Recover data from h...
 
Notifications
Clear all

Recover data from hdd/dvd recorder ?

15 Posts
10 Users
1 Likes
2,187 Views
ForensicRanger
(@forensicranger)
Posts: 122
Estimable Member
Topic starter
 

Folks,
Would anyone have insight as to how to view/recover the data on a dvd recorder's hdd? ..though windows initially sees the hdd, it can't mount due to the proprietary software used (in this instance, an LG).

Thanks!

 
Posted : 04/03/2010 6:45 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

What information were you able to get from the manufacturer?

 
Posted : 04/03/2010 6:52 pm
(@a_kuiper)
Posts: 69
Trusted Member
 

Many DVD-recorders just use mpeg2. Extracting it can be done in a few easy steps

- dump the contents of the HDD to an uncompressed file on your local HDD
- use a file-carving tool to carve out the segmented mpgs
- copy them to one big file, copy /b *.mpg result.mpg
- use avidemux for cutting (even the time-stamps should be fine)

 
Posted : 04/03/2010 9:20 pm
ForensicRanger
(@forensicranger)
Posts: 122
Estimable Member
Topic starter
 

key No reply yet from the Manufacturer

a_kui I hooked it up through a tableau bridge, Win detects the hdd - tells me it was ready to use, but the drive was not visible (explorer didn't show it, nor did win mgr)… any other thoughts?

 
Posted : 04/03/2010 9:42 pm
(@angrybadger)
Posts: 164
Estimable Member
 

a_kui I hooked it up through a tableau bridge, Win detects the hdd - tells me it was ready to use, but the drive was not visible (explorer didn't show it, nor did win mgr)… any other thoughts?

This just means that Windows doesnt recognise the file system.
have you looked at it withe Encase or better still Winhex?

 
Posted : 04/03/2010 10:07 pm
ForensicRanger
(@forensicranger)
Posts: 122
Estimable Member
Topic starter
 

hm indeed.. EnCase and FTK - no dice… have not tried Winhex.

 
Posted : 04/03/2010 10:12 pm
(@rich2005)
Posts: 535
Honorable Member
 

When you say it doesn't see it, what do you mean exactly?
Is it seeing data, but just not interpreting the filesystem?
If so what filesystem? One you can manually add in EnCase or other tool? Proprietary FS?

 
Posted : 04/03/2010 10:26 pm
ForensicRanger
(@forensicranger)
Posts: 122
Estimable Member
Topic starter
 

Windows recognizes the drive but does not assign it a drive letter; since I don't have a drive letter, I can't 'open' the drive..

 
Posted : 04/03/2010 10:36 pm
(@angrybadger)
Posts: 164
Estimable Member
 

Windows recognizes the drive but does not assign it a drive letter; since I don't have a drive letter, I can't 'open' the drive..

which means that Windows doesnt know what to do with the filesytem. i.e. its not FAT, FAT32 or NTFS.

What did encase say, did it give you (at the very least) a size for the drive?

If its something stupid (e.g. 0 blocks) then you can either give up or go for a DR, something has gone wrong with the firm/hardware.

Are any partitions defined or is it one big block of unallocated ?
If so look at it in hex mode, whats in block zero?

 
Posted : 04/03/2010 10:43 pm
(@a_kuiper)
Posts: 69
Trusted Member
 

@ForensiX In most cases you won't have any filesystem at all. That's why you should dump the whole contents to a file on your local system. Do this with windd, winhex, …

 
Posted : 04/03/2010 10:56 pm
IainWhite reacted
Page 1 / 2
Share: