±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35522
New Yesterday: 2 Visitors: 121

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

CCTV Hard Drives / "Surveillance" Drives

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

Rich2005
Senior Member
 

CCTV Hard Drives / "Surveillance" Drives

Post Posted: Jul 17, 18 15:41

Afternoon all,
I've recently had to look at a couple of drives from CCTV systems and both times had issues.
In one instance the drive couldn't be read and sounded audibly weak when using standard SATA power connectors, whether via writeblocker or directly to the machine, however I was able to get an image powering via the CCTV system's internal power connector, and then data cable to my machine.
I've now just had another drive which I don't know the provenance of, but again is sounding slightly audibly weak/unhealthy, and no option to power via the original system to get an image or review/export.

So my question is.....is this common for CCTV hard drives to have some kind of hardware/firmware difference/setting which means they're not easily read like a normal hard drive.

These two have had standard SATA connectors and don't APPEAR to be anything special on the face of it.

Anyone with any/lots of experience with these got an idea/opinion? Even if it's just to confirm I'm unlucky and it's unusual. Or that it's common and they have some sort of difference.

Many thanks in advance for any advice.
Rich  
 
  

JaredDM
Senior Member
 

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Jul 17, 18 17:29

No, there's no power or interface differences at all with CCTV drives compared to standard drives. In fact, many models (such as WD Purple) have the same internal architecture and PCB as other budget consumer drives (such as WD Blue).

Typically they are just drives with only one platter and only one or two read/write heads (for power savings and less chance of head failure due to constant writing). Plus they've disabled all features that might incline the drive to go to spin down.

They connect to a computer exactly the same as any other drive. Though they won't usually contain a standard file system (I hope you know that).

I'd guess your issue might just be a weak power supply for your adapter or a lost 12V connection. Many USB docks and adapters are sold with a power supply that is too weak for many drives. Even though the adapter may say 2A, it's not really putting out that much.

The only other thing you might be facing is if the drives are set to PUIS (power up in standby mode) or have an ATA lock set. Certain DVRs do do that for "security reasons". If that's the case, you might need someone with a tool like PC-3000 to override and disable the feature. Depending on the model, it may be possible to accomplish using some Linux Kung-Fu, but that all depends on the specific case.
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 
 
  

armresl
Senior Member
 

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Jul 17, 18 17:36

Take this with a grain of salt, but each cctv is different.
I've found that if you can get a copy of the online .pdf file navigating the onboard system is easy for extraction purposes and you will also maintain the file integrity.

A lot of times you can just hook up a SATA or USB drive and pull everything you want without pulling the drive.

- Rich2005
Afternoon all,
I've recently had to look at a couple of drives from CCTV systems and both times had issues.
In one instance the drive couldn't be read and sounded audibly weak when using standard SATA power connectors, whether via writeblocker or directly to the machine, however I was able to get an image powering via the CCTV system's internal power connector, and then data cable to my machine.
I've now just had another drive which I don't know the provenance of, but again is sounding slightly audibly weak/unhealthy, and no option to power via the original system to get an image or review/export.

So my question is.....is this common for CCTV hard drives to have some kind of hardware/firmware difference/setting which means they're not easily read like a normal hard drive.

These two have had standard SATA connectors and don't APPEAR to be anything special on the face of it.

Anyone with any/lots of experience with these got an idea/opinion? Even if it's just to confirm I'm unlucky and it's unusual. Or that it's common and they have some sort of difference.

Many thanks in advance for any advice.
Rich

_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 
 
  

kastajamah
Senior Member
 

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Jul 17, 18 19:16

I have had success with cloning the DVR's drive using Forensic Falcon or Tableau TD3 and TD2, and then putting in the clone drive into the DVR. That way I do not work with the original. I have only done this with DVR's I brought into the lab.

If I am on scene, I use the DVR's built in backup tools. I make sure and download the original video format. You need to confirm that it downloads a player, or you might have to reach out to the manufacturer and not all of them have tech support. I then will use the player to convert to AVI/WMV/MPG if that is an option. There can be some loss of quality and ratio when exporting as an AVI/WMV/MPG, and a defense attorney worth his/her salt would argue that with you on the stand.  
 
  

Rich2005
Senior Member
 

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Jul 17, 18 19:24

Thanks for the replies guys.
Unfortunately I'd already considered (and tried) all of what you describe (where applicable) so my question relates to the drives inside the machine.
So far 2 out of 2 from different systems have not wanted to play ball and power up properly, and sound audibly lethargic, whether via a tableau or directly in the machine using a linux forensics live cd. The first one was only able to be powered when powered from the system board of the original system (and was then imaged fine).
Second one I don't have the original system to see if the same applies (different case).
So I was just curious as to whether this is an unlikely anomaly or there's something specific that crops up with hard drives in CCTV systems (some sort of adapted power configuration that's not letting them be imaged via standard SATA power connectors).  
 
  

JaredDM
Senior Member
 

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Jul 17, 18 20:11

Well, power wise, CCTV drives are exactly the same as any other drive. Perhaps there is more to this story. Was the DVR actually working when the drive was removed? Was it perhaps sabotaged by the thief? I've seen several where a thief had banged the DVR around hard enough to destroy the drive inside.

Do you hear clicking sounds coming from the drive? You say it sounds lethargic....care to expound on what that means?
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 
 
  

Rich2005
Senior Member
 

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Jul 17, 18 20:29

- JaredDM
Well, power wise, CCTV drives are exactly the same as any other drive. Perhaps there is more to this story. Was the DVR actually working when the drive was removed? Was it perhaps sabotaged by the thief? I've seen several where a thief had banged the DVR around hard enough to destroy the drive inside.

Do you hear clicking sounds coming from the drive? You say it sounds lethargic....care to expound on what that means?


Without going into case specifics it's not one where there's much doubt about it being deliberately damaged (of course dropped in transit is a consideration - however - as in the case of the first drive - it did actually image correctly once connected via the system's own sata power connector rather than various attempts on different kit in the lab). That was a last-resort attempt and was surprised it worked.

I'm not sure I can describe the sound on either better than lethargic, the first job was a little while ago so recall isn't perfect, but the current one, as I say, has been making no sound particularly bad that would indicate slightly more common hard drive faults, just sounds as if it's underpowered rather than nasty scratching, clicking, or motor problem sounds. Underpowed not being a logical explanation when it's being supplied by a variety of standard SATA power sources.

It's one that's baffled me logically. As I assumed the drives are standard, and don't appear to be hardware faults (as the first one imaged fine once using the system's SATA power source), yet neither imaged using standard kit!  
 

Page 1 of 3
Page 1, 2, 3  Next