NDR / Claims, court and footage / Deleted recordings on a DVR

Investigations & evidence · recorder disks somebody erased

Deleted CCTV recovered in Nottingham. It is still on the disk; only the loop can take it off.

If you cut the power immediately, most of it will be recoverable. The recorder is continuing to write information. Removing entries from your menu simply deletes an entry within the record but does not delete the video block itself, which just waits to be reused. If you get to the mains before the loop reaches these blocks, most of your footage can be recovered and will include both your camera name and the date and time it was recorded. If the loop reaches them first, then nothing can be recovered. There is no cost to look. The work is £400 + VAT. Disks arrive here from many types of premises, such as a stable yard near Grantham, a joiner's unit on Teal Park at North Hykeham and an office behind a shop front on Hockley in Nottingham.

Only pay if we recover your data, on most jobs Treated as an exhibit from the moment it lands Every hour, the loop writes over more of it

An engineer will talk it through with you, in confidence
0115 8220606

Two routes in, and one hard limit.

Why there is an indexEvery digital video recorder (DVR) includes an internal table relating the camera and time to the actual location on the disk. Remove a particular item from the menu and that will cross through one line of that table; however, the information it referenced remains intact in its original position.

Reading it whole: the best resultIf the table is preserved as a whole, each segment of footage returns in chronological order along with the name of the camera which captured it and the recorder's own time stamp. This version does not need to be explained to anybody.

Carving: the next best resultWhen the table is gone, the next action is to look for the identifier located at the beginning of each compressed frame within the image. What turns up is assembled into playable segments of video. You get your images. In most cases, the camera identifiers and time stamps do not come with them.

Overwritten, and that is thatIf additional video has been recorded in these blocks, all prior recordings are absent from the disk, and there is no underlying layer below this new recording. No software or laboratory can alter this fact, regardless of any claims otherwise.

What the symptom points to.

Something else? Say what it does →

What is happening	What usually causes it	What that means for you
The recordings were erased at the unit itself	In effect, a line was removed from the index. The pictures have not moved one inch	Unplug it now
A fault made the unit reformat itself	A format only lays down an empty index; what sat underneath is left alone	Carving handles it, and the odds are decent
The box kept recording for days afterwards	Each extra hour of recording uses up another slice of your oldest material	Get a quote and the disk here today
The earliest date on the box is after the day you want	Almost certainly recorded over, although the free check will confirm it	Checking costs nothing
The clips play but carry neither camera name nor date and time	Carved video keeps the picture and drops the labels	Normal: the file list marks them
Somebody tried already, and left files nothing will open	Raw video streams came out without ever going into a container	They get wrapped into MP4s, and they play

Getting it here: first of all you need to get a quote, either by phone (0115 8220606) or through the online form. Once you have your quote, send it to our intake lab by tracked, insured post: Manchester Data Recovery, Peter House, Oxford Street, Manchester M1 5AN. Alternatively, you can drop it in there Monday to Friday, 9am to 5:30pm, without booking an appointment. Postage to return your data once recovered is paid for by us. If you are unsure what should go in the box and what should stay at home, contact us before sealing it and one of our engineers will walk you through exactly what needs to be sent and what can be left behind. All other details on packing and postage can be found in our packing and postage guide.

The order we work in.

More jobs like this one →

Booked in the day it arrives, and the first look is on us Free

Your case number is assigned when the item is received. Then an engineer works out what went wrong (no charge). At this point, you receive a basic summary of which parts are recoverable and which are not. You also receive a single written quote for the price of the recovery. Accept the quoted price or turn it down, and there is no obligation to pay anything.

The first look is freeOne fixed figure, in writingNo charge at this point

Halt the recorder

Shut off your system, pull the hard drive and make an exact copy (clone) behind a hardware write blocker. Once the clone is made, nothing more can be lost: anything the loop has not reached at this point is already in the image, and it stays there whatever happens to the recorder.

Mains off before anythingImaged through a write blocker

Hunt for the manufacturer's tables

Work is done entirely on the image. First we look for the filesystem used by the manufacturer (Hikvision uses its own proprietary filesystem; Dahua does too). If enough of it survives, individual clips come out named by camera, with the actual time stamp of the recording. No adjuster will argue over a version like that.

Clock times still on themCamera names preserved

Where nothing of the index survives

If too little of the filesystem remains to follow, the entire image is scanned for byte patterns. These patterns mark the beginning of each frame under both codecs. All frames that turn up are arranged in playable files that any player recognises. The file list marks which files kept their original timing and which did not.

The whole image combedUnlabelled clips called out

The file list comes before the bill

A complete file list will be provided before any invoicing. Simply say "yes" or "no" to what we found: yes means it is billed, no means it is not, and in most cases you only pay if we recover your data. What we find is posted to you on media purchased specifically for your case, at no additional cost to you. We consider the process complete once you have opened those files yourself on your own computer.

Nothing is charged until you agree the figureNew media, bought in for your jobWe pay to send it home

What turns up on recorder disks

A delete is simply a record entry: one line is removed from the index, while the unit carries on running just as it did before. Nothing is removed from the platter.
Every compressed frame starts the same way: in H.264 and H.265, each frame begins with a fixed byte pattern a scan can find. That is what makes carving possible after the index is lost.
A labelled clip speaks for itself: with the camera name and timestamp still on the clip, there is no need for anyone to rely on anyone else's word. That is why labelled clips go on one list and unlabelled clips on another.
Do the maths before you spend anything: capacity, bitrate and camera count together decide how far back the unit goes. Compare that with the date you need and you know where you stand before committing a penny. Working it out costs nothing, and in most cases you only pay if we recover your data.

Loop recording, plainly: the drive is split into blocks of the same size, and they are filled in order. When the last block is full, the recorder goes back to the start of the drive and records over whatever is there. So an erased clip stays readable only until the head comes back round to it. Cutting the power is not a preliminary to the recovery here; it is most of the recovery.

One of these, from start to finish.

NG · NTG-2026-1702ON THE LOG ✓

Wiped from the DVR's own menu; four of the five days came back

Unplugging the recorder within a few hours is what made this one work. A member of staff had deleted footage that looked long past its use, and the only record of the theft went with it. Four of the five missing days still had their index entries and timings, so those clips came back with camera names and times on them. Day five was recovered from the raw blocks instead: it plays fine, but there is nothing on it to say when it was recorded.

4 of the five days, times intact72 hours of work on it

What helps, and what does damage.

Worth doing first

Cut the power the moment you know
Note down date, time and camera numbers
Get a quote, then post the disk as you took it out
Say at the outset who the copy is for

What makes it harder

Waiting to see, while the loop turns
A format, to get the box working again
Running high-street undelete software on it
Taking the installer's word before an image exists

What gets asked before posting.

Is deleted CCTV footage still recoverable?

Most of the time. All deleting does is remove the entry from the recorder's own catalogue; it doesn't touch the video itself. That just sits in its blocks until the recording head comes round to that part of the platter again. Disconnect the power and nothing moves.

Why can nobody get overwritten video back?

Because the new recording uses the same blocks the old one occupied, and a magnetic block holds only one value, not two. Beyond that point nobody can promise you anything, and a firm that promises anyway is selling.

Do camera names and times come back too?

Often; it depends on how much of the manufacturer's index is still readable. Once a job gets as far as carving frames out of raw sectors, you are looking at getting pictures, not labels. Our file list marks which clips came back without labels.

How soon does the loop get there?

The three variables are camera count, bitrate and disk size. Whatever anyone tells you, there is no standard figure. Add more cameras, or more movement in front of the ones you have, and your oldest recordings go sooner.

Start here if the same thing is happening to yours.

What the recorder still holds → Copies insurers and police accept → What survives a deletion → Jobs that end up in court →

Power the recorder down before the loop reaches your clip.

Remove power from the DVR before you do anything else: as long as it is powered, it keeps writing, and the oldest footage goes first. Then get a quote and post the disk in. The first look is free. CCTV and DVR work is £400 + VAT, quoted in writing before any work starts, and anything recovered from the disk goes no further than our bench.

0115 8220606

Get my quote Posting it to Manchester

Disks, cards and whole machines

Start with what it is doing

Footage, forensics and reports

The price, and what happens next