Forensic Video Data...
 
Notifications
Clear all

Forensic Video Data Recovery Tools for CCTV DVRS

23 Posts
15 Users
0 Likes
8,399 Views
(@Anonymous)
Posts: 0
Guest
Topic starter
 

Hi

Now we are facing problems in recovering deleted forensic video from CCTV DVRs. Do you know how could we do this and is there any software could be helpful?

 
Posted : 01/08/2016 2:35 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

What is the hex header first 512 bytes of the hard drive of the DVR ? There are many different file systems used by CCTV vendors, the header info is trivial for finding ways for recovery.

Warnings!

- before anything else, create a sector-by-sector copy of the original hard disk, never use the original hard disk for analysis

- attach the work copy only to write protected USB ports of a computer

 
Posted : 01/08/2016 2:50 pm
(@sgreene2991)
Posts: 77
Trusted Member
 

Try DVR Examiner from DME Forensics. I've used it for several cases and found it to be not only user friendly but performs a thorough examination of the device.

 
Posted : 01/08/2016 9:43 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

Try DVR Examiner from DME Forensics. I've used it for several cases and found it to be not only user friendly but performs a thorough examination of the device.

DVR Examiner is my the best tool for CCTV forensics.

 
Posted : 02/08/2016 1:33 am
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

For WFS and Dahua file systems, which are very common for CCTV recorders, DVR Examiner couldn't do much. Also, if the H.264 codec is used for compression, DVR Examiner can't handle it well either.

DVR Examiner could be good, if the file system is known, or if the user knows what signatures is looking for.

In other cases, the good old hex examination can give hints of what is needed, then scalpel or maybe some scripting could be used to recover the data.

 
Posted : 02/08/2016 12:49 pm
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

I just recently had a look at some CCTV drives from a HIKVision unit, but have examined quite a few over the years in LE and since I've left.

I've had some good success using Xways to simply carve video files out and then often the manufacturer has a video viewing software which you can use to view them.

Where you don't need to carve video files I've also had good success simply mounting the disk image then installing the CCTV software on my analysis machine and pointing it to the mounted image.

There is a lot of trial an error involved depending on the system and what you are trying to achieve.

 
Posted : 03/08/2016 6:24 am
(@Anonymous)
Posts: 0
Guest
Topic starter
 

Take a look at TestDisk, a free and powerful data recovery program.

 
Posted : 01/09/2016 1:18 pm
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

Take a look at TestDisk, a free and powerful data recovery program.

Indeed, TestDisk is good, in certain situations, but for WFS, Dahua, Hikvision or other branded filesystems it is useless. That is why I suggested before to get the header of the disk, so the OP poster would at least know what he is against )

 
Posted : 04/09/2016 4:53 pm
NeGrusti
(@negrusti)
Posts: 18
Active Member
 

There are specialized software that allows you to scan the HDD/image and display all the found video fragments with their timestamp and channel information. You can select the time range you need and export it as a single file per channel, in chronological order. Works with HikVision, Dahua and some others.

 
Posted : 29/12/2016 11:13 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

There are specialized software that allows you to scan the HDD/image and display all the found video fragments with their timestamp and channel information. You can select the time range you need and export it as a single file per channel, in chronological order. Works with HikVision, Dahua and some others.

…and are you going to list some of them "specialized software" or this is just a generic note? ?

jaclaz

 
Posted : 30/12/2016 12:22 am
Page 1 / 3
Share: