The thief was caught on tape, but when you went to get the footage from your digital video recorder (DVR) the thing just wouldn't start. Or worse still the recording loop had wiped out a week's worth of recordings. Or better yet, some helpful soul had gone ahead and "formatted" it. We recover lost data from the drives of DVRs and network video recorders (NVRs) for domestic users, commercial users, insurance companies and law firms in Swansea.
We provide a free diagnostic service with every CCTV / DVR recovery project. A single fixed quote in writing prior to any work being carried out on your CCTV / DVR drive.
In most cases you only pay if we recover your data. This is true of all our services except for failure of electrical/mechanical components, chip level repairs, DVRs and forensic analysis. Our full price list can be seen at the cost of data recovery page.
Every job starts by looking at the symptoms exhibited by your CCTV / DVR, and there are fifteen potential faults that can be identified that way. These fifteen will cover all but a very small number of the faults that reach our bench.
The continuous operation (24/7) will kill DVR drives early; data that was once there can be carved off from whatever is still left on the hard drive platter(s).
Fragments of deleted video regularly remain in free space, as long as you stop recording immediately.
Deleting something simply removes an entry to locate the stream of data, leaving the stream itself behind: turn off the system before the freed space is reused for new recording.
When the PSU and/or mainboard fail they will leave all recorded archives on the disk inside the unit intact.
An engineer who visits to repair or work on the DVR may reset the DVR and when he does this all archived video is gone along with everything else. Carving allows us to recover what the format never actually reached.
Only with knowledge of proprietary formats (e.g. Hikvision, Dahua and the rebadges) will someone be able to recover footage if the file has been corrupted.
Recorders suffer the violence; drives that were inside them typically ride through it.
Drives from recorders at an incident location are treated and imaged as we would treat any drive that was damaged.
Video stream(s) are assembled back together using channel and time stamp and then exported so that they are viewable, as well as being provided with integrity hash values.
The recordings exist, however the recorder has lost its index of them; it gets reconstructed out of the data streams themselves.
WD20PURZ-class surveillance hard drives are delivered to us with failed heads from years of constant write usage.
Seagate's product-line for surveillance has the exact same 24/7 failure mode, and these drives are imaged on the bench prior to being carved.
This is the most commonly installed recorder-family locally (its raw format has been completely mapped here).
There are a few recorder-families that lock-down their associated disk with their custom firmware, therefore, the video files you get back will have been created through carving the raw image rather than "mounting" it.
Clock drift between cameras has been documented and corrected for so that exported timelines can stand up as evidence.
A CCTV recorder (Hikvision, Dahua, Swann, HiLook, Annke or one of the many different rebadged versions) does not store video like a computer stores video. The video stream is written directly to the surveillance storage device in its native manufacturer specific "raw" format; often it has no recognisable file system at all. Our carvers know these formats: we carve these formats (i.e. the streams) directly out of the sector image, associate them back to the original camera channel and time stamp, then export them as regular files which will be playable anywhere, with the same timing as when they were originally recorded.
If footage is intended for a police investigation, court proceedings or an insurance claim then proof of integrity will be required rather than simply that it contains images. Work proceeds on hash verified images along with documenting the handling chain from start to finish, and export options include the inclusion of integrity hashes. Give us the incident date and window you require at the beginning and the carve will only target the recordings in that time frame. It is also worth noting regarding pricing: CCTV recovery costs £400 + VAT for standard recorder drives and is forensic work so payment is taken up front.
The CCTV recovery process includes video forensics that are layered on top of a recovery of data from the drive, and the recovery bench addresses both sides of this equation:
These are native format parsers to decode raw video data from Hikvision, Dahua, and all of their rebadged versions into viewable video.
Software that matches frames based upon time stamps and channels and then rebuilds those frames into continuous, viewable video.
WD Purple or Seagate SkyHawk hard drives used in recorders will be imaged on the standard stack of hardware.
Wherever footage has become evidence, these include verified images, a documented handling chain and integrity hashes.
Exports land data into standard file formats which open first time, regardless of who your audience is: you, an insurance company or the police.
There is never any writing to the original recorder drive. Every operation takes place using a copy (image) of the original.
Take away the "own brand" label from most own-brand recorders and it is likely to be a Hikvision or Dahua motherboard that stares back at you; the DS-7208HQHI family alone represents a surprising proportion of what we see here. Inside those recorders run WD Purple WD20PURZ and Seagate SkyHawk ST2000VX008 surveillance hard drives that have been spinning continuously for many years and have been bench-imaged prior to us doing any carving.
First get a quote over the telephone or use our free on-line diagnostic. The majority of customers then have their media sent to us via post, this is tracked and insured.
Do you want to send a drive from your computer, laptop, MacBook, iMac, CCTV / DVR or server? Please do not send the complete unit of computer or device with a hard disk drive (HDD) or solid state drive (SSD) inside. Please remove it and only send the drive itself. For a server, please remove all disks and label them by their bay. We will also not perform removal of internal drives from devices in order to access data. Also, we will not extract data from devices where storage is soldered onto the motherboard (such as T2 and Apple Silicon Macs and some thin laptops). Additionally, we do not recover data from phones and tablets, only drives that can be removed and sent to us. If you're not sure which kind you have, ring us first.
↓ Print the booking-in & shipping form (PDF)
Clearly mark the parcel with the name Bristol Data Recovery, and when your media has been diagnosed we will call you immediately.
If unsure about what to post, please call us first on 0800 689 0668 (the free phone number), or complete a free online diagnostic.
Diagnostic provided at no charge. Fixed quote, and as this is forensic-class work it is paid upfront. Start now or call the freephone.