Updated August 2026. After a break-in, the first job is not buying a bigger alarm package. It is getting people to safety, calling the right authorities, preserving evidence, closing the immediate security gap, and restoring the home in a controlled order. This guide turns those jobs into a 48-hour recovery plan and a 60-minute security acceptance test.
If you believe someone may still be inside, do not enter or search the property. Move to a safe location and call emergency services. Follow instructions from police, fire, medical, building management, and your insurer. This article is a security operations checklist, not legal, medical, insurance, or emergency-response advice.
Break-in recovery: the short version
- Protect people first: stay out of an unsafe property and call emergency services.
- Preserve the scene: avoid touching, cleaning, repairing, or resetting affected areas until police and the insurer say you may proceed.
- Save volatile records: export camera clips, alarm events, access logs, notification screenshots, and monitoring records before retention windows overwrite them.
- Close the known opening: use a documented temporary repair, change exposed credentials, and add direct sensing to the actual entry path.
- Test the whole chain: verify door state, alarm reporting, cameras, alerts, monitoring, power loss, internet loss, user removal, and recovery.
What this plan covers
A burglary can expose more than a damaged door. It may reveal a weak strike plate, an unsensed window, a camera blind spot, a shared code, a stolen phone, an unlocked password manager, a missing alarm event, or a response plan nobody understood. Treat the incident as a chain of physical, digital, and operating failures. Repair each confirmed gap without guessing that one new camera will solve all of them.
| Layer | Question after the incident | Recovery evidence |
|---|---|---|
| People | Is everyone safe, accounted for, and able to stay elsewhere if needed? | Named household contact and temporary-location plan |
| Physical | Which door, window, gate, wall, lock, or key path failed? | Police-approved photos, measurements, repair record |
| Detection | Did a direct sensor report the opening, and was the zone named correctly? | Alarm timeline and supervised zone test |
| Evidence | Were useful clips and event records retained with correct timestamps? | Original exports, hashes where practical, and an evidence index |
| Access | Were keys, codes, phones, tokens, or account sessions exposed? | Credential-change and user-removal log |
| Response | Who received the alert, what did they do, and where did the chain stop? | Written incident timeline and revised response matrix |
Phase 1: first 30 minutes
Stay outside an uncertain scene
Do not assume the property is clear because an app shows no motion or a camera looks quiet. Cameras have blind spots, batteries fail, and a person may avoid a sensor. If there is any chance the event is active, stay at a safe distance and call emergency services. Do not ask a neighbor, cleaner, relative, or monitoring contact to investigate in person.
Account for people and urgent needs
Confirm the location of residents, children, guests, pets, caregivers, and workers. Tell responders about anyone who may be inside, known hazards, pets, firearms, oxygen equipment, or accessibility needs. Do not post live details about an empty home or temporary accommodation on social media.
Do not reset the story
Before touching the alarm app, note the current state: armed mode, active zones, device warnings, camera status, internet status, power status, and the time shown on the phone. Take screenshots without deleting alerts or clearing history. An immediate factory reset, device removal, clock correction, or automation edit can erase context needed by police, the insurer, or your own diagnosis.
Phase 2: preserve evidence without damaging it
Ask the investigating officer what may be photographed, moved, secured, or repaired. Ask your insurer what documentation it needs before cleanup or disposal. The Ready.gov property documentation guide explains the value of an inventory, photographs, and protected records. Requirements differ by location and policy, so record the advice you receive rather than relying on a generic checklist.
Build one incident index
Create a folder named with the property and incident date. Keep an index with the file name, source system, event time, export time, time zone, person who exported it, and any later copy or conversion. Preserve original files separately from edited clips or annotated screenshots. Do not crop, enhance, re-encode, or add music to the only copy.
- Police incident or report number and officer contact method
- Insurer claim number and adjuster instructions
- Wide and close photographs of each affected area, when permitted
- Camera clips before, during, and after the event
- Alarm history, zone events, arm/disarm events, and user history
- Smart-lock events, code use, failed attempts, and battery warnings
- Monitoring call records, verification messages, and dispatch notes
- Router, power, hub, and camera outage records if available
- Receipts, serial numbers, repair estimates, and temporary-security costs
The home-security insurance evidence checklist covers inventories, receipts, device records, camera exports, and protected storage in more detail. Keep the incident index factual. Separate observed events from assumptions about how entry occurred or who was involved.
Export before retention expires
Cloud and local camera systems use different retention windows. A subscription change, overwritten memory card, power cycle, stolen recorder, or account lockout can make footage unavailable. Export the relevant range promptly, but only after confirming that doing so will not alter the original evidence. Include several minutes before and after the visible event so the clip retains context.
Check timestamps against a known reference and record any offset. Do not silently change a camera clock and then describe the old footage as corrected. The camera timestamp and clock-drift audit provides a repeatable way to document local time, UTC, daylight-saving changes, and device drift.
Phase 3: close the immediate security gap
Once authorities and the insurer allow work, make the property safe for occupancy. A temporary repair should restore basic closure and delay without hiding the original damage before it is documented. Use a qualified locksmith, glazier, door technician, building manager, or contractor for work outside your skills. Fire exits and required egress must remain usable.
Repair the path that actually failed
- Forced door: inspect the door slab, frame, jamb, hinges, strike, fasteners, deadbolt throw, glazing, and surrounding wall. A new lock on a split jamb is not a complete repair.
- Window entry: inspect the sash, lock, frame, glass, screen, accessible roof or fence approach, and the sensor’s mounting surface.
- Stolen or copied key: rekey or replace every affected cylinder and account for spare keys, building keys, mailbox keys, garage remotes, and key safes.
- Used code or credential: remove the exposed credential, review every user, end old sessions where supported, and test that removed access fails locally.
- Garage or gate route: reset remotes or access codes, inspect emergency-release exposure, and add direct state sensing where appropriate.
Do not install a sensor until the opening closes consistently. A door contact cannot correct a misaligned latch, warped frame, or weak strike. After repair, record the contractor, work performed, parts, photos, warranty, and final fit test.
Add direct state before adding interpretation
Protect the confirmed entry route with a direct door or window contact when practical. Motion, video analytics, occupancy, and voice assistants can add context, but they should not be the only way the alarm knows an exterior opening changed state. Name the zone by physical location and type, such as “Kitchen east casement” or “Garage interior door,” not “Sensor 7.”
For a DIY hub, the Abode Smart Security Kit is one current starting point for an alarm hub and entry sensing. The Abode Mini Door/Window Sensor is designed to report opening state when installed within its fit limits. Check the live product page, compatibility, mounting clearance, plan state, and return terms before buying. Product availability and features can change.
Phase 4: secure accounts, phones, keys, and codes
A physical break-in can become a digital-access incident if phones, tablets, laptops, password records, keys, mail, or identity documents were taken or viewed. Work from a trusted device. Change the primary email and password-manager credentials first when they control recovery for other services. Then review the alarm, cameras, locks, router, Apple or Google home, monitoring portal, cellular account, and retailer accounts.
Use a credential exposure table
| Credential | Immediate action | Proof of completion |
|---|---|---|
| Physical keys | List affected cylinders; rekey or replace as required | Locksmith record and old-key failure test |
| Alarm PINs | Replace master and exposed user codes; remove unknown users | Named-code register and removed-code test |
| Smart-lock codes | Revoke exposed, shared, expired, and contractor codes | Local keypad test plus app history |
| Phones and tablets | Use platform loss controls, end sessions, rotate recovery credentials | Device list and account-security record |
| Camera accounts | Review viewers, shared links, sessions, storage, and exports | Viewer list and access-removal test |
| Wi-Fi and router | Change exposed admin access; assess Wi-Fi credential exposure | Router admin and connected-device review |
| Garage remotes | Erase and re-enroll affected transmitters if supported | Old-remote failure and new-remote success |
Do not leave the installer as the only administrator. Use named household accounts, multi-factor authentication where available, and two tested recovery methods. If identity documents or financial information were stolen, use the official IdentityTheft.gov recovery process and contact the relevant institutions.
Phase 5: reconstruct what the system did
A useful incident review is a timeline, not a blame session. Put events in order using the alarm history, camera time, monitoring records, phone notifications, witness observations, and responder records. Mark the time zone and confidence for each entry.
- What was the last confirmed normal property state?
- When did the first physical, alarm, camera, network, or power event occur?
- Which direct sensor changed state?
- Which camera recorded usable evidence?
- Who received each alert, on which channel, and how long after the event?
- Did monitoring receive the correct zone and contact the correct people?
- Did an automation change a lock, light, alarm mode, or notification?
- Which step worked, which failed, and which was never configured?
Distinguish “no event recorded” from “the event did not happen.” A sensor may be absent, asleep, bypassed, out of range, misnamed, or attached to the wrong surface. A camera may be offline, pointed elsewhere, outside its detection zone, or unable to retain footage. Write the proven condition and a test that can settle the unknown.
Phase 6: rebuild the response plan
Every alert needs an owner, a backup, a safe verification method, an escalation threshold, and a stop condition. “Everyone gets notifications” is not a response plan. It can cause duplicate calls, ignored alerts, or unsafe in-person checks.
| Event | Primary response | Backup | Unsafe action to prohibit |
|---|---|---|---|
| Entry alarm while away | Monitoring or named responder follows the written verification path | Second named contact | Driving over to search the home |
| Camera motion without alarm | Review from a safe location and compare direct sensors | Second viewer if evidence is unclear | Assuming a person is harmless from one clip |
| Door left open | Contact an authorized person already known to be safe | Building manager or documented local contact | Sending an untrained neighbor into an uncertain scene |
| Hub or internet offline | Check power and provider status remotely where possible | Use the documented local fallback | Disarming all protection as a first step |
| Unknown code use | Secure the property, disable the code, preserve logs | Account owner and monitoring contact | Deleting the user before saving the event record |
Use the home-security alert escalation plan to map events, responders, backups, verification, and stop conditions. If your plan includes professional monitoring, notify the provider before testing and confirm its test-mode process, event types, zone names, contact order, verification rules, and exit from test mode.
Camera changes after a break-in
Place cameras to answer defined questions: who approached, which direction they came from, which opening was used, and which way they left. Avoid pointing cameras into neighbors’ private spaces or placing them in bedrooms, bathrooms, or other sensitive areas. Check local recording and audio-consent laws before enabling audio.
A camera is useful only if it has power, network access, a useful field of view, correct time, adequate night exposure, enough retention, protected account access, and a tested export path. Walk the real route in daylight and at night. Test hats, backlighting, porch lights, headlights, weather, pets, branches, and package placement. Confirm that a notification opens the correct live view and that the clip can be exported by the person responsible for evidence.
If you want an Abode camera in the repaired plan, review the current Abode Cam 2 page for live features, power, placement, storage, and plan requirements. Do not buy it solely because the rest of the alarm uses the same brand; confirm that it can answer the exact evidence question at the actual location.
Power, internet, and equipment-loss checks
The incident may have included a cut cable, unplugged router, stolen recorder, dead battery, jammed door, or damaged hub. Test each dependency separately. Internet backup is not the same as power backup, and cellular alarm reporting does not automatically keep Wi-Fi cameras online.
- Unplug broadband and record what still senses, sounds, records, reports, and opens locally.
- Remove mains power using a safe, documented method and time hub, router, access-point, camera, and lock behavior.
- Confirm local entry and safe exit when phones and cloud services are unavailable.
- Check whether a stolen camera or recorder takes the only evidence copy with it.
- Verify low-battery warnings and the household owner responsible for replacement.
- Restore services in order and confirm that devices reconnect without silent gaps.
Record actual runtime instead of relying on a battery label. The home-security UPS runtime guide explains load, conversion losses, battery aging, network dependencies, and a controlled outage test.
What not to do after a break-in
- Do not enter or search an uncertain property.
- Do not touch, clean, repair, or discard evidence before you are cleared to do so.
- Do not post identifying footage publicly before police and the insurer advise you.
- Do not factory-reset cameras, locks, hubs, phones, or routers before preserving records.
- Do not replace every device without identifying the failed layer and acceptance test.
- Do not give contractors or temporary occupants the household master login.
- Do not rely on one phone, one cloud account, one camera, or one person for recovery.
- Do not describe a temporary repair as a finished security upgrade.
A practical 48-hour recovery schedule
Hours 0–2: safety and preservation
- Move to safety, contact emergency services, and account for people.
- Record the current alarm, camera, power, and network state without resetting it.
- Follow police and insurer instructions about entry, photos, repairs, and cleanup.
- Start the incident index and preserve volatile camera and alarm records.
Hours 2–12: temporary security
- Document damage and authorize permitted temporary repairs.
- Rekey or disable exposed physical and digital access.
- Arrange safe temporary accommodation if the home cannot be secured.
- Confirm insurance, building-management, locksmith, glazing, and monitoring contacts.
Hours 12–24: diagnosis
- Build the incident timeline and identify known, failed, and untested layers.
- Inspect the entry route, sensor coverage, camera evidence, account exposure, and alert chain.
- Approve permanent repairs based on the actual failure, not a generic bundle.
- Write the new zone names, user roles, response owners, and outage paths.
Hours 24–48: permanent controls and acceptance
- Complete permitted physical repairs and direct sensing.
- Finish credential rotation, user removal, and account recovery checks.
- Recommission cameras, monitoring, notifications, and automations.
- Run the 60-minute test below and record every failure before declaring recovery complete.
60-minute post-break-in security acceptance test
Tell the monitoring provider and household before testing. Do not create a false dispatch, damage equipment, defeat required safety systems, or simulate a dangerous event. Use controlled opening, account, network, and power checks.
- Minutes 0–8 — physical opening: inspect the repaired door or window, latch it repeatedly, test normal entry and safe exit, and record any rubbing, bounce, or incomplete closure.
- Minutes 8–16 — direct sensing: open and close the confirmed entry route and nearby openings; verify exact zone names, timestamps, armed-state behavior, and local siren rules.
- Minutes 16–24 — access: test each retained named code, one removed code, the mechanical backup, phone loss procedure, and account-recovery contact.
- Minutes 24–32 — cameras: walk the approach and exit routes in test conditions; verify field of view, night exposure, clip retention, correct time, notification, live view, and export.
- Minutes 32–40 — response: trigger approved test events; confirm the primary and backup responder receive the correct event and follow the written safe-verification path.
- Minutes 40–48 — monitoring: confirm the provider receives the correct zone, uses the current contact order, recognizes test mode, and records the test result.
- Minutes 48–54 — failures: test internet loss, approved power loss, unavailable phone, and one offline device. Record what continues locally and remotely.
- Minutes 54–60 — recovery: restore all services, exit test mode, verify final alarm and lock state, confirm cameras are recording, and assign every unresolved item to a person and date.
A pass requires evidence, not a green icon. Keep the test date, participants, firmware and app versions, zone list, screenshots, monitoring confirmation, failures, repairs, owner, and retest date. Repeat the affected part after any door work, lock change, network change, account change, camera move, automation edit, monitoring change, or major outage.
Buying rules for the rebuilt system
Before purchasing, write the property state the product must prove, the person who must receive it, the action they must take, the failure state you will test, and the ownership path if you stop paying. Compare complete three-year cost: equipment, sensors, locks, cameras, mounts, storage, monitoring, cellular backup, permits, false-alarm fees, batteries, network and power backup, repairs, replacement, and exit costs.
Prefer equipment with named users, clear event history, independent local entry, usable exports, supported account recovery, documented battery behavior, and a return window long enough to run the acceptance test. A longer feature list does not compensate for an unsensed opening or an unowned alert.
Frequently asked questions
Should I clean up before police arrive?
No. Stay out of an unsafe property and avoid touching, cleaning, moving, or repairing affected areas until police say you may proceed. Ask your insurer what it needs before cleanup or disposal.
Should I reset my alarm and cameras immediately?
Preserve alerts, event history, clips, device state, and account records first. A reset can erase context. Change exposed access promptly from a trusted device, but document the pre-change state and follow police and insurer instructions.
Do I need more cameras after a burglary?
Not automatically. First identify the physical entry path, direct sensing, evidence question, alert owner, retention, power, network, privacy boundary, and export path. A camera should fill a defined evidence gap.
When is the home security system recovered?
When permanent physical repairs are complete, exposed access is removed, direct zones and cameras are recommissioned, monitoring and responders are current, failure modes are tested, and the results are documented. Buying equipment alone is not recovery.
How often should the rebuilt plan be retested?
Retest the affected path after any repair, device move, account change, code change, network or power change, monitoring change, automation edit, or serious outage. Run the complete acceptance test on a scheduled basis and after another incident.
