CCTV footage recovery, Sydney
A DVR records in a loop. When the disk fills, it writes over the oldest footage to make room. Taking the unit out of service is the one decision that changes how much survives, and it costs nothing.
- Covers
- DVR and NVR disks, exports, cards
- Output
- Playable files and a written source record
- Reply
- Within one business day
Do this now
Before anything else
- Stop the recorder. Power it down, or take the disk out. Do not leave it recording.
- Write down the camera, the date and the time window you need, as closely as you can.
- Export the clip to a USB stick if you can still see it, then stop the unit anyway.
- Note the make and model on the front of the unit, and how many cameras it has.
- Write down who has touched it, and when. That goes in the report.
Every one of these costs footage
- Do not leave it running while you decide. It is writing over the oldest footage now.
- Do not browse the playback menus looking for the clip. Searching writes to the disk.
- Do not format, re-initialise or repair the disk.
- Do not let the installer reset the unit or update its firmware to fix it.
- Do not swap the disk into another recorder to have a look.
The clock here is the recorder, not us. Powering it down stops the loss immediately, whether or not you go any further. Reply within one business day.
Why the recorder is the deadline
A recorder writes to the disk continuously and, when it runs out of room, it writes over the oldest footage. Deleting a recording, or losing it from the playback list, does not erase the video straight away. What erases it is the recorder continuing to record.
There is no honest number of days to give you. The window depends on disk size, camera count, resolution and whether the cameras record all the time or only on motion. What is certain is the direction: every hour the unit runs, there is less to find.
What can be recovered, and what cannot
Often
Video the index has lost
Playback reads an index. When the entry goes but the video behind it has not been written over, the video can usually be carved back off the disk.
Often
Proprietary and headerless video
Most recorders write a container only their own player opens, and some write raw video with no container at all. Rebuilding those into ordinary playable files is the work.
Sometimes
Footage on a failing disk
A disk that is failing but still spinning can often be imaged in passes. A disk with a physical failure that needs a cleanroom is referred on, not opened here.
Never
Footage already written over
Once the recorder has looped past it, it is gone. No tool, no service and no amount of money brings it back, and anyone who says otherwise is selling you something.
How the work runs
Receive
The disk or the unit is logged in: what arrived, from whom, when, and what state it was in.
Image
A sector level copy is taken with the source write protected, and the copy is hashed. Nothing after this touches the original.
Carve
Video is located on the image by its own structure, then rebuilt into files that play in ordinary software.
Report
Each file is tied to where it came from on the disk, with hashes, the method, and what could not be found.
What you get, and what it does not claim
You get playable files, a written account of where each one was found on the disk, and hashes so the export can be checked later by somebody else.
Timestamps are reported as what the clock in the recorder read, not as the real time. Recorder clocks drift and many are never set. If something in shot fixes the time, say so and it goes in the report.
- No recovery is guaranteed, and no proportion of the footage is promised.
- What has been written over cannot be recovered by anyone.
- The report says what the evidence shows. It cannot promise a legal outcome.
- Enhancement has limits: a face that is four pixels wide stays four pixels wide.
What it costs
Work is quoted per matter before it starts. The rate below is what that quote is built from.
That rate is $1,000 a day. All prices are in AUD, plus GST.
The first stage is imaging the disk and establishing what is still on it. It is quoted on its own, because what the rest takes cannot be known until that is done. Stopping the recorder is free and it matters more than anything in this section.
See the rate in fullRelated work
- CCTV and access control audit so the next time the footage is there.
- Forensic data recovery when the media is not a recorder disk.
- Digital forensics for the matter the footage belongs to.
Questions asked in the first hour
How long do I have before the footage is gone?
There is no honest number of days, because it depends on disk size, camera count, resolution and whether the cameras record all the time. The rule is simpler. Every hour the recorder keeps running costs you footage. Take it out of service and the clock stops.
The footage is already missing from playback. Is it recoverable?
Sometimes. Playback reads an index. If the index entry went but the video behind it has not yet been written over, the video can often be carved back off the disk. If the recorder has looped past that point, it is gone and nothing brings it back.
Can I keep the cameras running while you look?
No. A running recorder writes over the oldest footage to make room, so leaving it on is the one thing that destroys what you came for. Take the disk out, or power the unit down, before anything else.
Is it enough to export a clip to a USB stick?
Export the clip anyway, because it costs nothing and it may be all you need. It is not the same as the disk. An export holds only what the recorder chose to write out, at the quality it chose. The disk holds what the export left behind.
Do I have to send the whole recorder?
Usually the disk is enough. Tell us the make and model when you ask. Some units keep the event database or the recording layout in their own memory, and where that is true the unit has to come too.
Will the timestamps hold up?
The report states what the clock in the recorder read, not what the real time was. Recorder clocks drift and many are never set. If something in shot fixes the time, a phone screen or another clock, say so and it goes in the report.
The video will not play on my computer. Can it be converted?
Usually. Most recorders write a proprietary container that only their own player opens, and some write raw video with no container at all. Rebuilding those into files that play in ordinary software is part of the work.
What does it cost?
Work is quoted per matter before it starts. The rate that quote is built from is $1,000 a day, plus GST. Take the recorder out of service first, then ask: that decision costs nothing and it is the one that matters most.