NDR / Claims, court and footage / Deleted recordings on a DVR

Investigations & evidence · recorder disks somebody erased

Deleted CCTV recovered in Nottingham. It is still on the disk; only the loop can take it off.

Cut the power now and most of it can still be recovered. That recorder has never stopped writing, which is the entire problem. What deleting from the menu removes is a single row of the catalogue; the video blocks stay put, queued for reuse and nothing worse than that. Get to the mains in time and most of what you are after comes back with the camera name and the clock on it. Let the loop get to those blocks and none of it returns at all. Looking costs nothing, the work is £400 + VAT. Disks arrive here from every sort of premises: a stable yard outside Grantham, a joiner's unit on Teal Park at North Hykeham, the back office behind a counter on Hockley in Nottingham.

On most jobs, nothing to pay if no files come back Treated as an exhibit from the moment it lands Every hour, the loop writes over more of it

An engineer will talk it through, in confidence
0115 8220606

Two routes in, and one hard limit.

Why there is an indexA table inside every DVR ties camera and time to a physical place on the drive. Delete from the menu and one line of it gets crossed out; whatever that line pointed at has not moved.

Reading it whole: the best resultWhere the table survives whole, the footage comes out in order, every clip carrying the name of the camera that shot it and the recorder's own time stamped on it. That version needs no explaining to anybody.

Carving: the next best resultWith the table gone, all that is left is a comb through the image for the markers at the head of each compressed frame, and the results get assembled into playable clips. Pictures you get. The camera names and the clock times generally stay behind.

Overwritten, and that is thatNew video in those blocks means the earlier recording is nowhere on the platter at all, with no second layer waiting underneath. Neither software nor any laboratory changes it, whatever you may be told.

What the symptom points to.

Something else? Say what it does →

What is happening	What usually causes it	What that means for you
The recordings were erased at the unit itself	A row went out of the index. The pictures did not move an inch	Unplug it now
A fault made the unit reformat itself	An empty index is all a format lays down; what sat underneath is left alone	Carving handles it, and the odds are decent
The box kept recording for days afterwards	Another hour of recording costs you another slice of the oldest material	Get the disk here today
The oldest date on the box is after the day you want	Almost certainly covered over, although the free check will say for certain	Checking costs nothing
The clips play, but carry no name and no clock	Carved video keeps the picture and drops the labels	Normal — the file list marks them
Somebody tried already, and left files nothing will open	Raw video streams came out and never went into a container	They get wrapped into MP4s, and they play

Getting it here: tracked, insured post to the intake lab, and the return leg is at our cost. Unsure what belongs in the box? Ring before it is taped up, and an engineer will run through what to include and what to keep at home. The rest of it is set out on the packing and postage guide.

The order we work in.

More jobs like this one →

Booked in the day it arrives, and the first look is on us Free

Your device picks up a case number the day it arrives, and an engineer then establishes what has genuinely gone wrong — at no cost, and ahead of everything else. Two things come back to you together: a plain account of what can be lifted and what cannot, and one fixed figure in writing. Agree to that figure, or turn it down and pay nothing.

The first look is freeOne fixed figure, in writingNo charge at this point

Halt the recorder

Power down, drive out, and a clone taken behind a hardware write blocker. From that point nothing further can go missing: whatever the loop has not yet reached is in the image, and it stays there whatever becomes of the recorder.

Mains off before anythingImaged through a write blocker

Hunt for the manufacturer's tables

All of this runs on the image. First it gets searched for the filesystem the manufacturer put down — Hikvision and Dahua each use a proprietary filesystem of their own. Where enough of that survives, clips come out named by camera and stamped with the actual recording time, and no adjuster argues with a version like that.

Clock times still on themCamera names preserved

Where nothing of the index survives

Where no structure survives to follow, the image is combed for byte markers: that fixed pattern which opens every compressed frame under either codec. Whatever surfaces gets assembled into clips any player opens. The file list separates those that kept their timing from those that did not.

The whole image combedUnlabelled clips called out

The file list comes before the bill

The file list reaches you before any invoice does. Say yes and it is billed; say no and it is not — and on most jobs, if nothing comes back there is nothing to pay. Whatever comes off goes home on media bought in for your case, carriage at our end. Nothing here is closed until you have opened those files on your own machine.

Nothing is charged until you agree the figureNew media, bought in for your jobWe pay to send it home

What turns up on recorder disks

A delete is a bookkeeping entry — one line crossed out of the index while the unit carries on exactly as before. Nothing leaves the platter.
Compressed frames all begin the same way — every frame in H.264 and H.265 opens with a fixed byte pattern a scan can find. That single fact is what makes carving possible once the index has gone.
A labelled clip speaks for itself — with the camera name and the timestamp still on it, nobody need take anybody's word for anything. That is why the two sorts arrive on separate lists: labelled on one, unlabelled on the other.
Do the arithmetic before you spend anything — capacity, bitrate and camera count together fix how far back the unit reaches. Set that against the date you need and your position is clear before you commit to a penny. It costs nothing to work out, and most jobs carry no charge where nothing comes back.

Loop recording, plainly: the drive is split into equal blocks and written from first to last. Once the last one is full the unit goes back to the first and records across whatever is there. An erased clip therefore stays readable only until the head comes back round to it. Cutting the power is not the preliminary to a recovery here. It is most of the recovery.

One of these, from start to finish.

NG · NTG-2026-1702ON THE LOG ✓

Wiped from the DVR's own menu; four of the five days came back

Unplugging the recorder within a few hours is what made this one work. Footage that looked long past its use had been deleted by a member of staff, and the only record of the theft went with it. Four of the five missing days still carried index entries and timings, which is why those clips returned with camera names and times on them. Day five came out of raw blocks instead: it plays, though there is nothing in it to say when.

4 of the five days, times intact72 hours of work on it

What helps, and what does damage.

Worth doing first

Cut the power the moment you know
Note down date, time and camera numbers
Post the disk exactly as you took it out
Say at the outset who the copy is for

What makes it harder

Waiting to see, while the loop turns
A format, to get the box working again
Running high-street undelete software on it
Taking the installer's word before an image exists

What gets asked before posting.

Is deleted CCTV footage still recoverable?

Usually. All a delete does is cross the entry out of the recorder's own catalogue. Video stays in its blocks, and goes on sitting there until the recording head comes round to that part of the platter again. Take the supply off and nothing moves.

Why can nobody get overwritten video back?

Because the newer recording is sitting in the same blocks the older one occupied, and a magnetic block holds one value, not two. Beyond that point nobody can promise you a thing, and a firm that promises anyway is selling.

Do camera names and times come back too?

Often — it depends how much of the manufacturer's index is still readable. Once a job drops as far as carving frames out of raw sectors, pictures are what you get and labelling is what you do not. Our file list marks which clips arrived without labels.

How soon does the loop get there?

Between them, camera count, bitrate and disk size decide it. Whatever anyone has told you, there is no standard figure. Put more cameras on, or more movement in front of the ones already there, and the oldest recordings go earlier.

Start here if the same thing is happening to yours.

What the recorder still holds → Copies insurers and police accept → What survives a deletion → Jobs that end up in court →

Power the recorder down before the loop reaches your clip.

Cut the power to the DVR before anything else — while it runs it keeps writing, and the oldest footage goes first. Then post it in. The first look is free, CCTV and DVR work is £400 + VAT quoted in writing before anything starts, and what is on that disk goes no further than the bench.

0115 8220606

Get my quote Posting it to Manchester

Disks, cards and whole machines

Start with what it is doing

Footage, forensics and reports

The price, and what happens next