For large corporations, keeping recordings for a long period is common.

I was at Sprint retail back in 2010 when information was leaked by a coworker at my retail store. The internal security team that came to the store less than a week after the leak, had recordings from the cameras 6 months prior that they were referencing when talking to all of us.

A small business may only be keeping camera recordings for maybe a month on a local DVR, but a corporation with their own data centers are going to keep those a lot longer. ESPECIALLY a government contractor where the logging requirements are much more stringent.