Taking work now — the first look is freeSpinning disks in a machine Quicker still, give us a ring:0203 0868633
ADR Advanced Data Recovery 0203 0868633 Price my job
ADR / Evidence, claims and footage / Erased recordings on a DVR

Investigations & evidence · disks a recorder has erased

Deleted CCTV footage recovery, London. The pictures have not moved. Only the loop erases them.

Get the power off now and a good deal of it is still recoverable. The whole difficulty is that the recorder has not stopped writing since. A menu delete strikes out one line of the catalogue; the video blocks are left exactly where they lie, queued for reuse and no worse off than that. Reach the socket in time and most of what you want returns, camera name and clock reading attached. Leave the loop to arrive at those blocks and nothing returns. The look is free; the work costs £400 + VAT. Disks come from premises of every kind — a scaffolding yard at Rainham, a joiner's unit on the Redburn estate at Ponders End, the back office of a salon on Ealing Road at Alperton.

No fee at all on most jobs if the files do not return Handled as an exhibit from the moment it arrives Each hour the loop covers more of what is left

Talk it over with an engineer, in confidence
0203 0868633

Two ways in, and one hard limit.

Why an index existsEvery DVR keeps a table that ties a camera and a time to one physical place on the drive. Delete at the menu and a single line of that table is crossed through; what the line pointed at has not moved.
Reading it intact: the best outcomeWhere the table survives intact, footage returns in order, each clip labelled with the camera that recorded it and the time the unit stamped on it. A version like that needs no explanation to anybody.
Carving: the second-best outcomeOnce the table has gone, the remaining route is to comb the image for the marker opening each compressed frame, and what that finds gets assembled into clips that play. The picture you get. Camera names and clock readings usually stay behind.
Overwritten, and that is the endWhere those blocks hold new video, nothing of the older recording is left on the platter, and no second layer waits underneath. Nothing in software and no laboratory alters that, whatever you may be told.

What the symptom usually means.

Not listed? Tell us what it does →
What is going onThe usual reason for itWhere that leaves you
Somebody erased the recordings at the unitA line came out of the index. The pictures never shiftedPower it off now
A fault caused the unit to reformatAll a format lays down is an empty index; whatever sat underneath it is untouchedCarving handles it, and usually does well
The unit went on recording for days afterEvery further hour of recording eats another slice of the oldest materialPost the disk today
The earliest date on the unit falls after the day you needAlmost certainly written over, but the free check will confirm it either wayThe check costs nothing
The clips play, but with no camera and no timeCarved video keeps pictures and loses the labelsUsual — the file list flags them
Somebody had a go and left files nothing will openBare video streams that were never put into a wrapperWe wrap them into MP4s and they play
How it reaches us:send it by tracked, insured post; Guildford takes it in, and the leg home is on us. Unsure what should travel with it? A call before the box is sealed will get you an engineer who can say what to include and what stays behind. The whole of it is spelled out on theguide to packing and posting.

The sequence we follow.

Other jobs on the log →
01

Logged the day it lands, and the first look costs nothing Free

A case number goes on it the day the parcel lands, and an engineer settles what has truly failed before anything else happens — free of charge, and first in the order of work. Back to you come two things together: a straight note of what is liftable and what is not, plus one figure, fixed and written down. Accept it, or decline and owe us nothing.

Nothing to pay for lookingA single figure, put in writingNothing owed at this stage
02

Stop the recorder

Power down, disk out, and a clone made with a hardware write blocker in front of it. Nothing further can be lost after that: what the loop has not yet reached sits in the image, and stays there regardless of what happens to the recorder.

Off the mains first of allWrite-blocked while it was cloned
03

Find the maker's own tables

Everything from here runs on the image. The first pass looks for the file system the manufacturer put down — HIKBTREE where the unit is a Hikvision, DHFS where it is a Dahua. Where enough of it has survived, each clip emerges with its camera named and the true recording time stamped on it, and an adjuster will not argue with a version like that.

Recording times still on themCamera names kept intact
04

When no index survives at all

With no structure left to work from, the image gets combed for byte markers — the fixed pattern at the start of every compressed frame in either codec. Whatever comes up is assembled into clips that any player opens. The file list keeps the ones that held their timing apart from the ones that did not.

The entire image combedUnlabelled clips flagged up
05

You see the file list before you pay

What was recovered is listed for you first, and only then does a bill exist. Approve the list and it is invoiced; turn it down and it is not — and where nothing has come back, most jobs carry no charge whatever. Recovered data travels home on fresh media bought in for your job, with the postage at our end. Your case is not closed until you have read those files on a machine of your own.

No charge until you accept the figureFresh media, supplied with the jobThe post home is ours

What the bench has learned

  • Deletion is a bookkeeping entry — one line removed from the index, while the unit itself carries on unchanged. Nothing leaves the platter.
  • Compressed frames all start alike — in H.264 and in H.265 every frame opens on the same fixed byte pattern, which a scan will find. Carving works after the index has gone for that reason alone.
  • A labelled clip speaks for itself — camera name and timestamp still attached, and nobody need take anybody's word for anything. Hence two lists rather than one: labelled clips on the first, unlabelled on the second.
  • Do the arithmetic before spending anything — capacity, bitrate and camera count together determine how far back the unit still reaches. Measure that against the date you need and you know your position before a penny is spent. The sum costs nothing, and where nothing comes back most jobs are not charged for.

Loop recording, plainly: the drive is cut into equal blocks and filled in order from the first. Once the last of them is full the unit returns to block one and writes across what it finds there. An erased clip therefore lasts exactly as long as it takes the head to come round again. Cutting the power is not a step ahead of a recovery. It is the bulk of the recovery.

One job, followed all the way through.

LDN · ADR-2026-3102JOB LOGGED ✓

Deleted through the DVR menu itself, and four days of the five returned

What saved this one was the plug coming out of the recorder within a few hours. A member of staff had deleted footage everyone assumed was long past keeping, and the only record of what happened in the shop went with it. Index entries and timings had survived on four of the five days, so those clips returned carrying camera names and clock times. Day five had to be carved from raw blocks: it plays, but nothing in it says when.

4days of five, timings intact72hours at the bench

What helps, and what harms.

Do this much first

  • Cut the power the moment you find out
  • Write down date, time and camera numbers
  • Post the disk in the state it left the unit
  • Say who the copy is for from the start

What sets us back

  • Waiting and watching while the loop turns
  • Formatting it to get the unit working
  • Running consumer undelete software over it
  • Trusting the installer before an image exists

The questions that come up first.

Can footage deleted from a recorder be recovered?

As a rule, yes. Deleting only crosses the entry out of the catalogue the recorder keeps. Video stays in its blocks and sits there until the recording head works its way back round to that part of the platter. Cut the supply and nothing shifts.

Why can nobody bring overwritten video back?

Because newer recording now occupies the same blocks the older one held, and one magnetic block holds a single value. Beyond that nobody can make you a promise, and any firm that makes one is selling.

Do the camera names and times return?

Frequently — it turns on how much of the maker's index is still readable. Once a job has dropped as far as carving frames out of bare sectors, pictures are what comes back and labelling is what does not. The file list identifies the clips that came back without labels.

How fast does the loop get there?

Camera count, bitrate and capacity settle it between them. No standard figure exists, whatever you may have been told. Add more cameras, or more movement in front of the existing ones, and the earliest recordings disappear sooner.

Begin here if yours is doing the same thing.

What is still on the recorder → Copies the police and insurers take → What is left after a delete → Work that reaches court →

Off the mains first, because that is what protects the evidence.

Whatever holds the evidence, take it off power before anything else — a recorder that is still running overwrites its own oldest material, hour by hour. Send it to us after that. Looking costs nothing; recorder work is £400 + VAT and forensic instructions start at £800 + VAT, both settled in writing beforehand. What sits on that disk stays here.

0203 0868633

Price my job Sending it to Guildford