±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36434
New Yesterday: 2 Visitors: 144

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

HIKVision CCTV DVR Recovery

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

renfantino
Newbie
 

HIKVision CCTV DVR Recovery

Post Posted: Dec 14, 16 01:28

I need help extracting data from a Swann CCTV (Model: srdvr-84500t) DVR system. Per the Investigator the owner reformatted the drive after the incident in an attempt to erase the footage. I have imaged the 2TB drive and it appears to be an HIKVision file system.

I used DVR Examiner but it does not recover any deleted videos. Any suggestions on what I could use to recover the deleted videos? I primarily work with mobile devices so this fairly new to me. I have attempted to use TestDisk but I'm not sure which partition option to select since I know none of them fit. I know there is HX-Recovery available but don't want to spend the $680 to get the full version.

Does anyone have experience with HIKVision systems? Any suggestions on how to carve the deleted video files?  
 
  

JaredDM
Senior Member
 

Re: HIKVision CCTV DVR Recovery

Post Posted: Dec 14, 16 04:42

Our DVR guy could probably handle it. He has his own custom software he's written and can even modify it for specific cases. But, you'd probably be looking at around $600 for the recovery.

How good is your internet connection? Feel like uploading the image for him to take a peek?
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 
 
  

jaclaz
Senior Member
 

Re: HIKVision CCTV DVR Recovery

Post Posted: Dec 14, 16 18:43

- renfantino
I have attempted to use TestDisk but I'm not sure which partition option to select since I know none of them fit. I know there is HX-Recovery available but don't want to spend the $680 to get the full version.

I don't think that TESTDISK could be anyway of use, AFAICU those things use not even any "normal" filesystem, see:
www.shs-conferences.or..._02010.pdf
(the actual article is BTW - IMNSHO - pointless and worthless, besides being written in a terrible English, but at least it evidences the "general idea" behind those).

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

passcodeunlock
Senior Member
 

Re: HIKVision CCTV DVR Recovery

Post Posted: Dec 14, 16 22:13

I did successful recoveries of this, manual work with hex editor and some scripting.

I don't want to advertise here the service or the price of it, I sent you a PM with details.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

renfantino
Newbie
 

Re: HIKVision CCTV DVR Recovery

Post Posted: Dec 15, 16 04:30

Thank you all for your suggestions. I have been able to extract videos using FFmpeg but have ran into another issue. The image was already divided into smaller parts so I selected a few of the parts for FFmpeg. For each part FFmpeg creates one video file and it contains random video clips from different days and camera channels. Is there anyway to automatically clips these videos into the correct segments?  
 
  

aditya5
Member
 

Re: HIKVision CCTV DVR Recovery

Post Posted: Dec 15, 16 08:49

Please check your PM.  
 
  

passcodeunlock
Senior Member
 

Re: HIKVision CCTV DVR Recovery

Post Posted: Dec 15, 16 13:30

- renfantino
Thank you all for your suggestions. I have been able to extract videos using FFmpeg but have ran into another issue. The image was already divided into smaller parts so I selected a few of the parts for FFmpeg. For each part FFmpeg creates one video file and it contains random video clips from different days and camera channels. Is there anyway to automatically clips these videos into the correct segments?


This is why I wrote that some scripting would be also needed, but I presume you didn't read your PM.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 

Page 1 of 2
Page 1, 2  Next