What to do in the first hour after a break-in: saving the footage

The hour after discovering a break-in is when footage is most likely to be lost, and almost always by accident. The recorder is still running, still recording, and still overwriting the oldest material on the disk — which on a short-retention system can include the event itself within days.

What follows is the order we give clients over the phone.

Why the clock is against you

A recorder writes continuously and, once full, replaces the oldest footage. If your real retention is eleven days rather than the thirty you were quoted, the useful window is eleven days — and if the incident happened during a busy period, less.

Meanwhile the natural response to a break-in is to review footage repeatedly, show it to neighbours, hunt for a better angle. All of that is fine. What is not fine is leaving the export until tomorrow.

The first hour, in order

• Do not disconnect or reset the recorder. Powering it off abruptly risks the disk, and a reset can clear the very logs that establish the timeline.
• Note the recorder’s own clock time, and how far it differs from real time. If the clock is wrong, every timestamp needs that offset applied, and knowing it now saves an argument later.
• Find the event window on one camera, then widen it. Take thirty minutes before and after, not just the moment — approach and departure routes matter more than the act.
• Export that window from every camera that covers any part of it, including cameras that seem to show nothing. A camera showing an empty frame establishes which route was not used.
• Copy the exports off the pen drive to a computer and to one other place. A single copy on a pen drive is not preservation.
• Only then review, share and discuss.

If you have an AMC or an installer who answers the phone, call them at step one. Exporting is the step people find hardest under stress, and it is the step with a deadline.

How to export footage so it stays usable

Two practical points decide whether an export is useful weeks later.

Export the native file, not a screen recording. A video of the monitor taken on a phone loses resolution and carries no timestamp metadata. Most recorders export a proprietary file plus a small player, or offer a standard format — take the standard format if offered, and take the player too if not.

Export the log alongside it. Many recorders can export a system log showing recording continuity and any gaps. It is unglamorous and it is the thing that answers “could this have been edited?”

Keep the original file untouched. If you need to trim or brighten a clip for sharing, work on a copy, so the original remains as it came off the recorder.

The four mistakes that destroy evidence

• Waiting until the weekend. The commonest loss by a wide margin, and entirely avoidable.
• Formatting the disk on the advice of somebody troubleshooting an unrelated fault. Never format after an incident until exports are safely copied twice.
• Recording the screen with a phone instead of exporting, then deleting nothing but relying on that clip.
• Exporting only the two minutes around the event. Approach, waiting, and exit are usually where identification actually comes from.

What to do if the recorder itself is gone

It happens, and it is the reason a recorder should be out of sight rather than beside the front door. If the unit has been taken:

• Check whether any camera recorded to its own memory card as well — some do, and that copy survives.
• Check whether cloud clip storage was enabled on the recorder or on any individual camera. Not common in standard configurations, but worth thirty seconds to establish.
• Preserve the site around where the recorder was, rather than tidying it.

Afterwards, treat recorder placement as a design decision. A unit in a locked, ventilated position away from the entry, with a camera covering it, converts “they took the evidence” into “we have footage of them taking the evidence”.