Everything You Need To Know About Deleted And Overwritten CCTV Footage

By Samir Datt | Founder & CEO ForensicsGuru.com | skd@forensicsguru.com

Is it really possible to restore a video that has been deleted? What leads to the deletion of data? Can CCTV footage automatically get deleted? How can we get back CCTV recordings that have been deleted or overwritten? What software can you use to swiftly and efficiently recover important videos? These are some of the questions that come to mind when it comes to video footage recorded on DVRs & NVRs.

Why is CCTV so important in our daily life?

CCTV cameras are additional eyes for you. They assist in the surveillance of public places. CCTV cameras are put in offices to protect assets and provide constant monitoring. Security and surveillance are provided via CCTV cameras and footage is stored on hard drives/media which are fitted in multichannel DVR (Digital Video Recording) Systems.

The following are some of the most common causes of damage or loss of recorded footage in CCTV systems from the DVR.

1. Intentional deletion (Footage that is intentionally deleted to hide any crime)
2. Accidental deletion
3. Water, impact, or fire damage
4. Corruption in  footage storage media eg. HDD or SSD
5. Virus attack
6. Overwritten information (Due to multiple cycles of DVR recording, previous footage gets overwritten thus becoming lost).

ALSO READ: Software Licensing Secrets for Indian Law Enforcement Agencies

Is CCTV footage automatically deleted?

No. Deletion is always manual (footage intentionally deleted to hide any crime)

but previously recorded footage can automatically be removed or lost due to data overwriting once the storage capacity is fully utilized and more recent footage needs to be written.

How are deletion and overwriting different?

Let’s get to know about this in a deeper way.

When CCTV footage is recorded, it is saved on a local hard disc, or a cloud server, or an offsite server. In most cases, after 15 days or a month depending upon the storage available in the DVR/NVR, old data is overwritten by fresh data by default, and thus old data is no longer available.

Let’s look at how data is stored on a hard disk or any other storage device. A hard disk contains sectors. Sectors are the smallest physical storage area on a disk and are usually 512 bytes in size. Bytes are used to store digital information. Each byte has 8 bits. Each bit has a value, which is either 0 or 1. Because it employs two symbols, 0 and 1, this method of storing data is known as a binary numeral system.

If someone deletes any file from a hard disk, the file system only changes the File Allocation database and marks that file on the disk as deleted, after which the operating system marks the space (earlier occupied by the file) as empty and reusable. This automatically removes the deleted file from ordinary view and shows the space earlier occupied by it as free.

However, in technical terms, the file someone deleted is still present at the physical sector where it was (which is now marked as empty) and can be recovered using some sort of recovery technique.

Now let us make this more complicated. As time passes the user continues to write additional files and store them on the same hard drive. In this circumstance it will write data in the “perceived” empty space and the space earlier only marked as “available” will now actually be utilized to store the data from these additional files.

Now since we have added another file on top of this hitherto deleted file, the recovery of this deleted file will become much more difficult or impossible, since the original data has been replaced by the data which formed the content of the new file written in its place.

This is why it is usually recommended that “If you want the data/footage back, don’t overwrite it! Or, if you need to  recover deleted footage, please be cautious about overwriting”

This image helps make the understanding of the process a lot easier.

Traditional knowledge and experience say that if a file is overwritten the data cannot be recovered since the bytes previously occupied by the first file have now been overwritten by the bytes from the second file. That is usually considered the end of the trial. However, when it comes to video footage, things are different.

So how can you recover deleted or overwritten CCTV footage?

Now we come to the crux of the matter. CCTV footage is written very differently from the way normal data is written on hard drives. Let me explain.

Whenever we buy a CCTV camera, it comes with a variety of specifications and parameters. One of these is FPS or frames per second. For example, if I buy a CCTV that says 24 fps, it signifies that the CCTV takes & writes 24 frames (or pictures) per second to the DVR hard disks. Unlike the standard Windows Hard drives which are formatted and hold the Operating System that stores data in a proper file system organized in clusters, CCTV systems do not in most cases have data stored in such a manner. As discussed, data is stored in frames, and based on the example of a 24 fps CCTV, the number of frames can be quite a lot, with no or only minor differences in content between consecutive frames. Hence in scenarios where some frames are physically overwritten, it is possible to reconstruct the video based on the remaining frames. In addition to that in certain situations where frames are repeated, the camera notes that the frame content does not change for the next “x” number of consecutive frames and does not bother to devote resources or time to repetitively write the data in the consecutive sectors allocated to those frames. Hence, while the system marks the sectors as containing data from the current video recording, in actuality the content, when looked at from a forensic perspective, belongs to the previous video frame that was written to that specific sector. When a group of previous video frames are available, these can be stitched together, and Voila! we have successfully recovered the (so-called) overwritten video.

It seems like magic but there is a definite science behind the process.

However, with the huge variety of CCTV systems (ranging from the low-end Chinese to the very high-end European systems) that are present out there, there are a plethora of differences in their data writing techniques. So overwritten CCTV video recovery is not a straightforward task. A number of specialized tools exist that perform the task. As always, some good and some umm…. patchy to say the least.

So what tool should I use to recover deleted and overwritten DVR footage?

From personal experience, the best tool that I have found for this job is a Korean tool from HancomWith called MD-VIDEO. Easy to use and really produces results. In fact, in a recent comparison with another tool, MD-VIDEO recovered 7x  more videos than the other one.

So that’s my personal favourite hands down.

It also helps that it works with a huge range of CCTV camera formats as well as IP-CCTVs, dashboard cameras, cellphones, desktop computers, digital cameras, camcorders, drones, as well as wearable devices.

Follow The420.in on

 Telegram | Facebook | Twitter | LinkedIn | Instagram | YouTube