CCTV Hard Drives / ...
 
Notifications
Clear all

CCTV Hard Drives / "Surveillance" Drives

18 Posts
8 Users
0 Likes
1,633 Views
(@rich2005)
Posts: 535
Honorable Member
Topic starter
 

Afternoon all,
I've recently had to look at a couple of drives from CCTV systems and both times had issues.
In one instance the drive couldn't be read and sounded audibly weak when using standard SATA power connectors, whether via writeblocker or directly to the machine, however I was able to get an image powering via the CCTV system's internal power connector, and then data cable to my machine.
I've now just had another drive which I don't know the provenance of, but again is sounding slightly audibly weak/unhealthy, and no option to power via the original system to get an image or review/export.

So my question is…..is this common for CCTV hard drives to have some kind of hardware/firmware difference/setting which means they're not easily read like a normal hard drive.

These two have had standard SATA connectors and don't APPEAR to be anything special on the face of it.

Anyone with any/lots of experience with these got an idea/opinion? Even if it's just to confirm I'm unlucky and it's unusual. Or that it's common and they have some sort of difference.

Many thanks in advance for any advice.
Rich

 
Posted : 17/07/2018 3:41 pm
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

No, there's no power or interface differences at all with CCTV drives compared to standard drives. In fact, many models (such as WD Purple) have the same internal architecture and PCB as other budget consumer drives (such as WD Blue).

Typically they are just drives with only one platter and only one or two read/write heads (for power savings and less chance of head failure due to constant writing). Plus they've disabled all features that might incline the drive to go to spin down.

They connect to a computer exactly the same as any other drive. Though they won't usually contain a standard file system (I hope you know that).

I'd guess your issue might just be a weak power supply for your adapter or a lost 12V connection. Many USB docks and adapters are sold with a power supply that is too weak for many drives. Even though the adapter may say 2A, it's not really putting out that much.

The only other thing you might be facing is if the drives are set to PUIS (power up in standby mode) or have an ATA lock set. Certain DVRs do do that for "security reasons". If that's the case, you might need someone with a tool like PC-3000 to override and disable the feature. Depending on the model, it may be possible to accomplish using some Linux Kung-Fu, but that all depends on the specific case.

 
Posted : 17/07/2018 5:29 pm
(@armresl)
Posts: 1011
Noble Member
 

Take this with a grain of salt, but each cctv is different.
I've found that if you can get a copy of the online .pdf file navigating the onboard system is easy for extraction purposes and you will also maintain the file integrity.

A lot of times you can just hook up a SATA or USB drive and pull everything you want without pulling the drive.

Afternoon all,
I've recently had to look at a couple of drives from CCTV systems and both times had issues.
In one instance the drive couldn't be read and sounded audibly weak when using standard SATA power connectors, whether via writeblocker or directly to the machine, however I was able to get an image powering via the CCTV system's internal power connector, and then data cable to my machine.
I've now just had another drive which I don't know the provenance of, but again is sounding slightly audibly weak/unhealthy, and no option to power via the original system to get an image or review/export.

So my question is…..is this common for CCTV hard drives to have some kind of hardware/firmware difference/setting which means they're not easily read like a normal hard drive.

These two have had standard SATA connectors and don't APPEAR to be anything special on the face of it.

Anyone with any/lots of experience with these got an idea/opinion? Even if it's just to confirm I'm unlucky and it's unusual. Or that it's common and they have some sort of difference.

Many thanks in advance for any advice.
Rich

 
Posted : 17/07/2018 5:36 pm
kastajamah
(@kastajamah)
Posts: 109
Estimable Member
 

I have had success with cloning the DVR's drive using Forensic Falcon or Tableau TD3 and TD2, and then putting in the clone drive into the DVR. That way I do not work with the original. I have only done this with DVR's I brought into the lab.

If I am on scene, I use the DVR's built in backup tools. I make sure and download the original video format. You need to confirm that it downloads a player, or you might have to reach out to the manufacturer and not all of them have tech support. I then will use the player to convert to AVI/WMV/MPG if that is an option. There can be some loss of quality and ratio when exporting as an AVI/WMV/MPG, and a defense attorney worth his/her salt would argue that with you on the stand.

 
Posted : 17/07/2018 7:16 pm
(@rich2005)
Posts: 535
Honorable Member
Topic starter
 

Thanks for the replies guys.
Unfortunately I'd already considered (and tried) all of what you describe (where applicable) so my question relates to the drives inside the machine.
So far 2 out of 2 from different systems have not wanted to play ball and power up properly, and sound audibly lethargic, whether via a tableau or directly in the machine using a linux forensics live cd. The first one was only able to be powered when powered from the system board of the original system (and was then imaged fine).
Second one I don't have the original system to see if the same applies (different case).
So I was just curious as to whether this is an unlikely anomaly or there's something specific that crops up with hard drives in CCTV systems (some sort of adapted power configuration that's not letting them be imaged via standard SATA power connectors).

 
Posted : 17/07/2018 7:24 pm
JaredDM
(@jareddm)
Posts: 118
Estimable Member
 

Well, power wise, CCTV drives are exactly the same as any other drive. Perhaps there is more to this story. Was the DVR actually working when the drive was removed? Was it perhaps sabotaged by the thief? I've seen several where a thief had banged the DVR around hard enough to destroy the drive inside.

Do you hear clicking sounds coming from the drive? You say it sounds lethargic….care to expound on what that means?

 
Posted : 17/07/2018 8:11 pm
(@rich2005)
Posts: 535
Honorable Member
Topic starter
 

Well, power wise, CCTV drives are exactly the same as any other drive. Perhaps there is more to this story. Was the DVR actually working when the drive was removed? Was it perhaps sabotaged by the thief? I've seen several where a thief had banged the DVR around hard enough to destroy the drive inside.

Do you hear clicking sounds coming from the drive? You say it sounds lethargic….care to expound on what that means?

Without going into case specifics it's not one where there's much doubt about it being deliberately damaged (of course dropped in transit is a consideration - however - as in the case of the first drive - it did actually image correctly once connected via the system's own sata power connector rather than various attempts on different kit in the lab). That was a last-resort attempt and was surprised it worked.

I'm not sure I can describe the sound on either better than lethargic, the first job was a little while ago so recall isn't perfect, but the current one, as I say, has been making no sound particularly bad that would indicate slightly more common hard drive faults, just sounds as if it's underpowered rather than nasty scratching, clicking, or motor problem sounds. Underpowed not being a logical explanation when it's being supplied by a variety of standard SATA power sources.

It's one that's baffled me logically. As I assumed the drives are standard, and don't appear to be hardware faults (as the first one imaged fine once using the system's SATA power source), yet neither imaged using standard kit!

 
Posted : 17/07/2018 8:29 pm
(@jakubr)
Posts: 8
Active Member
 

Some DVRs use hard drives which looks like a normal drive (WD Purple for example) but have modified HDD firmaware to work only with dedicated hardware. I saw few of them in DVRs. I dont know, your drive is this kind of HDD but it may be option. Sometimes you have to send special "secret" commands by SATA port to start this drive and later use standard ATA commands to work with data area. Your PC or Hardware Imager start to do they job with standard ATA commands but they will never work without proper "authorisation" to drive firmware.

But maybe solution is simpler ? Maybe your drive is just damaged ?

 
Posted : 17/07/2018 8:37 pm
(@rich2005)
Posts: 535
Honorable Member
Topic starter
 

Some DVRs use hard drives which looks like a normal drive (WD Purple for example) but have modified HDD firmaware to work only with dedicated hardware. I saw few of them in DVRs. I dont know, your drive is this kind of HDD but it may be option. Sometimes you have to send special "secret" commands by SATA port to start this drive and later use standard ATA commands to work with data area. Your PC or Hardware Imager start to do they job with standard ATA commands but they will never work without proper "authorisation" to drive firmware.

But maybe solution is simpler ? Maybe your drive is just damaged ?

I was about to say this sounds like the sort of thing…..but then realised, going back to the fact I could power it and image it via the original system's board and power connector, suggests it might not be be that!
It's definitely a puzzling one )

 
Posted : 17/07/2018 9:33 pm
(@jcoller)
Posts: 1
New Member
 

Although some CCTV hard drives can be based on a standardized Operating system, many are not. In law enforcement there is an entire subset of digital forensics dedicated to Video Evidence from sources like this. A good resource for training in this area is LEVA International. A great program for reading and extracting data from proprietary DVR drives is DVR Examiner by DME Forensics. They even offer a free trial of their software to verify it can access and read the data on your drive before you buy.

 
Posted : 31/07/2018 12:33 pm
Page 1 / 2
Share: