Taking work now — the first look is freeSpinning disks in a machine Quicker still, give us a ring:0203 0868633
ADR Advanced Data Recovery 0203 0868633 Price my job
ADR / Evidence, claims and footage / Footage from a recorder disk

Evidence work · reading the disk out of a CCTV recorder

CCTV and DVR recovery, London. Get the recorder off the mains first. Everything else will keep an hour.

Ten seconds at the socket gives you something better than anything else you could possibly do right now. It's all about the disk filling, the recorder going back to block one and laying new video over old. There is only one thing governing that order, which is age, and therefore, your ninety seconds of badly needed time ranks up alongside an empty loading bay at four on a Sunday morning. If you cut the supply then it stops where it is. Everything else is done at the bench using an image of the disk: the assessment is complimentary, the cost is £400 + VAT, you agree a figure in writing beforehand, and in most cases you only pay if we recover your data. Most of them are small sites: a security camera for a gate entrance to a yard at Brimsdown, a workshop unit off River Road in Barking, a shop unit on Harlesden High Street.

Only pay if we recover your data, on most jobs Handled as an exhibit from the moment it arrives Each hour the loop covers more of what is left

Talk it over with an engineer, in confidence
0203 0868633

The units we see most of.

Hikvision and HiLook unitsThere is nothing else that passes through in anything near these numbers. A HIKVISION signature is located at the start of each disk; after the signature there is a B-tree index; with the signature and index present, the clips come back labelled.
Dahua unitsThis make is second here for volume, but it follows a completely different setup: DHFS tables, with the video files stored as .dav files. Anything that parses is processed, and anything else is carved.
Swann, Reolink, Annke, UniviewThere are only a handful of chip sets, sitting under dozens of different badges. Remove the disk and typically the layout is something this lab has seen before, and at that point the case and the name of the case mean nothing.
Unbranded grey unitsInstalled some time ago by a company which is now closed: there is no documentation available, and there is no one who would answer your call. But inside the case there is a disk that writes video as blocks, and all that takes place here is the reading of those same blocks. None of that affects the work.

The symptom, and what to do next.

Not listed? Tell us what it does →
What is going onThe usual reason for itWhere that leaves you
Clips deleted via the menu.Only a single entry was removed from the index; the images never moved.Cut the supply today
Formatted to restore functionality to the unit.A format establishes only an empty index; whatever had been stored beneath it remains intact.Carving brings the frames back out of the image.
No light, no picture, nothing responded.Failed board. The video is saved to the disk and not to the board.Obtain a price quote first (via phone or our quote request form), then post the disk or drop it off at our Guildford intake lab, Mon–Fri 9am–5:30pm (no appointment needed). We then create an image of the disk.
This was a fortnight agoThe loop may have reached it, and that question can be answered.The free look tells you
Plays back fine; won't export.Either a bad USB port or export firmware that has stopped working.Your clips are generated from our image.
Has been requested by either a solicitor or loss adjuster.You receive native clips, MP4 versions, hash values, plus a method note.Say so when booking in.
How it reaches us: get a straight quote first (via phone or form), then send it via tracked, insured post or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed); our Guildford lab takes it in, and the cost of sending it back to you is on us. Unsure what to put with it when sending it to us? Give us a ring before sealing your box and we'll put you through to an engineer who can tell you what you need to include and what needs to stay behind. All of this information is also outlined on our guide to packing and posting.

The sequence we follow.

Other jobs on the log →
01

Logged the day it lands, and the first look costs nothing Free

As soon as your parcel arrives here, an engineer assigns a case number that same day, prior to determining what has really failed, which is the first thing done and costs you nothing. In addition to a note of what can and cannot be recovered from your drive, you will receive at the same time the fixed, written price for restoring what can be recovered. You can accept this quote, or decline it, which will result in no further obligation on your part and nothing owed to us.

Nothing to pay for lookingA single figure, put in writingNothing owed at this stage
02

Mains off, ahead of everything

Every call about footage starts the same way: unplug the recorder or pull out the disk from it. Nothing further down this page matters as much, because a recorder that still has power running through it is quietly overwriting the clip you rang about.

Mains off firstThe loop then halts
03

An image nothing can alter

The disk is connected to a hardware-based write-blocker which allows us to read from the disk but prevents any data from being written to it. We also read from the disk on a sector-by-sector basis. Upon completion of creating an image of the contents of the disk, the unit itself becomes irrelevant to our work. All subsequent processing of the contents of the disk occurs solely on the created image.

A write blocker in front of itA failed recorder is no barrier
04

The maker's tables, then carving

Each manufacturer uses different conventions when indexing their files. For example, Hikvision use a HIKBTREE index while Dahua use DHFS tables. In cases where sufficient numbers of one format remain intact, each individual clip can be delivered to you complete with details relating to both the camera used to capture them and the date/time they were captured. However, if insufficient numbers of either type remain intact, processing is stepped down a layer: rather than attempting to parse either type of table, the images are scanned instead for a specific byte pattern that always begins each compressed frame under either codec. Each clip can then be rebuilt based upon whichever frames surface during scanning.

Manufacturer tables firstFrame carving when they are gone
05

You see the file list before you pay

You will see what has been recovered as a list first, after which a bill exists. Accepting the list means that a bill will be issued. Rejecting the list means that a bill will not be issued, and in most cases you only pay if we recover your data. The recovered data travels from here back to you via new media purchased specifically for your project, with the cost of postage paid by us. Your case is not resolved (i.e., "closed") until you personally view the files on a computer of your own.

No charge until you accept the figureFresh media, supplied with the jobThe post home is ours

What the bench has learned

  • The disk drives used contain no file systems that you would recognise. How the blocks are arranged was entirely up to the disk manufacturer. When one is connected to a personal computer using Windows, Windows cannot interpret this type of disk drive, so it provides a formatting option. Consumer grade undelete utilities will provide zero results.
  • Pictures go into the blocks, names and timing tags in the index: if the index exists, all files will be delivered to you labelled and dated. If not, the video will come back regardless of the tag; however, the file will never indicate which lens recorded it or when.
  • No digital recorder weighs anything up: it always records over the oldest block next, every time. An empty hallway and the minute you called about are one and the same to a digital recorder.
  • There is authority involved also: whoever books the job must have the right to access that system. Provide the name of the owner when booking the job and, when ownership may be questionable, seek advice prior to allowing any parcel to leave your site.

On retention: in the UK there is no statutory minimum regarding how long to retain CCTV footage. There is a figure quoted among members of the public as being relevant to data protection requirements. This figure was derived from data protection guidelines indicating that footage should not be retained beyond the point of achieving its intended use: a guideline based upon purpose rather than storage. Your recorder is an arithmetic problem: cameras times bitrate, onto a disk of a given size. No one can work out this calculation over a telephone line, and there is no need for us to calculate it either: the unit already contains this information. Each camera has a playback schedule built into the unit. On that schedule, the earliest date stored is displayed. This is the only figure that anyone can truthfully provide, and it moves forward with every hour the unit remains powered.

One job, followed all the way through.

LDN · ADR-2026-3096JOB LOGGED ✓

The London shop waited nine days before asking for footage

Nine days elapsed before the adjuster requested the footage. During this time frame, the recorder remained powered. We received the disk, created an image of it, then examined the index. It was determined that the minutes in question were contained in blocks the loop did not revisit. A duplicate was prepared for viewing purposes; and a second duplicate was submitted for inclusion with the claim. Waiting for good fortune for nine days is excessive; hence why we advocate for day one and turning off the main power source.

The entire incident lifted whole off the disk3 days here, and back to you

What helps, and what harms.

Do this much first

  • Turn off the power source of the unit.
  • Record camera numbers and times.
  • Secure a price quotation first (either by phone or through using the submission form), then post the disk separately or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed). Please retain the housing portion of the unit.
  • Identify who will receive your copy; and advise us that this examination is under your authorisation.

What sets us back

  • Leaving it powered while deciding.
  • Deleting older recordings to create space.
  • Completing a firmware upgrade or performing a factory reset.
  • Performing a second attempt at an export that has previously been unsuccessful.

The questions that come up first.

Can footage deleted from a recorder be recovered?

Yes, normally. The one factor that determines it: was the electrical supply disconnected before the loop worked its way back round to that stretch of disk? Erasing a recording deletes that entry from the catalogue and does not remove that particular recording from storage. Until newer video captures that same area of storage space, it will remain exactly where it was.

And if the unit has already recorded over it?

At that point it is removed permanently. Newer video captures those areas of storage space, creating new layers without any previous layer existing underneath, neither at this location nor at any other laboratory. Therefore, there is one instruction that begins every call: disconnect the electrical supply.

The recorder has stopped working. Has the video stopped with it?

Rarely. Three components constitute a DVR: the housing, the circuit board and the hard disk. Video is only written to the third component. Thus, if a board becomes damaged beyond repair it merely presents an inconvenience rather than an impediment: the hard disk comes out, an image of it is created, and processing continues from that point onward with the image.

How long have I actually got?

These factors establish how long a DVR can hold video: capacity of the disk, total number of cameras and bitrate of each camera. Every DVR arrives at a different solution due to differing combinations of these three factors. For example, a forecourt with activity occurring across every lens returns to its initial hour much sooner than its owner estimates. The clock continues counting as long as the DVR unit remains powered.

Begin here if yours is doing the same thing.

Clips deleted, and what is left → Copies the police and insurers take → How much time is left → When the recorder disk fails → A disc nothing will open → The drive inside the machine → Work that reaches court →

Off the mains first, because that is what protects the evidence.

Regardless of what contains the evidence, turn off electrical power to it before doing anything else: a recorder still operating overwrites its oldest evidence every hour. Once power is removed, secure a price quotation (either by phone or through submitting a form), then post us just the disk or drive (do not include the recorder or computer), or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed). Evaluation costs nothing; work on recorders costs £400 + VAT and forensic analysis starts at £800 + VAT, both prices agreed to in writing beforehand. What sits on that disk stays here.

0203 0868633

Price my job Sending it to Guildford