±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 4 Overall: 34601
New Yesterday: 3 Visitors: 213

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

HikVision DVR

If you require the services of a computer forensics or data recovery firm please post details of your requirements here. Other members will then be able to contact you with a quote for their services [NOTE: Forensic Focus assumes no liability whatsoever for the results of services provided].
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3 
  

Re: HikVision DVR

Post Posted: Sat Apr 28, 2018 1:07 am

The overwriting process isn't linear considering the timeline, there are big chances that the needed data or parts of it are still available!

@JaredDM: nobody can recover overwritten data, but since here we talk about video content data, if overwriting wasn't 100%, there are chances to recover dirty frames, still having parts of the original data
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 

passcodeunlock
Senior Member
 
 
  

Re: HikVision DVR

Post Posted: Sat Apr 28, 2018 5:28 am

- passcodeunlock
The overwriting process isn't linear considering the timeline, there are big chances that the needed data or parts of it are still available!

@JaredDM: nobody can recover overwritten data, but since here we talk about video content data, if overwriting wasn't 100%, there are chances to recover dirty frames, still having parts of the original data


Define "dirty frame", please.

It is pretty much binary, at disk level a given sector has either been overwritten or it hasn't.

Assuming, only because of the time passed and on the features of the unknown and undocumented overwriting mechanism that something has been overwritten is as arbitrary as assuming that it has not.

As a matter of fact, if the presented data is correct:
Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.


Everything is possible. Shocked

We don't know WHEN the 10 days overwriting loop starts, nor how much data 10 days of recording use of the disk space, we don't even know if the recording was "motion controlled" or "continuous" and - in the case of the latter - how much compression is affected (or not affected) by a "static" scene.

Let's say that the 10 days was set because - roughly - 10 days of recording equates maximum to 1.5 TB (or 3/4 of the drive capacity), i.e. for each day there is at most 150 GB recorded, while an eventless day is more like 100 GB.

On days 1-10 the first 1.5 Tb or less are written.

What happens on day 11-20?

1) the recorder continues linearly to record past the 1.5Tb until it gets to 2 Tb, then wraps around.
2) the recorder re-starts from sector 0 (the last 500 GB of the drive are NEVER written)
3) the recorder re-starts from a *random* sector.

if #1 on day 15 (i.e. 18/04 if day 1 is 04/04) anything between 0 and 500 GB from previous recordings may have been NOT overwritten
if #2 the data is overwritten and lost
if #3 who knows?

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: HikVision DVR

Post Posted: Mon Apr 30, 2018 4:03 pm

I ran the HikV Recovery demo software. The demo provided a text file with a long list of dates and times including the following from the time period I am looking for:

2018-04-04 11-01-23 - 11-12-35.264
2018-04-04 11-12-35 - 12-08-32.264
2018-04-04 11-15-56 - 11-27-45.264
2018-04-04 11-20-40 - 11-47-50.264
2018-04-04 11-21-53 - 12-09-42.264
2018-04-04 11-27-45 - 11-28-26.264
2018-04-04 11-28-18 - 11-48-26.264
2018-04-04 11-28-26 - 11-36-29.264
2018-04-04 11-36-29 - 12-23-05.264
2018-04-04 11-47-50 - 12-55-00.264
2018-04-04 11-48-26 - 12-35-27.264
2018-04-04 12-08-32 - 12-11-13.264
2018-04-04 12-09-42 - 12-29-02.264
2018-04-04 12-11-13 - 12-23-15.264
2018-04-04 12-23-05 - 13-30-14.264
2018-04-04 12-23-15 - 12-49-12.264

I presume these are the video clips that are recoverable? Can anyone verify that this software works to extract the clips? If so, well worth the cost but trying to do my due diligence before spending $1000 of my bosses money.  

ares99
Newbie
 
 
  

Re: HikVision DVR

Post Posted: Tue May 01, 2018 10:49 am

@ares99: Pretty big money for unsure results...

@jaclaz: your theory is right, in practice for this Hikvision recorder your assumed #3 applies (if #3 who knows?)
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 

passcodeunlock
Senior Member
 
 
  

Re: HikVision DVR

Post Posted: Fri Jul 27, 2018 3:38 pm

I recently had a DVR recovery case infront of me and after a lot of trying using all different tools and softwares I failed, only to find out the files had been corrupted.

I did more research and stumbled across this software which saved the case and the innocent people were saved.

check this out, best thing about it is that you can test it to see if you can recover the files, when you recover it, email the owner and tell him you see some files, he will then send you a temporary reg key so you can see if you can view the files or not, if it works, you can go ahead and purchase the tool to your requirement, this really helped me and I hope it can help you.

hxdvr.com/
_________________
Digital Forensics is an Exact science, not the procedures, but the results. 

Vesalius
Senior Member
 
 

Page 3 of 3
Go to page Previous  1, 2, 3