Possible To Recover Overwritten Video Recording?

Is there any way to recover overwritten recordings?

I have had a scenario where the client didn't do the backup of an incident and he now needs it very desperately?

Thanks.


If the video isn't actually overwritten yet, but has merely be deleted, you MIGHT be able to get it back with an "undelete" utility. If it's actually been overwritten... then no (well, a data recovery service MIGHT be able to get something back, but it would cost a lot with results not guaranteed).

With a surveillance system, since storage use is typically close to 100%, the likelihood that it has not been overwritten is low.

That said, have you asked your recorder manufacturer? Can you share who the manufacturer is? We can help check.

The manufacturer is Dahua and they say, they don't have the capacity and qualification to recover HDD content exactly.

Yes, I agree with them :)

Hopefully, you have already pulled the hard drive and might try some third party service. Seems like a longshot though.

Yes it is possible because the data is not erased, instead when the hard drive is full it only overwrites what is already there. I should also say that if the hard drive is the newer solid state drive (SSD) then that answer would be no.

It can depend somewhat on the filesystem. Linux-based systems may be using EXT3 or EXT4, which not only mark the sectors as available (as with NTFS), but also delete the pointers to the files (inodes).

That said, there are some free utilities, such as PhotoRec that can search a drive for files that have not been overwritten, but you lose all attributes (such as file names).

THere are a number of File recovery services available. Here is one that i know of. I contacted them some time ago about a similar issue and they said they may be able to do it. Good thing is, they give you an esimate and you only need pay 15% to find out if they can recover it. If the file is recoverable, they give you a quote which could range from $200 to about $900 as I recall.

As it turns out, i did not need the service, so i cannot tell you anything about the company. Please post if you find out something that works. I would bet that others have or will run into this issue at one point or another.

IMHO, this is really two seperate questions:

1. Is there a (reasonable) chance that the needed data still exists?

This depends mostly on how soon the recorder was stopped after the 'overwrite' happened. It also depends on how long the footage needed is? If it was on auto-overwrite and ran out of space, then it would delete one or more of the oldest files, freeing up space, thus allowing it to grow existing files and create new files from the sectors that were deleted. For efficiency it would be expected that the auto-delete process would delete a few files at a time, so that it was not continually running.

If for instance, the recorder was stopped within a few minutes of the deletion, you would have good chances of getting of a sub-minute clip. As the time increases since stopping the recording and the needed footage gets longer, your original data will start to resemble Swiss cheese, with bigger and bigger holes.

2. Is there a (reasonable) way to recover it or reconstruct it if it does?

This will depend on how long the clip is as well as a lot of other factors, like how the disk extents are allocated, how fragmented the superblock/inode indirection is, etc. And how much it's worth to have someone try to identify and stitch the parts together where possible.

I put a tiny 16gig SATA drive in my Dahua NVR, and am letting it fill-up, to see what I can learn about the deletion algorithm. I'll post back anything interesting.

Also to keep in mind is the integrity of the recovery... especially if it will be used in court. The data cannot be changed so make sure whatever you use maintains that integrity.