Surveillance video deleted after a preservation letter: proving spoliation without recovering the footage
The situation
A customer sued a private security company and a shopping center alleging excessive force by security officers in a parking garage. Plaintiff's counsel sent a preservation letter two days after the incident requesting all video, access-control records, incident reports, and communications. Three months later the defendants said the relevant video no longer existed because the system overwrites after 30 days.
What the other side said the evidence showed
That the deletion was routine and automatic — a retention policy doing what retention policies do, with no human decision involved and therefore nothing to sanction.
When video is gone, the question stops being what it showed and becomes when it existed, who touched it, and whether it could have been kept.
This is the case type where attorneys most often assume forensics has nothing to offer, because the obvious deliverable — the footage — is unavailable. In practice the surveillance system is a far richer record than the video alone. Recording indexes show which camera covered which area. System logs record who logged in, what they viewed, and what they exported. Retention settings can be measured against actual disk behavior. Export events leave traces on the machines that received the files.
A retention policy is also a testable claim rather than an explanation. If a system is configured for 30 days and the incident video was overwritten at 26 to 33 days, that is consistent with automatic operation. If someone viewed and exported the relevant camera two days after the incident and that export never appeared in discovery, the automatic-overwrite explanation stops covering the whole question.
The practical point for civil counsel: spoliation is frequently provable from artifacts about the missing file even when the file itself is unrecoverable. The absence of the video does not end the inquiry — it relocates it.
What the examination involved
Imaged the NVR and camera drives
Forensic images of the recorder and associated storage, so retention behavior, indexes, and unallocated space could be examined without further altering the system.
Reconstructed the recording index and coverage
The index established which camera covered the area of the incident, and what the system believed it had recorded at the relevant time.
Carved fragments from unallocated storage
Although the complete file was gone, several short video segments were recoverable from unallocated space — enough to establish content and coverage, though the crucial interval remained missing.
Tested the retention claim against the system's actual behavior
The defense stated 30-day automatic retention. Measured behavior at the time of the incident put effective retention at roughly 26 to 33 days, which is consistent with the claim. That part of the explanation held up.
Examined system access and export logs
The logs recorded a supervisor viewing the relevant camera and exporting a seven-minute clip shortly after the incident. That export was not among the files produced in discovery.
Followed the export onto the manager's laptop
LNK artifacts referenced the exported file; an MFT record and partial video data established that it had been created after the preservation letter and deleted two days later. A recovered fragment contained frames from the parking garage.
Read the surrounding email traffic
Internal messages established awareness of the incident, of the preservation request, and of the existence of the export.
What the examination found
- The automatic-overwrite explanation was accurate as far as the underlying NVR retention went
- A supervisor had viewed the relevant camera and exported a seven-minute clip after the incident
- That export was never produced in discovery
- File-system artifacts on a manager's laptop showed the exported file was created after the preservation letter arrived and deleted two days later
- A partial recovered fragment contained frames from the parking garage incident
- A shorter clip later produced by the defense was not a continuous export — it consisted of two segments joined together
Outcome
The examination supported a spoliation argument built on the export and its deletion rather than on the automatic overwrite, which was legitimate. A careful expert conclusion separates the two: routine retention explains the loss of the original recording; it does not explain a manual export created after a preservation duty attached and deleted two days later.
Takeaways for counsel
- Send the preservation letter naming the system, not just the footage — recorder, camera drives, system logs, export history, access logs, and the machines that received any exports.
- "It was automatically overwritten" is a testable claim. Retention settings, index data, and disk behavior either corroborate it or don't.
- Ask specifically whether anyone viewed or exported the relevant camera after the incident, and demand the access logs that would show it.
- Exports leave traces on the receiving computer — LNK files, MFT records, jump lists — long after the file is deleted.
- A produced clip that is shorter than the original is worth examining for continuity. Two segments joined together is a materially different exhibit from a continuous export.
Related questions
Frequently, yes. Recording indexes, system and access logs, export histories, retention configuration, and unallocated space often survive the video itself. In spoliation disputes those artifacts are usually more probative than the footage would have been, because the contested question has shifted from what happened to what was preserved.
Services involved
Have a case that turns on digital evidence?
Tell us the case, the device, and your deadline. The scoping call is free, and we'll tell you honestly whether an examination is worth it.
Appointed counsel: see our Colorado public defender program.
More case studies
A screen recording was the only surviving record of the conversation — what made it hold up
The drone video looked decisive until the flight logs put the camera 70 feet away
Deleted files in an employee-theft prosecution: what the artifacts proved, and what they couldn't
This case study is illustrative. It is written to show how digital evidence is examined, challenged, and presented in court; it is not an account of any client matter, and any resemblance to a specific case is unintended. The techniques and failure modes described are real. Nothing on this page is legal advice, and no result is a prediction or guarantee of the outcome of any other matter.