±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 34832
New Yesterday: 7 Visitors: 136

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

CCTV Hard Drives / "Surveillance" Drives

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3  Next 
  

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Tue Jul 17, 2018 2:37 pm

Some DVRs use hard drives which looks like a normal drive (WD Purple for example) but have modified HDD firmaware to work only with dedicated hardware. I saw few of them in DVRs. I dont know, your drive is this kind of HDD but it may be option. Sometimes you have to send special "secret" commands by SATA port to start this drive and later use standard ATA commands to work with data area. Your PC or Hardware Imager start to do they job with standard ATA commands but they will never work without proper "authorisation" to drive firmware.

But maybe solution is simpler ? Maybe your drive is just damaged ?  

JakubR
Newbie
 
 
  

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Tue Jul 17, 2018 3:33 pm

- JakubR
Some DVRs use hard drives which looks like a normal drive (WD Purple for example) but have modified HDD firmaware to work only with dedicated hardware. I saw few of them in DVRs. I dont know, your drive is this kind of HDD but it may be option. Sometimes you have to send special "secret" commands by SATA port to start this drive and later use standard ATA commands to work with data area. Your PC or Hardware Imager start to do they job with standard ATA commands but they will never work without proper "authorisation" to drive firmware.

But maybe solution is simpler ? Maybe your drive is just damaged ?


I was about to say this sounds like the sort of thing.....but then realised, going back to the fact I could power it and image it via the original system's board and power connector, suggests it might not be be that!
It's definitely a puzzling one Smile  

Rich2005
Senior Member
 
 
  

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Tue Jul 31, 2018 6:33 am

Although some CCTV hard drives can be based on a standardized Operating system, many are not. In law enforcement there is an entire subset of digital forensics dedicated to Video Evidence from sources like this. A good resource for training in this area is LEVA International. A great program for reading and extracting data from proprietary DVR drives is DVR Examiner by DME Forensics. They even offer a free trial of their software to verify it can access and read the data on your drive before you buy.  

jcoller
Newbie
 
 
  

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Tue Jul 31, 2018 6:39 am

- jcoller
Although some CCTV hard drives can be based on a standardized Operating system, many are not. In law enforcement there is an entire subset of digital forensics dedicated to Video Evidence from sources like this. A good resource for training in this area is LEVA International. A great program for reading and extracting data from proprietary DVR drives is DVR Examiner by DME Forensics. They even offer a free trial of their software to verify it can access and read the data on your drive before you buy.


I had tried DVR Examiner, the problem was though, that the drives wouldn't image/read (unless powered by the original system in the first instance), so was curious as to the reason why (if anyone had an idea).
So, whilst DVR Examiner is a useful tool for processing the unusual file-systems, and exporting data from them, that's not an option if the drive can't be read!
Still none the wiser, but I've worked round the problem(s) for now, but would always be interested to hear if someone has had similar experiences with CCTV drives.  

Rich2005
Senior Member
 
 
  

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Tue Jul 31, 2018 12:14 pm

Some CCTV systems use an ATA lock on the drives so they can't be read outside the DVR. They could also be using PUIS (power up in standby mode). There's a few reasons.

Depending on the drive model, there's sometimes free utilities to unlock it (for example WD usually has a generic master key for ATA lock). Other times, it requires tools like PC-3000 to override the function and get the drive working normally.

Either way, a reputable data recovery company should have no problem unlocking and imaging such drives.
_________________
Lead Data Recovery Tech at Data Medics® - www.data-medics.com 

JaredDM
Senior Member
 
 
  

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Tue Jul 31, 2018 12:37 pm

I would measure the voltage output of the computer's power supply with a regular drive connected and then the DVR drive connected. If there is a measurable difference, it might be simply a bad connection.

Used (old) power supplies aren't giving the power needed to spin up the drive if oxidation or other corrosion appear on the power pins.

...or just simply connect the DVR drive to another computer.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 

passcodeunlock
Senior Member
 
 
  

Re: CCTV Hard Drives / "Surveillance" Drives

Post Posted: Tue Jul 31, 2018 1:46 pm

- passcodeunlock
I would measure the voltage output of the computer's power supply with a regular drive connected and then the DVR drive connected. If there is a measurable difference, it might be simply a bad connection.

Used (old) power supplies aren't giving the power needed to spin up the drive if oxidation or other corrosion appear on the power pins.


You sure it would be a (measurable) voltage issue, and not a power (Amperes) one, as JaredDM previously mentioned?

For sure once upon a time external 2.5" external cases came often with a (needed) USB Y cable as taking the power from a single USB port (500 mA) was not enough for many (old) 2.5" drives.
Voltage was obvioulsy 5 Volts allright, but simplt not enough Amperes could be drawn to spin up and operate the drive.

And it happened to me more than once that a (old) power supply gave the right voltage but not enough "juice".


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 

Page 2 of 3
Go to page Previous  1, 2, 3  Next