Told your CCTV footage was recorded over? We recover what the recorder did not reach.

A recorder writes in a continuous loop. When the disk is full it starts again at the beginning, overwriting the oldest footage first. It does that automatically. Every hour the unit stays powered on, it writes over more of what you are trying to keep.

Stop it. Then call. Stopping it costs nothing and is worth more than any expedited handling. Do not let someone “export from the menu” if that rewrite is still looping.

If it has already lapped, that is not the end of the job. A recorder that has lapped writes over the start of each zone, not the whole of it. What we get back after an overwrite.

This is where most people are turned away. The question nobody asks them is whether the recorder replaced the footage itself, or left parts of it untouched.

A recorder does not overwrite footage neatly. It claims space in large fixed zones and writes into a zone until it moves on to the next one. When a zone is only part filled, the rest of it is never touched. The older recording is still sitting in that tail, behind the write pointer, exactly as it was left.

So a drive that has lapped is not a blank drive. It is a drive holding thousands of part used zones, each with an untouched tail on the end of it.

Read straight off that recorder's own allocation table, before carving a single byte:

• 7 minutes 49 seconds of 4K video, decoded from a 200 MB sample of surviving older footage
• 10.74 GB of older footage still readable, across 3,705 recording zones
• measured before the work started, so the job was costed on a real number

A separate case. On another recorder the unit's own index had stopped listing footage that was still on the platters, and we recovered 94,104 clips it no longer claimed. Those clips are older than the footage now occupying their space, which is what the method predicts, and we checked that rather than assuming it: it held on 98.8 per cent of them. That is a check on the method, not a recovery rate, and the two recorders above are two different jobs.

The honest limit. The part of each zone the recorder has genuinely written over is gone, and nobody can bring that back. What survives is the untouched remainder. We will not promise a specific minute before reading the drive, which is what the free written assessment is for.

A damaged file table hides files that are still on the drive. Windows reports it as raw or unformatted, consumer software finds nothing, and standard forensic tools refuse to parse it at all. The catalogue that lists the files is what broke, not the files.

Each file on an NTFS disk keeps its own record, and those records survive independently of the table that indexes them. We rebuild the catalogue from the records themselves.

On a 320 GB drive with both copies of the file table destroyed:

• 344,154 surviving file records read directly off the platter
• 74,138 files, 46.68 GB, extracted and readable
• 111,895 deleted filenames recovered from directory records
• imaged with zero read errors

Where a drive reads clean, we verify the copy by matching its hash against the hash of the original — that check is what proves a copy is a true copy. Where a drive does not read clean, the ranges we could not read are recorded and named, never quietly filled and counted as recovered. You are told which you got. That is the difference between a recovery you can rely on and one you cannot.

We copy the recorder's drive first, then recover from the copy. Where the video stream survives, we rebuild playable copies on new media.

Surveillance recorders do not use ordinary filesystems. Hikvision, Dahua, Uniview, Reolink, the Xiongmai family and the many rebadges write proprietary formats that standard recovery software reads as empty. Parsing them as the formats they are, rather than carving blindly and calling the result a success, is the core of this work.

Deleted on a recorder usually means the index entry went, not the footage. A dead recorder often leaves the disk intact. The bytes new recordings actually replaced are gone; the older footage left in the untouched part of each zone is not.

Authority is required before anything is touched: proof of ownership, or an instructing solicitor. Installers stay in front of their client. We do not approach that client about anything but the job you sent.

We do not run a cleanroom. Mechanical failures (clicking, non-spinning, head crash) are referred after free assessment. We will not open the drive on a bench and make it worse.