Carving out MJPEG/J...
 
Notifications
Clear all

Carving out MJPEG/JPEG files from a DVR image

8 Posts
5 Users
0 Likes
1,024 Views
(@terrific)
Posts: 6
Active Member
Topic starter
 

Hello Gents,

We have a old netpromax DVR, which uses DAT files for 5 minutes of intervals. We made a recovery and we are trying to carve out JPEGS from the DAT files.

I tried several tools, but none of them are successful.

Because normal jpegs are starting with FF D8 FF E1 or FF D8 FF E0 and ends with FF D9.

But in my case, JPGs are starting only with FF D8 FF and there are no FF D9

as far as i know enhanced mjpeg files are between 2 to 7 KB , i also tried to use simple carver to carve out jpgs satarting with FF D8 FF with 2 KB sizes, still it is not working.

Normally DVR has a software that can carve out jpgs, but the software cannot open recovered DAT files because they are recovered from format.

Here is a sample of the DAT file

https://drive.google.com/file/d/0B9eCrVhVnfoSckFIcDA2N3lmMkk/view?usp=sharing

Tried several forensic tools, but we cannot carve out data.

 
Posted : 25/02/2017 10:02 pm
MDCR
 MDCR
(@mdcr)
Posts: 376
Reputable Member
 

From what i know of the MJPEG format

MJPEG is a different format than JPEG. It encapsulates lots of functionality from the JPEG standard, it is meant to stream JPEG data so it really do not need any of the standard headers/footers that carvers usually would use since the encapsulating format takes care of these. You can say that MJPEG is basically MPEG with just I-frames.

Pretty sure that you have to create a new header/footer info for these files to get anything out.

Your best bet would be to try different players that can play the DAT file and then grab screenshots from that player either directly from the screenbuffer (scripted or manual), or converting the file to another more manageable format.

I googled it and there are many converter programs that support MJPEG as a source and can output to a multitude of video formats.

Recommend you try VLC player if you just want to take a few shows and save them.

 
Posted : 26/02/2017 6:16 am
(@terrific)
Posts: 6
Active Member
Topic starter
 

The DAT itself is a index file with MJPEG and cam channel information. So it is not playable. i also tried DEFRASER , but no luck.

 
Posted : 26/02/2017 6:57 am
Thomas
(@thomas)
Posts: 59
Trusted Member
 

I have downloaded your test .dat file, and have converted it succesfully to an .avi file with FX-viewer, which you can download from here http//www.cameraguard.net/Website/index.php?location=NetproPrograms
From there on it should be easy to extract the right jpg files D

 
Posted : 26/02/2017 4:37 pm
(@terrific)
Posts: 6
Active Member
Topic starter
 

Hello Thomas,

Thanks for your comment. We already tested with Fx viewer. it works for undeleted data, but we have recovered dat files (Which is not shared here) , these dat files are corrupted so we cannot open them with fx viewer. So if someone carve out original jpegs from this undeleted DAT , then we can try it on recovered DAT files.

 
Posted : 26/02/2017 11:50 pm
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

If you want I can create a custom data recovery file type XML to plug into R-Studio for you. I'd just need about 5 small sample files to cross reference, plus I might need remote access to look at the data of the drive in HEX for a few minutes. Let me know.

 
Posted : 27/02/2017 12:13 am
(@terrific)
Posts: 6
Active Member
Topic starter
 

Hi Jared,

Sent you a skype message.

 
Posted : 27/02/2017 12:35 am
(@bntrotter)
Posts: 63
Trusted Member
 

DME Forensics - DVR Examiner

 
Posted : 28/02/2017 12:42 am
Share: