Hard Drive RecoveryData recovery & digital forensics

NVR · DVR · CCTV, forensic recovery

CCTV footage recovery, direct from the recorder’s drive.

Surveillance recorders don’t use ordinary filesystems. Hikvision, Dahua, Uniview, Reolink, the Xiongmai family and the many rebadges of them write proprietary formats that standard recovery software cannot read, which is why a scan of the drive so often comes back empty. Reading them is specialist work, and it’s the core of ours.

Why this is a clock, not a queue

A recorder writes in a continuous loop. When the disk is full it starts again at the beginning, overwriting the oldest footage first. It does that automatically, whether or not anyone asked it to. If the recorder is still running, it is consuming the footage you want back right now.

How a CCTV recorder overwrites its own footageA ring of recording segments. Most are still present, a growing arc has already been overwritten by the recorder writing in a continuous loop, and the write head advances into the remaining footage.
Still on the disk Already overwritten Recording now — advancing
The honest position, by situation.
SituationWhat that usually means
Deleted, or the recorder was resetOften recoverable. Deleting from a recorder’s interface typically removes the index entry, not the footage.
The recorder failed or won’t bootUsually recoverable. The footage is on the disk; the machine that reads it is what broke.
Recorder still running since the incidentEvery hour costs footage. Stop it now, then call.
Genuinely overwrittenGone. No lab can undo an overwrite, and anyone who says otherwise is selling you something.

Evidence-grade handling

  • Chain of custody from receipt

    Logged, sealed and recorded from the moment the device arrives.

  • Read-only acquisition

    The recorder's disk is imaged; all examination happens on the image.

  • Hash verification

    Acquisition hashes recorded, so exports can be shown to match the source.

  • Written report

    Device, method, what was recovered, where it came from, and the gaps.

  • Timestamp analysis

    Where it matters, whether recorded times are internally consistent.

  • Authority required

    Proof of ownership, or an instructing solicitor's engagement, before anything is touched.

Who engages us

  • CCTV and security installers

    Your client's recorder has failed, or footage they needed is already gone. We work behind you, the client stays yours, and we never approach them about anything but the job you sent.

  • Solicitors and investigators

    Defensible acquisition, chain of custody from receipt, and a written report explaining method and findings in language a court can follow.

  • Strata and facilities managers

    Incident footage from building systems, with authority handled properly before anything is touched.

  • Loss adjusters and insurers

    Independent recovery and examination of footage where a claim turns on what the cameras did or didn't capture.

Discuss a matterCall 02 9707 0999