Subscriber Discussion

Possible To Recover Overwritten Video Recording?

UI
Undisclosed Integrator #1
Feb 25, 2015

Is there any way to recover overwritten recordings?

I have had a scenario where the client didn't do the backup of an incident and he now needs it very desperately?

Thanks.

MI
Matt Ion
Feb 25, 2015

If the video isn't actually overwritten yet, but has merely be deleted, you MIGHT be able to get it back with an "undelete" utility. If it's actually been overwritten... then no (well, a data recovery service MIGHT be able to get something back, but it would cost a lot with results not guaranteed).

JH
John Honovich
Feb 25, 2015
IPVM

With a surveillance system, since storage use is typically close to 100%, the likelihood that it has not been overwritten is low.

That said, have you asked your recorder manufacturer? Can you share who the manufacturer is? We can help check.

UI
Undisclosed Integrator #1
Feb 25, 2015

The manufacturer is Dahua and they say, they don't have the capacity and qualification to recover HDD content exactly.

JH
John Honovich
Feb 25, 2015
IPVM

Yes, I agree with them :)

Hopefully, you have already pulled the hard drive and might try some third party service. Seems like a longshot though.

UI
Undisclosed Integrator #2
Feb 25, 2015

Yes it is possible because the data is not erased, instead when the hard drive is full it only overwrites what is already there. I should also say that if the hard drive is the newer solid state drive (SSD) then that answer would be no.

(1)
UM
Undisclosed Manufacturer #3
Feb 25, 2015

It can depend somewhat on the filesystem. Linux-based systems may be using EXT3 or EXT4, which not only mark the sectors as available (as with NTFS), but also delete the pointers to the files (inodes).

That said, there are some free utilities, such as PhotoRec that can search a drive for files that have not been overwritten, but you lose all attributes (such as file names).

JE
Jim Elder
Feb 25, 2015
IPVMU Certified

THere are a number of File recovery services available. Here is one that i know of. I contacted them some time ago about a similar issue and they said they may be able to do it. Good thing is, they give you an esimate and you only need pay 15% to find out if they can recover it. If the file is recoverable, they give you a quote which could range from $200 to about $900 as I recall.

As it turns out, i did not need the service, so i cannot tell you anything about the company. Please post if you find out something that works. I would bet that others have or will run into this issue at one point or another.

U
Undisclosed #4
Feb 25, 2015
IPVMU Certified

IMHO, this is really two seperate questions:

1. Is there a (reasonable) chance that the needed data still exists?

This depends mostly on how soon the recorder was stopped after the 'overwrite' happened. It also depends on how long the footage needed is? If it was on auto-overwrite and ran out of space, then it would delete one or more of the oldest files, freeing up space, thus allowing it to grow existing files and create new files from the sectors that were deleted. For efficiency it would be expected that the auto-delete process would delete a few files at a time, so that it was not continually running.

If for instance, the recorder was stopped within a few minutes of the deletion, you would have good chances of getting of a sub-minute clip. As the time increases since stopping the recording and the needed footage gets longer, your original data will start to resemble Swiss cheese, with bigger and bigger holes.

2. Is there a (reasonable) way to recover it or reconstruct it if it does?

This will depend on how long the clip is as well as a lot of other factors, like how the disk extents are allocated, how fragmented the superblock/inode indirection is, etc. And how much it's worth to have someone try to identify and stitch the parts together where possible.

I put a tiny 16gig SATA drive in my Dahua NVR, and am letting it fill-up, to see what I can learn about the deletion algorithm. I'll post back anything interesting.

UI
Undisclosed Integrator #2
Feb 26, 2015

Also to keep in mind is the integrity of the recovery... especially if it will be used in court. The data cannot be changed so make sure whatever you use maintains that integrity.

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions