The CCTV footage played in court during the murder trial over the death of Albert Ojwang has become one of the case’s most significant pieces of evidence.
The recordings, retrieved by the Independent Policing Oversight Authority (IPOA), show Ojwang walking into Nairobi’s Central Police Station alive before later being carried out unresponsive. Prosecutors have relied on the footage as part of the evidence presented against former Central Police Station OCS Samson Talaam and his co-accused.
For many Kenyans following the case, one question has stood out: How was footage reportedly deleted from the station’s CCTV system recovered?
While IPOA has not publicly explained the forensic process it used, digital forensics experts say recovering deleted CCTV recordings is often possible, depending on what happened to the storage device after the files were removed.
Deleting a File Is Not the Same as Destroying It
When a CCTV recording is deleted, the video is not always erased immediately.
Instead, most Digital Video Recorders (DVRs) and Network Video Recorders (NVRs) simply mark the space occupied by that recording as available for future use. The actual video data can remain on the hard drive until fresh recordings are written over it.
This means investigators may still be able to recover deleted footage if they obtain the storage device before too much new data has replaced the old recordings.
How Investigators Recover Deleted CCTV Footage
The first step for forensic investigators is usually to secure the recording equipment and preserve the evidence.
Rather than examining the original hard drive directly, specialists create an exact forensic copy of the storage device. This protects the original evidence from accidental changes during analysis.
Using specialised forensic software, investigators then scan the copied drive for deleted files, hidden data and fragments of video that may no longer appear in the recorder’s normal menu.
Even when a complete file cannot be found, forensic tools can sometimes reconstruct recordings from remaining pieces of data.
Investigators also analyse system logs, which can reveal when footage was deleted, whether the recorder was formatted or whether settings were changed.
Why Timing Matters
Whether deleted CCTV footage can be recovered often depends on how much the system has continued recording after the files were removed.
Most CCTV systems continuously record and automatically overwrite older data once the storage becomes full. Every new recording replaces part of the old information.
If investigators seize the recorder before a significant amount of new footage has been saved, there is a much greater chance that deleted recordings will still exist on the hard drive.
However, if the deleted space has been completely overwritten, recovery becomes extremely difficult and, in many cases, impossible.
Why the Albert Ojwang Footage Matters
The CCTV recordings have become central to the prosecution’s case surrounding Ojwang’s death while in police custody.
The footage shown in court captures his arrival at Central Police Station and later shows him being carried out while unresponsive. It forms part of the evidence being examined by the court as prosecutors seek to establish what happened during the hours he was held at the station.
Although IPOA has not disclosed the specific forensic methods it used to recover the recordings, digital forensic principles show that deleted files are not necessarily lost forever. If investigators secure a storage device before the deleted data is overwritten, modern forensic techniques can often retrieve evidence that appears to have vanished.
As the trial continues, the recovered CCTV footage is expected to remain one of the most closely scrutinised pieces of evidence before the court.
About the Author
