Notifications
Clear all

HikVision DVR

19 Posts
9 Users
0 Likes
6,973 Views
(@ares99)
Posts: 5
Active Member
Topic starter
 

I need to recover data from a Hik Vision DVR (Model DS-7216HGHI-SH).

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

What is the possibility of getting any usable video from the HD from that time frame? We have run a trial copy of DVR Examiner on it. It only shows 5 clips but they say they are 00 minutes long and we can’t see what they are or which camera they are from. The local forensic tech we used to copy the drive said he would not have any ability to go beyond what DVR examiner shows. The drive is 2 TB in size.

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.

According to DVR Examiner, the rest of the info is

Filesystem Name HIK_264
Filesystem Version 2018.01.22
DVR Examiner Version 2.2.0
Database Version 3/20/2018

Type SegmentedRaw
Bytes Per Sector 512
Sector Count 3907029168
Total Size 1863 GB

 
Posted : 26/04/2018 3:20 pm
 sxtt
(@sxtt)
Posts: 3
New Member
 

Hi,

It depends on the configuration of the HiKVision unit i.e are the cameras only recording when movement is on. Majority of the time there is free space so you would find overwriting hasn't taken place. I've had it go back up to 90 days

Is the unit one or two drives?

 
Posted : 26/04/2018 3:34 pm
(@ares99)
Posts: 5
Active Member
Topic starter
 

It is one drive. It appeared when we looked at it before copying the hard drive that it was recording all the time. There were 5 cameras.

 
Posted : 26/04/2018 4:07 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.

Let me guess … 😯

… you are using BitDefender … roll

1/67 on VirusTotal !

https://www.virustotal.com/#/url/028fb767568d80c586ec2de40c66d557c94dd23e458d99eba7ac9c4cf0a5f05b/detection

jaclaz

 
Posted : 26/04/2018 4:16 pm
(@ares99)
Posts: 5
Active Member
Topic starter
 

No, actually it was both Norton (home) and Vipre (work). I can download the file from the site fine but when I try to unzip it is when its gets blocked.

 
Posted : 26/04/2018 4:35 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

No, actually it was both Norton (home) and Vipre (work). I can download the file from the site fine but when I try to unzip it is when its gets blocked.

This is "queer" 😯 Antivirus programs do decompress archives checking their contents, so there should be no difference between downloading it and only decompressing/expanding it after download (the moment the actual installer or howerver .exe is executed may of course change the situation).

In any case you should be able to make an exception for the file, decompress the contents, then re-analyze the expanded contents.

All I can tell you (but you shouldn't trust advice from a stranger on the internet) is that the decompressed contents are fine here in ClamWin

Scan Started Thu Apr 26 184218 2018
——————————————————————————-

———– SCAN SUMMARY ———–
Known viruses 6482700
Engine version 0.99.4
Scanned directories 1
Scanned files 10
Infected files 0

Data scanned 27.88 MB
Data read 26.70 MB (ratio 1.041)
Time 30.062 sec (0 m 30 s)

————————————–
Completed

and that the same contents on VirusTotal are again 1/67 ot 1/68 flagged by "CrowdStrikeFalcon" (WHO?) and nor by BitDefender

jaclaz

 
Posted : 26/04/2018 4:44 pm
(@ares99)
Posts: 5
Active Member
Topic starter
 

Thanks for the info. Do you think I will be able to get more from HX Recovery than what DVR Examiner found?

 
Posted : 26/04/2018 5:01 pm
(@tacobreath)
Posts: 14
Active Member
 

I have limited experience with recovering video from DVRs. That said, when I used both DVR Examiner (trial) and HX Recovery for one case, only DVR Examiner was able to recognize the file system and show me the video files ready for examination.

If you can afford DVR Examiner, it appears to be money well-spent. The founder of the company that makes DVR Examiner, Jimmy Schroering, is active on the IACIS listserv. He's always willing to answer questions you may have about the product or even DVR forensics in general.

 
Posted : 26/04/2018 5:32 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Thanks for the info. Do you think I will be able to get more from HX Recovery than what DVR Examiner found?

Hard to say, in at least another occasion it worked fine where DVR Examiner failed
https://www.forensicfocus.com/Forums/viewtopic/t=16393/

but as you most probably well know each software may work exceptionally well in one case and do nothing of use on another one.

jaclaz

 
Posted : 26/04/2018 5:42 pm
(@soft512byte)
Posts: 16
Active Member
 

Write to your personal mail. We wrote the software, you can check what dates you can reсovery.

 
Posted : 26/04/2018 5:44 pm
Page 1 / 2
Share: