Taking work now — the first look is freeSpinning disks in a machine Quicker still, give us a ring:0203 0868633
ADR Advanced Data Recovery 0203 0868633 Price my job
ADR / Evidence, claims and footage / Erased recordings on a DVR

Investigations & evidence · disks a recorder has erased

Deleted CCTV footage recovery, London. The pictures have not moved. Only the loop erases them.

Turn off the main supply now and much of your data will still be recoverable. The problem is that the recorder has continued to write ever since. Deleting one entry from the menu removes one catalogue listing, but it doesn't remove the video block or move it; it simply leaves it queued, waiting to be used again. If you reach the plug before these blocks have been overwritten by new loops, then most of what you want to retrieve will be available, with the camera name and clock reading attached. However, if you leave the loop long enough so that it overwrites them, there won't be anything left. The look itself is free; however, you'll be charged £400 + VAT for the work. Disks come from all sorts of premises: examples include a scaffolding yard near Rainham, a joinery unit on the Redburn estate at Ponders End, and the back office of a salon on Ealing Road at Alperton.

Only pay if we recover your data, on most jobs Handled as an exhibit from the moment it arrives Each hour the loop covers more of what is left

Talk it over with an engineer, in confidence
0203 0868633

Two ways in, and one hard limit.

Why an index existsEach digital video recorder maintains a table which links a particular camera and time to a specific location on a hard disk. Deletion via the menu deletes one line from this table. It does not affect what the deleted line points to.
Reading it intact: the best outcomeWhen the table remains intact, recovered footage is returned in sequence. Each segment of recovered footage retains its original camera identification and timestamp. This sort of recovery requires no explanation to anyone.
Carving: the second-best outcomeIf the table is lost, the only method of recovering footage is to search through the image for the marker that opens each compressed frame, and assemble these segments into sequences that can be played. What you do get back is the picture. Most of the time, camera names and timestamps are left behind.
Overwritten, and that is the endIf these blocks are holding new video, there is nothing from the original recording left on the platter, and no secondary layer below. Software does nothing and no lab changes this fact, whatever you have been told otherwise.

What the symptom usually means.

Not listed? Tell us what it does →
What is going onThe usual reason for itWhere that leaves you
Someone removed the recordings at the unitThere was one line missing from the index. The pictures themselves had not movedPower it off now
A fault led to a reformat of the unitA format establishes only an empty index; whatever had been stored beneath it remains intact.Carving can handle it, and it generally performs well
This unit continued to record for days afterFor every additional hour of recording, one additional section of the oldest material is consumedPost the disk today
The earliest date shown on this unit is after the date you needIt was almost certainly overwritten; however, a free check will determine whether or not it remains intactThe check costs nothing
The clips play; however, there is neither a camera name nor a time on themCarved video continues to display images, but loses the labelsAs expected: the file list identifies them
Someone worked on it before leaving files that nothing will openUnwrapped video streams that have been stored without being placed in a wrapperThey are then wrapped in MP4s and they play properly
How it reaches us: get a straight quote first (via phone or form), then send it via tracked, insured post or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed); our Guildford lab takes it in, and the cost of sending it back to you is on us. Unsure what to put with it when sending it to us? Give us a ring before sealing your box and we'll put you through to an engineer who can tell you what you need to include and what needs to stay behind. All of this information is also outlined on our guide to packing and posting.

The sequence we follow.

Other jobs on the log →
01

Logged the day it lands, and the first look costs nothing Free

As soon as your parcel arrives here, an engineer assigns a case number that same day, prior to determining what has really failed, which is the first thing done and costs you nothing. In addition to a note of what can and cannot be recovered from your drive, you will receive at the same time the fixed, written price for restoring what can be recovered. You can accept this quote, or decline it, which will result in no further obligation on your part and nothing owed to us.

Nothing to pay for lookingA single figure, put in writingNothing owed at this stage
02

Stop the recorder

The power is shut off, the hard drive removed, and an exact copy made using a hardware write blocker. After that nothing further can be lost: everything that has not yet been reached by the loop will now remain in the image. Regardless of what else may happen to the DVR, everything that has been copied onto the image will remain there.

Off the mains first of allWrite-blocked while it was cloned
03

Find the maker's own tables

All subsequent processing occurs directly upon the image. The first pass attempts to locate the file system installed by the manufacturer (HIKBTREE if it is a Hikvision DVR and DHFS if it is a Dahua). If sufficient information survives from the original file system, each clip will include the name of its associated camera and a true recording time stamp, and an adjuster will not contest such a version.

Recording times still on themCamera names kept intact
04

When no index survives at all

If there is no remaining evidence of a file system, we use byte marker identification to find common patterns at the beginning of every compressed frame within either codec. All identified frames are combined together to form clips that any standard video player can load. Clips that retained their recording time stamps are listed separately from those that did not.

The entire image combedUnlabelled clips flagged up
05

You see the file list before you pay

You will see what has been recovered as a list first, after which a bill exists. Accepting the list means that a bill will be issued. Rejecting the list means that a bill will not be issued, and in most cases you only pay if we recover your data. The recovered data travels from here back to you via new media purchased specifically for your project, with the cost of postage paid by us. Your case is not resolved (i.e., "closed") until you personally view the files on a computer of your own.

No charge until you accept the figureFresh media, supplied with the jobThe post home is ours

What the bench has learned

  • A delete operation does not physically alter data: it simply deletes an item from the directory listing while the physical media on which the data resides remains untouched.
  • Each compressed frame starts with the same signature: in H.264 and H.265 all frames begin with a consistent set of bytes, so once we identify these bytes, we can carve. For that reason alone, we do not require the existence of an index to perform carving.
  • A labelled clip requires no additional verification: the camera name and recording time stamp remain intact. Therefore, we create two separate listings: all labelled clips appear on the first list, and all unlabelled clips appear on the second list.
  • Do the maths before you spend anything: how far back will this thing go? Camera count, bitrate and capacity together decide how far back the device will reach. Compare the date when you need access to the recorded information with how far back the device can read. This will tell you where you are without spending money. The sum costs nothing, and in most cases you only pay if we recover your data.

Loop recording, plainly: the drive is broken up into equal sized pieces called "blocks". The data fills these blocks in order, from the first, until all the space in each block has been used. When the last block is completely written to, the unit goes back to writing over the first block. An erased clip therefore lasts exactly as long as it takes for the head to circle around again. Cutting power is not merely a step before a recovery; it is essentially the bulk of the recovery process.

One job, followed all the way through.

LDN · ADR-2026-3102JOB LOGGED ✓

Deleted through the DVR menu itself, and four days of the five returned

Fortunately, the plug was pulled out of the video recording equipment within a few hours. A member of staff had deleted footage that everyone assumed was long past keeping, and the only record of what happened in the shop went with it. Fortunately, index entries and timestamps had survived for four of the five days of activity captured by those cameras. Therefore, the video recordings for those days came back with information identifying the cameras and showing the actual dates and times captured. For day five, however, all blocks of data representing that day had to be recovered using raw block carving techniques, since no indexes or timestamps existed to identify individual video segments. While the resulting videos exist and can play back content, no timestamp information exists for that specific day.

4 days of five, timings intact72 hours at the bench

What helps, and what harms.

Do this much first

  • Turn off the power as soon as you find out
  • Note the time, date and camera numbers
  • Get a quote first (by phone or using the form), then send in the disk as it is or drop it off at our intake lab in Guildford (no appointment required)
  • Tell us who the copy is for from the start

What sets us back

  • Sitting around waiting while the loop turns
  • Reformatting it to get the unit working again
  • Using consumer undelete software on the drive
  • Trusting the installer before an image exists

The questions that come up first.

Can footage deleted from a recorder be recovered?

Yes, in general. Delete means only that the entry will be deleted from the catalogue kept by the recorder. Video will remain within those sections (blocks) of the video disk and wait there until the record head again passes through that area. When power is removed nothing moves; nothing changes.

Why can nobody bring overwritten video back?

Newer content now occupies the same blocks used by previous content, and a single magnetic block contains a single value. Beyond that, no promises can be made, and anyone making such promises is selling.

Do the camera names and times return?

Frequently; it depends upon how much of the manufacturer’s index can be read. Once a job drops to carving frames out of bare sectors, all that comes back is images and none of the labelling. File lists contain information about which clips were returned with no label information.

How fast does the loop get there?

Ultimately camera count, bitrate and storage capacity settle it between them. There is no industry standard number that determines this, whatever you may have been told. Adding additional cameras or increasing motion in front of the existing cameras causes earlier recordings to disappear sooner.

Begin here if yours is doing the same thing.

What is still on the recorder → Copies the police and insurers take → What is left after a delete → Work that reaches court →

Off the mains first, because that is what protects the evidence.

Regardless of what contains the evidence, turn off electrical power to it before doing anything else: a recorder still operating overwrites its oldest evidence every hour. Once power is removed, secure a price quotation (either by phone or through submitting a form), then post us just the disk or drive (do not include the recorder or computer), or drop it off at our Guildford intake lab, Monday to Friday, 9am to 5:30pm (no appointment needed). Evaluation costs nothing; work on recorders costs £400 + VAT and forensic analysis starts at £800 + VAT, both prices agreed to in writing beforehand. What sits on that disk stays here.

0203 0868633

Price my job Sending it to Guildford