CCTV data recovery on your average hard drive system.

[The Hypno-Toad]

I didn’t do this, honest guv!

We have what I would call a standard CCTV system at work for the size of our premises (8 cameras.). We need to recover some footage from just over a month ago for a legal matter and this would appear to have been erased as someone didn’t back up the footage within the monthly time limit before it is deleted off the hard drive.

Would there be any chance of any recovery if we get someone professional to have a look or would it be a waste of time. I can get the name of the system in the morning if that helps?

[Harpoon]

Have you stopped recording which is probably making the recovery harder?

I'd speak to somebody like Ontrack and get a quote:

https://www.ontrack.com/en-gb/data-recovery/cctv

[The Hypno-Toad]

I ll ask the boss for permission to go in and turn the system off. Thanks for your help. :thumbup :

[NoBrakesWC]

A Digital Forensic company would be able to help as they have specialist software's that they use which could locate the footage if it's still on there somewhere.

[Road2Ruin]

I don't see why not, as long ad it hasn't been overwritten by newer data.

[The Hypno-Toad]

Thanks for your advice so far guys.

Having looked through the owners manual it mentions a Database rebuild? Would it effect the system in any other way if we did this?

Sorry to appear an utter idiot but none of this know much about this system and the only person who did has left. Doh!

[simon_harris]

if this is really important to you then get a professional in to sort it. anything you do could well reduce your chances of getting the data back (if it is still there by this time)

[Matty_]

Road2Ruin said:

I don't see why not, as long ad it hasn't been overwritten by newer data.

This is key. The longer its been deleted, and the longer its running, the more chance it will be overwritten. At the same time, careful you don't leave yourself liable by turning it off and leaving it off for a period while recovery is happening (this can take a while, depending on recovery).

I've deleted my other answer and edited this - if this is mission critical, I'd be very inclined to speak to a specialist before doing anything other than turning if off.. Even if you do consult with a recovery company, you'll still need someone to strip the system of the drives and rebuild it again, then configure a proper retention/backup of the system so it doesn't happen again.

For recovery recommendations, I have absolutely no affililiation with these guys, but we've used them twice and the second time, performed absolute miracles getting 95% of core data for a customer that could have potentially sunk their business:
https://www.lazarusdatarecovery.com/

Very, very reasonably prices too.

Edited by Matty_ on Tuesday 12th May 13:30

[The Hypno-Toad]

Matty_ said:

This is key. The longer its been deleted, and the longer its running, the more chance it will be overwritten. At the same time, careful you don't leave yourself liable by turning it off and leaving it off for a period while recovery is happening (this can take a while, depending on recovery).

I've deleted my other answer and edited this - if this is mission critical, I'd be very inclined to speak to a specialist before doing anything other than turning if off.. Even if you do consult with a recovery company, you'll still need someone to strip the system of the drives and rebuild it again, then configure a proper retention/backup of the system so it doesn't happen again.

For recovery recommendations, I have absolutely no affililiation with these guys, but we've used them twice and the second time, performed absolute miracles getting 95% of core data for a customer that could have potentially sunk their business:
https://www.lazarusdatarecovery.com/

Very, very reasonably prices too.

Edited by Matty_ on Tuesday 12th May 13:30

thanks Matty_, wise words and I have sent that link to the boss, I will report on what happens.

[Brother D]

There is zero chance the data will still be there. The hard drive recovery services work on essentially data being 'marked for deletion' and not actually being over written by anything.

A cctv hard drive works on a time-based rolling storage, overwriting the oldest data. It doesn't mark more than a small buffer area before over writing it with the new data. This is how DBAN/NIST hard drive wiping software works.

So if you do not have video/history of the time period you are looking at, there is no chance to recover the data.

[Frane Selak]

Brother D said:

There is zero chance the data will still be there. The hard drive recovery services work on essentially data being 'marked for deletion' and not actually being over written by anything.

A cctv hard drive works on a time-based rolling storage, overwriting the oldest data. It doesn't mark more than a small buffer area before over writing it with the new data. This is how DBAN/NIST hard drive wiping software works.

So if you do not have video/history of the time period you are looking at, there is no chance to recover the data.

This is what I was going to say, my CCTV fills up the HDD and then starts at the beginning again. What's available to view is what hasn't been overwritten yet, there isn't a set number of days it keeps anything for.

Is it true though that once its been overwritten only once the data is gone forever, even for the forensic guys?

[Brother D]

Frane Selak said:

Brother D said:

There is zero chance the data will still be there. The hard drive recovery services work on essentially data being 'marked for deletion' and not actually being over written by anything.

A cctv hard drive works on a time-based rolling storage, overwriting the oldest data. It doesn't mark more than a small buffer area before over writing it with the new data. This is how DBAN/NIST hard drive wiping software works.

So if you do not have video/history of the time period you are looking at, there is no chance to recover the data.

This is what I was going to say, my CCTV fills up the HDD and then starts at the beginning again. What's available to view is what hasn't been overwritten yet, there isn't a set number of days it keeps anything for.

Is it true though that once its been overwritten only once the data is gone forever, even for the forensic guys?

Fundamentally hard drives just store 1's and 0's. You flip a location from 1 to 0 to 1 there is no 'memory' or what state a location was at a specific historical time, so you cannot reconstruct a hard drive to a previous state that has been overwritten - it's just not possible.

Its like trying to detemine which light switches and plug sockets in your house were on or off at a random time in the past with no record of their state at that time. .

Edited by Brother D on Thursday 21st May 08:33

[AlexGSi2000]

Probably slim to none on a system like this.

Im assuming the data is being written to mechanical spinning drives? if so there is a slight chance.

If its going to solid state drives then you can doubly forget about it.

Personally I would write it off unless the legal matter is substantial in which case it may be worth the potential cost of attempting recovery, or to show you have made efforts.

[The Hypno-Toad]

Thanks for the help guys but its unrecoverable. Lesson learned for next time.

[carl_w]

The Hypno-Toad said:

I didn t do this, honest guv!

We have what I would call a standard CCTV system at work for the size of our premises (8 cameras.). We need to recover some footage from just over a month ago for a legal matter and this would appear to have been erased as someone didn t back up the footage within the monthly time limit before it is deleted off the hard drive.

There is a lesson here. Your backup process is broken. Surely there must be some way of automating it?

[simon_harris]

generally for CCTV systems the juice isn't worth the Squeeze, if you have need to retain X months of data then you need to provide provision for X months of data storage. If there is an event that occurs you need to retain you take a copy and mark it for non destruction and write it to CD to somewhere else on the network or both.

the danger of having too much data stored is the admin overhead of managing it if anyone makes any data access requests etc