±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34287
New Yesterday: 6 Visitors: 247

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

HikVision DVR

If you require the services of a computer forensics or data recovery firm please post details of your requirements here. Other members will then be able to contact you with a quote for their services [NOTE: Forensic Focus assumes no liability whatsoever for the results of services provided].
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

HikVision DVR

Post Posted: Thu Apr 26, 2018 9:20 am

I need to recover data from a Hik Vision DVR (Model DS-7216HGHI-SH).

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

What is the possibility of getting any usable video from the HD from that time frame? We have run a trial copy of DVR Examiner on it. It only shows 5 clips but they say they are 00 minutes long and we can’t see what they are or which camera they are from. The local forensic tech we used to copy the drive said he would not have any ability to go beyond what DVR examiner shows. The drive is 2 TB in size.

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.

According to DVR Examiner, the rest of the info is:

Filesystem Name: HIK_264
Filesystem Version: 2018.01.22
DVR Examiner Version: 2.2.0
Database Version: 3/20/2018

Type: SegmentedRaw
Bytes Per Sector: 512
Sector Count: 3907029168
Total Size: 1863 GB  

ares99
Newbie
 
 
  

Re: HikVision DVR

Post Posted: Thu Apr 26, 2018 9:34 am

Hi,

It depends on the configuration of the HiKVision unit i.e are the cameras only recording when movement is on. Majority of the time there is free space so you would find overwriting hasn't taken place. I've had it go back up to 90 days

Is the unit one or two drives?  

sxtt
Newbie
 
 
  

Re: HikVision DVR

Post Posted: Thu Apr 26, 2018 10:07 am

It is one drive. It appeared when we looked at it before copying the hard drive that it was recording all the time. There were 5 cameras.  

ares99
Newbie
 
 
  

Re: HikVision DVR

Post Posted: Thu Apr 26, 2018 10:16 am

- ares99

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.


Let me guess ... Shocked

... you are using BitDefender ... Rolling Eyes

1/67 on VirusTotal Exclamation :

www.virustotal.com/#/u.../detection

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: HikVision DVR

Post Posted: Thu Apr 26, 2018 10:35 am

No, actually it was both Norton (home) and Vipre (work). I can download the file from the site fine but when I try to unzip it is when its gets blocked.  

ares99
Newbie
 
 
  

Re: HikVision DVR

Post Posted: Thu Apr 26, 2018 10:44 am

- ares99
No, actually it was both Norton (home) and Vipre (work). I can download the file from the site fine but when I try to unzip it is when its gets blocked.


This is "queer" Shocked Antivirus programs do decompress archives checking their contents, so there should be no difference between downloading it and only decompressing/expanding it after download (the moment the actual installer or howerver .exe is executed may of course change the situation).

In any case you should be able to make an exception for the file, decompress the contents, then re-analyze the expanded contents.

All I can tell you (but you shouldn't trust advice from a stranger on the internet) is that the decompressed contents are fine here in ClamWin:

Scan Started Thu Apr 26 18:42:18 2018
-------------------------------------------------------------------------------


----------- SCAN SUMMARY -----------
Known viruses: 6482700
Engine version: 0.99.4
Scanned directories: 1
Scanned files: 10
Infected files: 0

Data scanned: 27.88 MB
Data read: 26.70 MB (ratio 1.04:1)
Time: 30.062 sec (0 m 30 s)

--------------------------------------
Completed

and that the same contents on VirusTotal are again 1/67 ot 1/68 flagged by "CrowdStrikeFalcon" (WHO?) and nor by BitDefender

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: HikVision DVR

Post Posted: Thu Apr 26, 2018 11:01 am

Thanks for the info. Do you think I will be able to get more from HX Recovery than what DVR Examiner found?  

ares99
Newbie
 
 

Page 1 of 3
Go to page 1, 2, 3  Next