The camera captured it. Then the recorder either broke down, or the recording loop came around again to write over the most important part of the week, or someone simply reset the unit while tidying up. We carve surveillance footage back off DVR and NVR hard drives for households, shops, farms, insurers and legal teams throughout Norfolk, including the yards and packhouses where a camera is very likely to be the only witness on site.
Every CCTV / DVR job is diagnosed free. The price is written out and fixed in advance of a single tool being used.
In most cases you only pay if we recover your data. Electronic, mechanical, chip-level and physical work is charged at 50% upfront. Ransomware, forensic, BitLocker and CCTV/DVR jobs are charged 100% upfront on acceptance of our fixed quotation. Please refer to the data recovery cost page for full details on costs.
On every CCTV / DVR job, we start by matching the symptom with the fault, and after twenty-odd years these thirty account for virtually all the problems that come through our door.
Continuous writing brings down surveillance hard drives early; this is exactly what they were made to last through, and it is still what eventually kills them. Whatever is left on the platters is carved back into something viewable.
Pieces of an overwritten period can be found in unallocated space more often than one would think possible, but only if the recording stops the moment someone realises. The longer you keep the recording going, the more hours of history you lose.
This removes the index, leaving the video streams sitting right where they originally were. Turn off the power before the recorder decides to reuse the space occupied by them, because it will, and soon.
Recorder power supplies and boards fail around a perfectly healthy disk. When the recorder dies but the disk is fine, we have no complaints; it is a common and cheerful outcome.
A factory reset by an engineer will remove the listings, but does not touch the video data underneath. Carving recovers whatever the reset did NOT physically overwrite, and usually that is most of it.
Hikvision, Dahua and their many rebadges corrupt in ways that only tooling that knows their formats can untangle. Years of experience have given us the tools and knowledge to do precisely this.
Intruders often attack the recorder on their way out. The hard drive inside is frequently undamaged by these attacks and provides its evidence anyway.
A recorder from an incident scene is treated just like any other damaged drive. We stabilise it, clean it and image it. On occasion, the footage outlives the building it was recording.
Each stream is restored per camera and per timeline, and delivered in a playable state, along with integrity hashes for the bundle so the material stands up to questioning.
When the map is damaged but the video is not, the timeline is built back up from the streams themselves, hour by hour, until it plays back in order.
WD Purple and Seagate SkyHawk units arrive with their read/write heads polished smooth because they have been running continuously for years. Image first and then carve second, never in reverse.
The ST2000VX015 and its cousins fail under the same constant use as all other surveillance drives. Head-swap bench repair, then the carve follows.
Most of the installs around here are either Hikvision products or some rebadge of those products. Due to this, the way those devices store raw data has been mapped in detail at our end.
Some lines tie the drive to the firmware of the recorder so nothing mounts. Rather than trying to mount the drive, the video is carved from a raw capture, thus avoiding the problem altogether.
Over months the clocks drift out of sync and most people do not notice until the footage becomes important. The drift is measured, documented, and corrected so that exported timelines hold together even when scrutinised.
The recorder resets back to the year 2000 and stamps new video with a date that never happened. We work out the correct times during the carve and do NOT guess them.
Their small memory cards wear out from looping in the same way a recorder's disk does, and worn microSDs go to the flash bench where chip level reads happen.
A recorder gets baked in a locked cabinet each year, and its heat aged disks arrive expecting sympathy. They get patient imaging instead, which works much better.
Low cost repairs often fit a plain desktop hard drive that quickly fails under continuous use since it was never rated for it. After recovery, it is replaced with proper surveillance grade stock.
Interrupted USB exports from the recorder's own menu damage the listings. The streams are therefore cut from a raw image and the menu is left out of it completely.
H.265 variants leave whole seconds between full frames. Therefore, a damaged span decodes patchily. The maths restores anything that can be restored; however, nothing is made up.
Live view works but the disk does not record anything, and this is discovered on the day the footage is needed. We determine at what point writing actually stopped and deliver our verdict without watering it down.
Two-disk recorders set up to record on one and simply ignore the second one completely. The loaded drive gets carved; the empty drive gets about thirty seconds and a straight answer.
No matter how many websites tell you otherwise, footage that was never written to disk cannot be recovered by anyone. Whatever the sensor did write to the disk comes back precisely.
A locked recorder and a phone number that just keeps ringing out. The disk does not care about the admin password, and the footage carves directly off the platters.
Larger recorders split video across multiple disks, therefore if one disk goes bad the remaining drives hold pieces that no single drive can make sense of. All the members are imaged and the arrangement is solved before any carving begins, the same as with any other array.
Typically recorders export in their own file format along with a small player which was written for Windows XP and has not been updated since. The file is good. Getting it into an ordinary player is a matter of converting the file, and we convert files like this all of the time.
Install a 10TB hard drive in a recorder that was only tested with 4TB, and it may only access a portion of it, looping over that same area and overwriting much sooner than the settings indicate. Owners usually realise when they go searching for last month's recordings.
It doesn't have to be lightning that strikes the building. If there is a strike near a camera's run of cable, particularly if that cable runs across open ground, the spike travels down that cable and into the recorder via the camera inputs. This can take out the recorder's board and often the drive's electronics too. Most commonly, the board is repaired with the ROM carried over.
A surveillance file system does NOT resemble a Windows file system, therefore Windows will report the disk as RAW and offer to format it. If you accept the format, a new structure is written directly over the footage. Declining costs NOTHING, and the disk should then go to a bench instead of into another computer.
Hikvision, Dahua, Swann, HiLook, Annke and the long list of rebadged units sharing their boards each lay down video their own way, generally as raw streams with no file system a normal computer understands. Tools on this bench read those layouts directly. The streams are cut out of a complete sector level copy of the disk, matched to the camera channel and the clock they were recorded from, and handed over as ordinary files that play, preserving the original timing. At no time does anyone use the recorder's own menu OR its export feature, which is a good thing, since one of the two is often how people lost the footage in the first place.
When video goes to the police, an insurance company, or a court, it must clearly be intact, not just viewable. Work runs off hash-verified copies, all handling is documented from when the parcel is opened to when it leaves again, and each export can have its own integrity hashes included. Please give us the specific date and time window involved and we will point the carve at those recordings before anything else, which saves substantial time on a disk that holds months of footage. The cost is simple: £400 + VAT for a standard recorder drive, classed as forensic work, which means it is paid upfront once you accept the fixed quote rather than on results.
Surveillance work is drive recovery with video forensics layered over it, and both trades are in this building:
Native parsers for Hikvision, Dahua and the own-brand makers behind them convert raw surveillance blocks back into files that play.
Frames sorted by camera and timestamp to create uninterrupted per-camera footage which plays first time without an argument.
Whether the recorder holds a Purple, a SkyHawk or something else, we image it on exactly the same hardware as the rest of the drives in the drive room.
Verified captures, documented chain of custody and integrity hashes for any footage going to insurers, solicitors or the police.
The recovered footage is handed over as ordinary files which can be opened by any ordinary media player. No codec hunt at your end.
At no point does the recorder's own disk have anything written to it. All processing happens on the captured image.
Most own-brand recorders have a Hikvision or Dahua silkscreen inside. The DS-7200 family alone has been installed in disproportionate numbers across the city and the market towns around it. Inside are surveillance Purples and SkyHawks such as the ST2000VX015 that have recorded every second of every day for years without stopping, which is why each job starts with an inspection and a full image before a single frame is carved. Send the drive rather than the recorder, and if you're unsure about getting the drive out, please call us first on 0800 689 0668.
Most items arrive at this bench by insured and tracked post. We recommend getting a quote first, either by telephone or using our free online diagnostic, and once you have received your quote, simply post the item. Post is the steadiest way to move a poorly drive, and a parcel sent from Norfolk typically arrives on the bench within a working day.
Is the drive still bolted inside a laptop, desktop, MacBook, iMac, server or CCTV / DVR recorder? Before sending, remove the hard disk drive (HDD) or solid state drive (SSD), as we do not accept whole units. From a DVR or recorder, send just the disk. From a server or RAID, take out the disks and clearly label each disk by bay number. A network attached storage (NAS) device may be sent as its disks if they can be removed; otherwise please send the NAS itself. There is only one type of drive we are unable to accept: storage soldered onto a motherboard (e.g. Apple Silicon Macs, extremely thin laptops). In such cases, if the storage cannot be taken out it cannot be accepted. If you are unsure whether you have a removable drive or not, call us before sending anything.
↓ Print the shipping & booking-in form (PDF)
Please mark the parcel for the attention of Cambridge Data Recovery. It takes about an hour and twenty minutes to travel from Norwich along the A11, then two minutes off the A14 at Junction 32. Otherwise you can post it using a tracked service and we will receive it the following working day. We will contact you as soon as we have your drive and it is booked onto our bench.
If you're unsure of what to include in the box, please call us on 0800 689 0668 before sealing it. Or, for a first view on what we can do, you can use our free online diagnostic.
Free diagnosis, one fixed figure written down, and in most cases you only pay if we recover your data. Start online or ring us.