I’ve recently been involved in an interesting CCTV recovery case. The CCTV allegedly recorded a violent incident in a nightclub. What the incident was is not important for the purposes of this post, but it’s sufficient to say the incident’s recovery was very important.
The CCTV system when inspected was found not to contain evidence of the incident. The owners of the nightclub were baffled as to why this was they case. Upon inspection of the system, it appeared that no data had been deleted, it was just that no data appeared to have been there.
Inspection revealed that the CCTV system was set to loop-record in 30 day cycles, and so would only contain information from the last 30 days. The incident took place some 9 months previously but in the meantime the CCTV system had remained off.
Understanding this was crucial to the retrieval of footage from the hard drives of the CCTV system.