Many Kenyans have been wondering how the Independent Policing Oversight Authority (IPOA) managed to retrieve CCTV footage that had reportedly been deleted from Nairobi's Central Police Station following the death of Albert Ojwang.
While forensic experts have not publicly disclosed the exact method used, understanding how digital storage works can help explain why "deleted" footage is not always gone forever.
Think of it this way: imagine you wear a shirt today, and it is not very dirty. Instead of putting it in the laundry basket with dirty clothes or hanging it back in the wardrobe with clean clothes, you leave it somewhere convenient because you might wear it again tomorrow.
The shirt hasn't disappeared. It's simply waiting in a different place until it is either worn again or eventually washed.
Digital storage works in a somewhat similar way.
When CCTV footage is deleted from a hard drive, the files are often not immediately erased. Instead, the system simply marks the space occupied by those files as "available" for future use.
Advertisement
Advertisement
What Happens Inside a Hard Drive?
A hard drive stores information in different sections. When footage is deleted, the computer does not necessarily wipe every piece of that data instantly.
Instead, it removes the "address" that tells the system where to find the footage. The actual video data may remain on the drive until new recordings are saved over it.
This means that forensic investigators can sometimes recover deleted files because the information is still physically present on the storage device.
Digital Forensics
The Overwriting Process
Imagine a CCTV system contained 800GB of footage and someone deleted it.
If the cameras later record 100GB of new footage, only 100GB of the previously deleted space would be overwritten. This would leave approximately 700GB of the older footage still intact and potentially recoverable.
The more new footage that is recorded after deletion, the less likely it becomes that investigators can recover the original files because they are gradually replaced by new data.
Why Timing Matters
In the case of the Central Police Station CCTV system, some online commentators have suggested that IPOA may have moved quickly enough to seize and examine the storage devices before sufficient new recordings could overwrite the deleted footage.
If that happened, forensic specialists would have had a better chance of recovering portions of the original recordings.
This is one reason digital investigators often act quickly when dealing with computers, phones, CCTV systems, and other electronic devices. Every hour that passes can result in new data being written over potentially important evidence.
The Power of Digital Forensics
Modern digital forensics is remarkably advanced. Specialists can often recover deleted photos, videos, documents, and CCTV recordings that many people assume are permanently erased.
In simple terms, deleting a file is often more like removing a book from a library catalogue than burning the book itself. Until the space is reused and overwritten, traces of the original data may still remain.
Digital Forensics
That is why investigators are sometimes able to retrieve evidence that others believed had vanished forever.
This version keeps the shirt analogy while making the article more professional, educational, and easy for a general audience to understand.
