The video was recorded. Then the recording device failed to work, or the recording loop caught up and wrote across the week that counted, or someone simply reset the unit as part of tidying up the office. Videos are recovered here from DVR and NVR disk drives for individuals (households), businesses (shops), property owners (yards and farms) and insurance companies and solicitors. On many of those properties, the video camera was the only source of evidence available.
Each CCTV/DVR diagnosis is done at no cost. Your fixed price will be sent to you in writing prior to any tools being used.
In most cases you only pay if we recover your data. The exceptions are electronic/mechanical failures, chip level work, DVR and forensic jobs. All pricing information can be found on the data recovery cost page.
Any CCTV/DVR problem has to start with finding the cause by relating the symptoms to the defect. In twenty-odd years, these twenty-five causes cover nearly every failure of this type which reaches our workbench.
It's a major contributor to premature failure of surveillance disks when they are written continuously. They were designed for continuous write activity; therefore it is exactly that type of operation that results in their demise. Whatever data remains on those platters can be carved back into a format suitable for viewing.
There are more pieces of the overwritten time frame left intact in unallocated space than would seem rational, so long as recording stops as soon as someone detects the loss. Each additional hour of recording costs you another hour of recorded history.
This deletes the index but leaves the video streams right where they have been. Turn off the power to the recorder immediately upon recognising the loss since the recorder will take ownership of the location occupied by those streams shortly.
Surveillance recorder power supplies and boards fail around a completely healthy disk. Of all possible outcomes within surveillance work, this is the most pleasant and mercifully one of the most common.
The many forms of corruption in Hikvision, Dahua and the numerous rebadged versions of those two are something which only format-fluent tooling can untangle. We have years of experience doing just that. General-purpose computer software has no experience at all in this area.
When exiting a building after having committed a crime, the perpetrator will normally seek out the recorder box. However, even though the perpetrator may have destroyed the housing containing the DVR's hard drive (disk), the data stored on the disk usually remains intact and will be provided as evidence of the perpetrator's actions, which is somewhat ironic.
After a DVR has been removed from an incident location, its disk will be stabilised, cleaned, and then an image taken of it just as would be done when attempting to recover data from an injured disk. Surveillance footage often survives the destruction of buildings.
We provide reconstructed video streams per camera and per timeline for playback along with integrity hashes that accompany the streams so the video can withstand scrutiny should someone question the authenticity or validity of the recovered video.
While the map was damaged, the video footage itself remained intact. Using only the video streams themselves, we reconstruct each timeline hour by hour until the entire sequence of events plays back in chronological order.
ST2000VX015 type drives (and their close relatives) fail under exactly the same continuous use that finishes the other video storage, and WD Purple disks arrive here with their heads polished smooth. First repair, then the carve.
The Hikvision family, rebadges included, is so large that it has become ubiquitous in local installs from shopfronts to yard gates. The map we have shows us exactly how they organise data in their raw storage layout.
Some lines tie the disk directly into the box's firmware making it impossible for anything other than this box to access the disks. Video is carved directly from a raw capture of the disk, thus bypassing the issue.
Over time clocks will slowly drift apart and most people do not notice this problem until they need to access video footage that has been recorded by these systems. When this happens the clock drift is measured, documented and corrected so that when video footage is exported (to be used as evidence, for example), it will survive scrutiny.
Their small cards loop themselves flat just like a recorder's disk does, but much faster. A tired microSD card crosses the hallway to the flash bench and is read at chip level.
A desktop disk installed as part of a low cost repair job fails rapidly when continuously used since none of these disks were ever built for use as such. Here at the lab we recover data from this type of disk, and then it gets replaced with a properly rated surveillance grade disk.
When an active export is interrupted while using the recorder's native software to move files off the disk, the file listing becomes damaged along with possibly the two files before/after the damaged file. Using a raw image of the disk, we recut the streams, leaving the recorder's menu out of it.
In H.265 variants whole seconds pass between full frames; damaged spans therefore decode patchily. The mathematics restores what it can restore. There is no invention to paper over gaps.
The Live View function was working as it should while the hard disk recorded nothing; it wasn't until the footage needed to be viewed that anyone realised this. We establish the date that writing genuinely stopped, and that finding is given to you unsoftened.
No one recovers footage which has never been written to a disk regardless of any website claim. Whatever video signal is placed on a disk by its sensor returns precisely as sent, with the difference clearly articulated rather than fudged.
Locked recorder plus phone number answered by no person. The passwords for administrators are entirely meaningless to the actual disk, and regardless of those passwords, the video footage will be carved off those disks/platters exactly.
Larger recorders spread out video footage across multiple disks. If any single disk is lost, then the other disks will each have only fragments, none of which can be interpreted by any individual disk on its own. Each member gets imaged and their relationship solved before any carving begins (exactly like any array).
Recorders often export files in a "house" format, bundled with a very basic Windows XP-based (never updated) viewer. Your file is correct; getting it viewed by other programs is a simple process of file conversion, which we do regularly.
Adding a 10TB hard drive to a device from manufacturers who tested up to 4TB may only allow the drive to access part of its total capacity (looping around the portion it has access to), thereby writing over files long before the time allocated within the configuration. Owners find out about this while searching for previous months' recordings.
Lightning does not have to strike the building. If it strikes somewhere nearby (i.e. near a run of camera cable across open ground) then the electrical "spike" travels along those wires and into the camera inputs on the recorder. The resulting damage usually includes taking the recorder's board down, and frequently the electronics on the hard drive sitting behind the board as well. The usual route from there is to repair the drive's board and carry the ROM over.
Surveillance recorders use file structures totally unlike those used on a standard Windows PC. The PC therefore identifies the disk as RAW and asks if you want to format it. If you agree, it erases your current files and installs its own version of how the disk should be structured. If you decline, there's no cost to you, and you'll have to send the disk to a lab bench instead of just putting it in another computer.
Hikvision. Dahua. Swann. HiLook. Annke. Plus many other boxes using identical printed circuit boards (PCBs), just labelled differently. Each produces video in its own format. Raw streams are usually written to a disk without being part of any file system an ordinary computer will recognise. These formats are read directly here. The whole disk is copied at the sector level first. Then the streams are extracted from that copy, matched up to their respective channels and clocks, and restored into normal file formats that can be played on any device, with timing preserved. The recorder's menus and export function are never used. That is good luck for most users, since one of those is often how the footage went missing in the first place.
If footage is being sent to a police force, an insurance company or a courtroom, it will have to be proven that the footage is untouched (not altered), not simply viewable. Therefore, the work will be based upon hash-verified images. All steps taken during the work, from opening the package containing the media through to sending it back out again, will be logged. Integrity hashes will also be placed into exports where this is required. Tell us the date and the hours in question, and the carve will target those recordings before anything else, which is extremely important when dealing with a disk holding months of continuous video. The pricing is simple and stated up front: £400 + VAT for a standard recorder drive, classed as forensic work, which means payment before the work rather than on our usual terms, where in most cases you only pay if we recover your data.
Surveillance jobs need two professions that work together here, drive recovery with video forensic analysis on top:
We currently have native parsers available for Hikvision, Dahua, and the proprietary brands associated with these companies. These converters take each block of un-interpreted data and convert it back into something playable.
Each frame is ordered using both the channel number and the timestamp, the frames are then joined together to form continuous streams of each camera which play the first time through without needing an argument from a codec.
All Purples, SkyHawks (as well as any other types of disk a given recorder will hold) are imaged using the same equipment used for all of the other drives in the drive room.
All verified captures will have their custody evidenced throughout, and integrity hashes are generated on any footage destined for insurers, solicitors or the police.
Any recovered material returned will be simply presented as normal file formats and therefore can be opened with normal media player software. None of your team will need to search for a specific codec.
At no point during processing does anything write to the original disk of the recorder. All processing occurs against the captured images.
On most own-brand boxes, you only have to remove the lid to see a Hikvision or Dahua silkscreen staring directly back at you. This is particularly evident throughout this city and its industrial estates, as well as the towns lining the coast, where an outsized share of the installations are from the DS-7200 range. Inside, turning without a break, are surveillance Purple and SkyHawk drives (such as the ST2000VX015) that have been writing non-stop for years. Therefore, the standard process that has evolved around them is to first inspect the drive, next to image it in full, and to carve nothing until both of those are done. Yard gates, harbour compounds, boat sheds at Peterhead and Fraserburgh, farm steadings, shop fronts: all sending in identical hardware for identical reasons. First get a quote via telephone or use the free online diagnostic. Then send us the hard drive instead of the recording device. Should you be unable to remove the hard drive, contact us on 0800 689 0668 and we will guide you through it.
Get a quote first by telephone or use our free online diagnostic. Most of what you see on this bench will then be delivered via tracked, insured post. This is one of the safest ways to move a failing drive and packages handed in at a North-East post office are normally delivered here the next working day.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Free diagnosis, one fixed price quoted in writing, and in most cases you only pay if we recover your data. Start online or phone it in.