The break-in is on the recording device, except the recording device is malfunctioning, or the hard drive was removed by an insurance company, or the loop is silently writing over the incident as all parties deliberate. Surveillance recovery includes drive work with two other twists: proprietary formats most tools do not read, and a clock that never ceases. When video evidence is important, speed of recovery along with having the proper equipment at your disposal will be of importance.
A lot of people will plug a DVR’s hard disk in and find that there is little they can do. Surveillance recorders create proprietary formats for native H.264 or H.265 raw video data streams. These recorders typically do not have a traditional file system, but instead organise raw video data based on camera ID and time. Rebuilding these systems means indexing the original structures created by the DVRs, either using the index itself or building an index from the individual streams when the DVR fails to maintain its own. It then requires breaking down the index by both camera ID and specific time windows, and finally creating standard video files (with timestamps) which users can play back. The familiar examples here include Hikvision, Dahua, Swann and many other “white label” manufacturers who use similar formats as well. Failed drives start out with basic imaging recovery (as if the drive were simply crashed); after that, we move on to file recovery techniques including what we call “format archaeology”.
Surveillance footage has a very short shelf life because recorders overwrite first in/first out once they run out of space, and on busy multi-camera systems that’s days. When the footage is needed to document an incident, stop the recorder or at least the recording, take note of date/time/cameras used to capture the event, remove the drive from the system, label it if there are multiple drives, and get it to us. For insurance and legal uses, tell us at intake: we then document what was recovered, where and how, in a format that will survive scrutiny, and our forensic service handles it as evidence where that is required.
The length of time that you can recover recordings will depend solely upon how long the system has been retaining the information. In general, less used systems could retain months’ worth of information, whereas busy 16-camera systems typically would have little to no chance of recovering older than a few days’ worth of information due to all of the writing going on. Stop the recording right away, as each hour overwrites the oldest hour, and the diagnostic will be able to tell you which time frame for each camera still exists.
Yes, frequently. Most systems delete only the indexes when deleting from the menu, leaving the streaming data intact until something else overwrites it. This is why recovery should occur as soon as possible. Recovery builds from the streams themselves (deleted or not), wherever the loop has not reclaimed them.
Recovered footage will be exported to you in the form of standard playable files that include the timestamp from when they were originally captured, along with information on how the recovered files were obtained. If you intend to use recovered footage as evidence for police or court purposes, please inform us about this intention at the time we receive your request, and we will follow best practices for managing evidence (e.g., imaging, hashing, chain-of-custody) through our forensic services. This will also allow us to prepare appropriate documents regarding the intended use of the recovered footage.