Four and a half hours missing from one camera. Why?
A forensic investigation firm was working an incident captured by a commercial security recorder. One camera had no footage for about four and a half hours on the evening in question. They needed to know why: was it deleted, disabled, or never recorded?
What made it difficult
- The question wasn't "can you recover it", but "why isn't it there", and the answer had to stand up to scrutiny.
- The recorder's internal records aren't documented by its manufacturer.
- The recorder's channel numbers didn't match the camera labels: one camera's footage was logged under the next channel number.
- The camera recorded on motion, not continuously, so "no footage" could mean several different things.
What we did
- Built a custom toolset for this recorder and recovered everything on its video partition: video, still images and audio, plus deleted recordings going back about four months.
- Decoded the recorder's own event database, almost two million entries, into a spreadsheet the client could review.
- Checked the gap three independent ways: the event log, the recovered video index, and a scan of the raw disk below the index, which still held older fragments from the same camera.
- Confirmed the log had no missing entries, and that the recorder did log video loss on another channel that night, but never on this one.
- Compared the same camera on the four preceding Fridays.
All three sources agreed: the camera recorded nothing during the gap, no log entries were missing, and nothing from that period was found on the disk. On the four previous Fridays, the same camera had stopped recording within about 12 minutes of the same time and stayed quiet until morning. The written finding: the gap is consistent with the camera staying online with no motion to trigger a recording, and there is no affirmative evidence that footage was deleted or the camera was disabled. We also set out a controlled test on an identical recorder to show exactly what its firmware logs when a channel is turned off. Along the way, the log showed that a different camera had still been connected but hadn't been recorded for over a year.
Lab notes: SQLite event log, 1,953,676 rows, contiguous IDs · FAT32 video partition · H.265 video, G.711 audio · raw-disk scan for proprietary recording structures
Similar problem?
Tell us what happened
Send the details or call (587) 387-2346. We'll tell you what to do with the device until you get here.
Drop-off: Southcentre Executive Tower, #610 - 11012 Macleod Trail SE, Calgary. Monday to Thursday 8:00 AM to 6:00 PM, Friday 8:00 AM to 5:30 PM.