Data Recovery Case File · Trust, Practice & Honest Limits · Overwritten, Not Deleted

DVR Hard Drive: Footage Older Than the Loop

His enquiry was two sentences and contained its own answer, which is why it belongs in the archive — because the answer is no, and the reason is worth understanding by anyone who relies on a recorder. "There is a DVR hard drive. Could you recover a four-month-old recording? The DVR records only one month." He has stated the capacity and the age of the footage he wants, and the gap between them is the whole case. This is not a question of equipment or expertise or budget. A recorder that holds one month has, in the four months since, written over that footage roughly three times. Overwritten is a fundamentally different word from deleted — and the difference is the difference between a routine recovery and a genuine impossibility.

The decode: how a loop works, and why this is a real limit

How a recorder uses its disk: a video recorder is designed for continuous operation with finite storage, so it writes in a loop. It records forward across the disk until it reaches the end, then returns to the beginning and records over the oldest material, continuously, for as long as it is powered. The "one month" figure is not a policy or a setting that hides older footage — it is a statement of how long it takes the loop to come all the way round. Everything older has been physically written over by newer video.

Why this differs from every deletion case in this archive: the distinction that matters. When a file is deleted, only its listing is removed — the data remains physically written until something else claims the space, which is why deletion is among the most recoverable events there is. When data is overwritten, new magnetic patterns have been written in the same physical locations. The old patterns are not hidden, unlisted or fragmented. They are gone, in the same sense that a repainted wall no longer holds the previous colour. No equipment reads them back, at any price, in any laboratory — and a firm suggesting otherwise, particularly where footage might matter to an incident, is describing something that does not exist.

The narrow margin, stated honestly rather than as encouragement: recorder filesystems are proprietary and some allocate space unevenly — reserving regions for system data, event flags, thumbnails or index information, and occasionally leaving partial areas the main loop does not reuse on every pass. So fragments occasionally survive: an event log recording that motion occurred at a particular time, a thumbnail, a few seconds at a boundary. Those can matter for establishing that something happened even when the footage itself is gone. It is worth a proper investigation for that reason, and CCTV work is charged as a flat fee with 50% payable upfront. It is not worth hope for the recording itself.

Where footage might genuinely still exist: the useful part, and it is not on the disk. Many recorders offer scheduled exports, remote or cloud backup, or push clips to an application when events trigger — so the footage may exist somewhere it was copied to rather than where it was recorded. Equally, anyone who viewed or exported clips at the time may still have them. And where footage relates to an incident that was reported, the relevant authority may have taken a copy. Those avenues cost nothing to check and are the only realistic chance here.

And the practice note: if footage may ever matter, it has to be exported at the time. A recorder is a rolling window, not an archive, and its retention is measured in the weeks it takes the loop to come round.

On the bench

The investigation's purpose was to answer his question rather than to find work, and the terms were stated before it began: a flat fee for CCTV and forensic investigation work, 50% payable upfront, the balance due only on successful recovery. The recorder's retention behaviour and allocation pattern were established from the disk — how far the loop reaches, and whether any regions are reserved or unevenly reused — and those areas were examined for surviving fragments, event records or index remnants that might place a time even where the video itself had gone. The finding went to him in writing, plainly: the requested footage had been overwritten by subsequent recording and was not recoverable, with whatever peripheral records survived listed specifically. The balance beyond the upfront 50% was not charged, and no work was proposed beyond what the evidence supported.

The outcome

An honest investigation, the position stated in writing, and nothing sold beyond it. CCTV and forensic investigation work is charged at a flat fee, with 50% payable upfront to begin the investigation, and the balance due only on successful recovery. The decode, for anyone asking a recorder for old footage: a DVR writes in a continuous loop and its retention figure is simply how long the loop takes to come round, so anything older has been physically written over — and overwritten is not deleted. Deleted data persists until something claims the space; overwritten data has been replaced, and no technique reads it back. Fragments in reserved or unevenly used regions occasionally survive and can be worth an assessment, but not hope. Check instead for exported clips, scheduled or remote backups, and anyone who saved footage at the time — and if footage may ever matter, export it while it is still inside the window.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.