they are hit by a later loop pass. If you cut off the power, those images will never move again.

Why is overwritten video unrecoverable?

A new recording will go into the exact same space that the previous recording occupied, and a single state (a single set of bits) exists per block on a platter. Once this has occurred no one can guarantee what will happen when attempting to recover the original recording and anyone who claims to be able to guarantee results is a salesman.

Do the timestamps and channel names survive?

Often, if enough of the manufacturer's index remains legible. When carving individual frames from a series of unindexed raw sectors (as opposed to reading directly from indexed ones), the picture comes back, but typically the labels associated with the frame(s) will remain unreadable. The file list sent out includes information regarding which segments arrive with or without the label attached.

How soon does the loop write over it?

There is no universal rule for how long your oldest footage can last before being overwritten. It all depends on the number of cameras you have recording, the bitrate each camera is set to, as well as the overall capacity of your hard drive. The more cameras you add to the mix and/or the greater amount of motion you ask the cameras to capture, the less time you'll have before one of your older recordings is overwritten.

What people read after this.

Video off recorders → Clips for an insurer or the police → Deleted by mistake → Forensics and evidence →

The recorder is overwriting it now.

The clip you wish to obtain is currently being recorded over; the deadline has not changed. Log a job. The initial review will cost you nothing; your comments remain confidential.

0800 6890668

Price it up How to post it to us

Devices and media we work on

Sorted by fault

Forensic and CCTV evidence

What to expect