Data Recovery Case File · CCTV & Surveillance · An Honest Limit

The recorder that ate its own evidence: retention rollover, the physics of overwritten footage, and an answer without false hope

The enquiry was admirably direct: footage from a specific June date was needed from a network video recorder; the system's 30-day retention had "deleted/overwritten" it; the drive was a 6TB surveillance-class disk. Is it possible to recover? Most pages in this archive end in recoveries because most faults leave the data behind. This page exists for the other kind — because surveillance retention is the one deletion that usually doesn't, and the trade owes enquirers like this one the honest mechanics before their money, plus the drill that makes the next incident recoverable by design.

Why retention "deletion" is different from every other deletion

Across this archive, "deleted" almost always means unlisted but present — files removed from the index while their contents wait, recoverable until something overwrites them. A surveillance recorder inverts the odds, because it is that something, professionally and continuously: an NVR is a machine whose entire job is writing video around the clock, and its retention cycle doesn't merely unlist old footage — it hands the territory straight back to cameras that never stop. Footage "deleted at 30 days" is footage whose disk space rejoined the front of a conveyor belt; whether any of it survives depends on one variable only: how much new recording has happened since. A system powered down the day the footage aged out preserves nearly everything; a system that kept recording for weeks — as this one had — has been methodically re-consuming exactly the sectors in question, multiple cameras at a time. The date requested had aged out of the window, and the recorder had then run on: the arithmetic was against it before any equipment was involved, and saying so plainly, before quoting anything, is the assessment this enquiry actually needed.

What examination can still honestly offer — and what it found

The honest version of "is it possible?" is sometimes, partially, and only an examination settles it — because overwrite is uneven: recorders allocate space in blocks, cameras write at different rates, and pockets of older territory occasionally survive longer than the average. So the drive was imaged write-blocked and its surveillance filesystem read forensically: the recorder's own allocation records mapped, the target date's former territory identified, and that territory swept for surviving video-stream fragments beneath the newer recordings. The finding matched the arithmetic: the requested window proved substantially overwritten, with only scattered fragments — moments, not sequences — recoverable from the unevenly-reused regions, delivered as exactly that with a written report stating what existed, what didn't, and why. No fee for the footage the physics had already taken: the assessment that established it cost nothing, which is the only defensible way to sell hope this bounded.

Outcome

An honest partial measured in fragments, a customer who got the truth quickly instead of an invoice slowly — and the page's real payload, the drill that decides every future version of this case in the first hour: the moment footage becomes important, the countdown is already running. Export the relevant clips immediately through the recorder's own interface; if export must wait, stop the overwriting — power the recorder down or pull its drive, accepting the gap in new coverage as the cheap price of preserving the old; and check the retention maths on your system today, because "30 days" is only as long as it sounds until day 29. Surveillance systems are perfect witnesses with scheduled amnesia. The schedule is the whole game.

Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.