There is a recording of the break-in, but the recorder is broken, the recording drive was taken out by the insurance company, or it's being overwritten as everyone waits to decide what action should be taken. Recovery from surveillance systems is drive work, plus two other issues: you have to deal with proprietary formats that no ordinary tool reads, and your timing is critical because the clock never stops. When there are time-sensitive video needs, speed along with having the right tools and technicians available both matter.
When you plug a DVR's hard drive into a PC, you'll typically find little of use: raw H.264/H.265 video streams are written directly to proprietary index structures, which may be simply indexed blocks for each camera by time slot, rather than a standard file system. In order to recover footage from such a device, we need to read these native index structures directly: we reconstruct the DVR's original index structure, or rebuild it from the recovered video streams if the DVR's index has been compromised. Once the index is rebuilt, we can extract data by camera and time window and convert the extracted data into standard playable formats that keep the original timestamps. We are familiar with the general structure of how common DVRs from Hikvision, Dahua and Swann work, as well as the many white-label recorders built on their platforms. Failed DVR hard drives receive the same standard imaging treatment as other failed media devices first. Format archaeology procedures are performed as a secondary procedure.
Surveillance systems record forever, first-in-first-out, so footage for any incident has a shelf life of days on busy systems with multiple cameras. The moment that footage becomes important: stop the recorder or at least the recording, and take note of the date and time of the incident and which cameras captured the event; get a quote first, by phone or through use of the form, before removing the drive from the recorder to take to the bench, labelled by bay order if there is more than one. For insurance purposes and legal purposes, state this up front during the intake process: extracted material will then be documented as to what was obtained, where it came from and how, in a format that will survive scrutiny, and our forensic service takes over where formal evidential handling is required.
Depends entirely on the system's retention: a lightly used recording device may hold months of footage. But a busy 16-camera loop may only hold days. To protect your data: stop the unit from recording now. Every hour it records overwrites the oldest hour. And once it's stopped, the diagnostic maps exactly what time range exists for each camera.
Frequently: menu deletion typically only erases index entries, leaving the stream data alone until it is overwritten. This is why it is so important to pull the drive promptly. Recovery creates new indexes, rebuilding from the original streams themselves, deleted or not, within whatever the loop hasn't reclaimed.
Recovered video can be exported in a standard format to create playable video files that will include the original timestamp of when each piece of recovered media was captured, along with detailed documentation of how we were able to recover your media. If the recovered video needs to be used as evidence in a court case or for law enforcement purposes, please let us know about this at intake. We will follow the proper procedure for evidence collection, including imaging the drive, generating hashes and documenting every step of the process (chain of custody) through our forensic services. The documentation collected will be consistent with the reason why the evidence was requested.