Data Recovery Case File · Trust, Practice & Honest Limits · The Loop's Horizon
"I can only go back to the 16th while I'm looking for the 8th": a CCTV recorder's loop decoded honestly — what was saved by pulling the plug, and what no lab can un-record
His enquiry was short, courteous and precisely aimed: "Is it possible to recover overwritten data of my CCTV box? I can only go back to the 16th of August while I'm looking for the 8th — the box has already been disconnected." He was travelling, due back in the country within the week, and asked for the reply by email — honoured, as it always is. A question this direct deserves the answer before the sales pitch, so here it is: footage the recorder has genuinely overwritten cannot be brought back — by this laboratory or any other — and a firm that promises otherwise is telling you what you want to hear. What an assessment can do is verify exactly where the loop's horizon fell, and check the honest, narrow exceptions around its edges. And one thing in his message mattered enormously: the box has already been disconnected. That single act is the reason there was anything left to verify at all.
| Device | CCTV recorder ("the box") — hard-drive-based surveillance unit recording continuously on a loop |
| Reported situation | Earliest available footage: the 16th of the month · date required: the 8th · recorder disconnected promptly · enquirer abroad, email contact requested |
| Fault class | No fault at all — circular recording operating as designed; the target date beyond the retention horizon |
| Equipment used | Write-blocked imaging of the recorder's drive · surveillance-filesystem analysis · horizon verification and edge-region inspection · playable export of everything inside the window |
The decode: the loop, the horizon, and what "overwritten" physically means
How the box eats its own history: a surveillance recorder writes continuously and forever onto a drive of fixed size, so it is built from the first day to consume its own oldest footage. When the drive fills, the recorder circles back and records the newest hours directly on top of the oldest ones. The distance between "now" and the oldest surviving footage — here, back to the 16th — is the retention horizon, set by drive size, camera count and quality settings. Nobody deleted the 8th. The 8th was spent, days earlier, as raw material for newer recordings — that is the machine working exactly as designed, which is cold comfort and also the truth.
What overwritten means on the platter: it's natural to imagine old footage buried underneath the new, waiting for a sufficiently clever tool to peel back the layer. Magnetic recording doesn't stack; it replaces. Writing the new day re-magnetises the same physical territory, and the prior signal ceases to exist as recoverable information. This is physics, not policy — no fee, no equipment and no promise changes it, which is why the honest answer to his exact question is the one given above, in writing, before any money is discussed.
The honest exceptions, precisely bounded: the verdict "beyond the horizon" deserves verification rather than assumption, because loops are untidy at their edges. Recorders overwrite in chunks, not clean day-boundaries; fragments just past the apparent horizon sometimes survive out-of-index; regions the drive retired from service early can hold stale, older data; and footage the recorder was asked to protect (motion events, manual locks, exports) sometimes lives outside the loop entirely. These are narrow doors — checking them is exactly what a free assessment on a write-blocked image is for. And this is also what disconnecting the box saved: every additional day of recording marches the horizon forward and slams those edge-doors one by one. He stopped the clock. Textbook.
The assessment: verify, export, and tell the truth about the rest
On his return the recorder's drive was imaged write-blocked and its surveillance filesystem read directly — these units keep their own indexing rather than ordinary folders of video files. The analysis confirmed the horizon where the box itself had reported it, examined the edge regions and protected-clip areas for stragglers from the earlier week, and exported everything inside the surviving window as ordinary playable files, so that what did exist was no longer hostage to one ageing recorder.
The outcome
An honest ledger, delivered by email as requested: the retention window verified and exported in full, playable on any computer; the target date confirmed to lie beyond the horizon, with the edge-cases checked rather than hand-waved. Under no-recovery-no-fee, verification of a hard truth costs nothing — which is precisely the protection that policy exists to provide. He got an answer he could rely on instead of a promise he couldn't.
CCTV footage you need is close to the edge of the loop
Disconnect the recorder the moment you know a date matters — retention horizons move daily, and pulling the plug freezes yours where it stands. Export important incidents at the recorder as soon as they happen rather than trusting the loop to keep them. Size the drive to the retention you actually need, not the default. And treat any firm that promises to recover genuinely overwritten surveillance footage with suspicion: the honest answer starts with verifying the horizon, and sometimes ends there.
Disconnect it now, then call Edinburgh Data Recovery on 0131 202 0491 — honest verification, free assessment, no recovery, no fee.
Request a quote online →
Our case files are drawn from genuine enquiries received by our laboratory over the past ten years, anonymised to protect client confidentiality. Each one describes the diagnostic and recovery procedure our engineers apply to that fault, using the equipment listed.