Disk Full on Camera 7
You are the clerical corporal in the security office of a Category B airport. At 21:15 the CCTV workstation displays 'disk full - recording stopped' and all channels are affected, including Camera 7 on the cargo gate. The recorder has a 4 TB disk, 16 cameras streaming at 4 Mbps each, and was configured at installation for 30-day retention. A notebook beside the operator's desk holds the recorder's administrator password in plain text. Last week a 40-minute clip was exported for a theft inquiry and has never been deleted. The shift in-charge wants a two-line message on the phone now and a formal email by 08:00. The operator asks you to 'just delete the oldest ten days' yourself so that recording restarts. No incident is currently under investigation at the cargo gate, but the theft inquiry from last week is still open.
1. Calculate whether 4 TB can hold 16 cameras at 4 Mbps for 30 days. Show the working and state the options.
Read the worked answer
Per camera: 4 Mbps = 0.5 MB/s. Per day: 0.5 × 86,400 = 43,200 MB ≈ 43.2 GB. All cameras: 43.2 × 16 = 691.2 GB per day. Capacity: with 4 TB nominal and about 3.6 TB usable, 3,600 ÷ 691.2 ≈ 5.2 days; even on the full 4,000 GB it is 5.8 days. Conclusion: 30-day retention was never achievable on this hardware at this bitrate. The export and the disk-full message did not cause the failure; they exposed a configuration error made at installation. Options to put to the officer:
- Reduce bitrate or frame rate - 2 Mbps roughly doubles retention to about 11 days, still short.
- Motion-based recording on low-traffic cameras, which can cut storage by 40–60%.
- Add storage: to hold 30 days at 691 GB/day needs about 21 TB, plus headroom, so about 24 TB.
- Or adopt a shorter retention period, documented and signed - an unwritten 30-day promise is what fails in an inquiry or a court.
2. Draft the two-line message for the shift in-charge and outline the formal email due by 08:00.
Read the worked answer
Message (immediate, factual, asks for a decision): '21:15 - recorder disk full, recording stopped on all 16 channels including Camera 7 cargo gate; actual retention was about 5.8 days, not the configured 30. Request your instruction on retention/bitrate; nothing deleted pending your approval. - Cpl [name], Security Office.' Why in this shape: it is time-stamped, states impact rather than speculation, asks for a decision, and records that nothing was destroyed. Email outline:
- Subject: CCTV recording failure - cargo gate Camera 7 - storage capacity against 30-day retention
- What happened: time, exact message, channels affected, when recording stopped.
- Impact: the period with no coverage, and whether any open inquiry is affected.
- Cause: the capacity calculation, in figures.
- Action taken: nothing deleted, password issue reported separately.
- Options with approximate cost and the retention each buys.
- Recommendation and the approval sought, with a deadline.
- Annexes: screenshot, export list, camera schedule.
3. The operator asks you to delete the oldest ten days, and the password is written in a notebook. How do you respond to both?
Read the worked answer
On the deletion - refuse, and explain the reason rather than the rank. Deletion is not a storage housekeeping task: it destroys potential evidence, and the theft inquiry is still open. Automatic overwrite by the recorder is a normal operating event; a manual deletion by a named person is a deliberate act that must be authorised and recorded. Propose instead: export and label what the inquiry needs, then allow the automatic overwrite to resume, or obtain written approval for a change of retention policy. On the password - treat it as a security incident, not a housekeeping note. Anyone who can read that notebook can delete, alter or export footage, which destroys the office's ability to prove who had access. Change the administrator password today, move to individual accounts so each action is attributable, record the change in the register, and report it to the officer in the same email. Why report rather than quietly fix: if footage is later challenged, the office must show a controlled access history. A silent fix leaves the earlier exposure undocumented and the evidence unarguable.