The camera saw it, then the DVR/recorder failed, the loop rolled over the week in question, or a reset removed all files from the archive. We recover surveillance video from DVRs and NVRs for York residents, retailers, insurance companies and legal teams, including race day crowd footage when an incident happens to be captured during one.
We give free diagnosis on every single CCTV/DVR job. Once diagnosed, we provide a fixed written quote before lifting a screwdriver.
In most cases you only pay if we recover your data. Chip level, electronic and mechanical repair is charged at 50% at start-up, and the other 50% only upon successful recovery of your data; all BitLocker, ransomware, forensic and CCTV/DVR recoveries are charged at start-up when you accept our fixed quote. More information can be found on the data recovery cost page.
All jobs are initially matched against possible causes of the fault. After two decades of experience, these 25 account for nearly every failure we see come through the door.
Continued writing will shorten the lifespan of any surveillance drive. Any remaining video stored on the disks is recovered by carving it back into playable footage.
Slices of an overwritten window are found in unallocated space more often than seems fair, as long as you stop the recording as soon as it becomes apparent what has happened.
This will cause all indexes to be removed from the drive and abandon the streaming data on the disk. Be sure to cut the power before the recorder begins to recycle the space they occupy.
Recorder PSUs and boards typically fail while the disk is good. This is one of the most positive conclusions in surveillance cases, and fortunately very frequent.
A factory reset (performed by engineers) deletes all of the recording listings. Carving into those deleted recordings reveals whatever was never physically overwritten by the reset, normally a lot.
Hikvision and Dahua recorders, and their many rebadged versions, are known to corrupt recordings in ways only format-fluent tools can unravel. Our team has had multiple years of experience with just these types of issues.
Thieves vandalise the recorder while committing a crime. The drive inside commonly survives the vandalism and often contains evidence regardless, which is a pleasing irony.
Recovering incident-scene recorders involves treating them just like an injured hard disk: stabilised, cleaned and imaged. Frequently the video lives longer than the building.
We deliver reassembled streams per camera and timeline, ready to be played back. Integrity hashes for each piece of evidence accompany the entire bundle.
The index was corrupt but the recording itself wasn't. We build our timelines using the individual streams we recover, hour after hour.
WD surveillance drives that have been continuously used for years typically arrive with their heads polished smooth, so it's a clean image first, then carving. The order is paramount.
Seagate's surveillance products fail under exactly the same non-stop use as every other manufacturer. Head-swap bench repair first, then carve.
Hikvision systems and their many cousins account for most installs in this area, and the raw storage layouts of all these systems are fully documented at our end.
Some of those lines link the hard drive to the box's firmware, and therefore we do not ever attempt to mount the disk; video is extracted directly from a raw capture as opposed to mounting a disk.
Over time (months), clocks can begin to diverge. We measure how much they have drifted and record that information along with correcting it when exporting timelines so that the exported timeline will pass muster if challenged.
The recorder rewinds itself to 2000 and stores new footage as fiction. The actual time stamps are re-figured during the carve process.
Those little cards in the cameras wear out in the same manner as recorder disks. When a microSD card becomes worn out enough it gets sent across the hall for chip level reading.
Each year locked cabinets bake recorders, and the heat aged platters come with an expectation of compassion. Patient imaging is what they get instead, and it works much better.
An ordinary PC drive fitted during a cheap repair gives out quickly under 24/7 duty. We recover it, and then it gets swapped for proper surveillance stock.
Interrupted USB exports via the menu on the recorder cause loss of listing data. Therefore we cut new streams from the raw image of the recorder and bypass the menu altogether.
Variants of H.265 leave whole seconds in between full frames. This is why damaged segments will display a jumbled, patchy decoded video. Mathematically speaking, we are restoring as much as possible. Nothing is invented.
Live view worked, but none of the footage was being saved, and nobody found out until it mattered. We determine at which point all writing to the disk ceased and then give you our honest verdict.
Two-disk recorders that have been configured to fill one disk and disregard the other. The loaded disk is carved; the empty disk receives 30 seconds and an honest shrug.
No matter what a website says about recovering unrecorded video, nobody can recover anything except what was committed to disk by the sensor. In short, that data on the disk returns exactly as recorded.
A locked recorder with a number that rings out. The disk does not care about an administrator password: footage is carved straight off the platters.
Video recording devices made by Hikvision, Dahua, Swann, HiLook, Annke and countless rebadges write video content their own way. Raw stream content goes right to disk with little to no file system structure that a typical computer would recognise. Our carving tools understand the native language used by these manufacturers' products: they take raw stream content from a sector image of the disk, match it to the specific camera channel and clock (time) of the original capture, and deliver it back to you as plain old files which can be played just like any other file, with all of the timing preserved from the original recording. The recorder's own menus never come into it.
Videos bound for law enforcement, courtrooms, insurance companies etc. need verifiable integrity rather than merely being viewable. All are handled using verified hash-based images, where all handling steps are documented from arrival, through processing, until return, and all exports can include their own integrity hashes. Identify the incident date and the hours that matter, and the carving will target only those recordings, whether it's a break-in at a Clifton Moor unit, a fight in a race-day crowd, or whatever else the drive was keeping. The pricing is straightforward and clearly communicated upfront: £400 + VAT for a standard recorder drive, classified as forensic work, and therefore paid upfront once you accept the fixed quote.
The recovery of surveillance footage is drive work with video forensics layered on top. This workshop keeps both trades in-house:
Raw surveillance blocks parsed natively for Hikvision, Dahua and own-brand recorders to produce watchable video files.
Frames sorted by channel and time-stamp before being joined into continuous per-camera video that plays first time.
Purples, SkyHawks et al. found inside a recorder, imaged and handled on the exact same hardware stack as the rest of the drive room.
Verified captures, documented custody and integrity hashes for all video evidence where it is being passed to insurers, solicitors, police etc.
All recovered media will be delivered in standard file formats playable on standard media players, so there will be no need for you to chase codecs.
At no time during this process does our system write to the recorder's disk; all processing occurs on the captured image.
If you lift the cover plate on most own-brand recorders, Hikvision or Dahua silkscreen branding can normally be found, and the DS-7200 series alone accounts for an outsized share of installations throughout the city and surrounding market towns. Inside these units are surveillance Purples and SkyHawks that have been capturing images 24/7 for years, therefore each job begins with a bench inspection followed by a full image capture before the first frame is carved.
Get a quote first, by calling us on 0800 689 0668 or using our free online diagnostic tool. After receiving your quote, tracked and insured post is how nearly every job reaches us: it is the fastest and safest way to get your drive to our lab in Leeds. There's no collection service, so the parcel is yours to send, or you can hand it in at the Leeds lab's reception.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Free diagnosis, fixed written quote, and on most work you only pay if we recover your data. Start online or call our freephone.