Hello Gents,
We have a old netpromax DVR, which uses DAT files for 5 minutes of intervals. We made a recovery and we are trying to carve out JPEGS from the DAT files.
I tried several tools, but none of them are successful.
Because normal jpegs are starting with FF D8 FF E1 or FF D8 FF E0 and ends with FF D9.
But in my case, JPGs are starting only with FF D8 FF and there are no FF D9
as far as i know enhanced mjpeg files are between 2 to 7 KB , i also tried to use simple carver to carve out jpgs satarting with FF D8 FF with 2 KB sizes, still it is not working.
Normally DVR has a software that can carve out jpgs, but the software cannot open recovered DAT files because they are recovered from format.
Here is a sample of the DAT file
https://
Tried several forensic tools, but we cannot carve out data.
From what i know of the MJPEG format
MJPEG is a different format than JPEG. It encapsulates lots of functionality from the JPEG standard, it is meant to stream JPEG data so it really do not need any of the standard headers/footers that carvers usually would use since the encapsulating format takes care of these. You can say that MJPEG is basically MPEG with just I-frames.
Pretty sure that you have to create a new header/footer info for these files to get anything out.
Your best bet would be to try different players that can play the DAT file and then grab screenshots from that player either directly from the screenbuffer (scripted or manual), or converting the file to another more manageable format.
I googled it and there are many converter programs that support MJPEG as a source and can output to a multitude of video formats.
Recommend you try VLC player if you just want to take a few shows and save them.
The DAT itself is a index file with MJPEG and cam channel information. So it is not playable. i also tried DEFRASER , but no luck.
I have downloaded your test .dat file, and have converted it succesfully to an .avi file with FX-viewer, which you can download from here http//
From there on it should be easy to extract the right jpg files D
Hello Thomas,
Thanks for your comment. We already tested with Fx viewer. it works for undeleted data, but we have recovered dat files (Which is not shared here) , these dat files are corrupted so we cannot open them with fx viewer. So if someone carve out original jpegs from this undeleted DAT , then we can try it on recovered DAT files.
If you want I can create a custom data recovery file type XML to plug into R-Studio for you. I'd just need about 5 small sample files to cross reference, plus I might need remote access to look at the data of the drive in HEX for a few minutes. Let me know.
Hi Jared,
Sent you a skype message.
DME Forensics - DVR Examiner