Dahua DVR forensic analysis
Hi all, I have to extract videos from dahua DVR HDDs.
We cloned the HDDs to E01 images using the forensics falcon because we weren't allowed to take the originals hard drives or the complete DVR.
I saw on the download section of the dahua website there is a "HDD download tool" that let me extract the videos from the original HDD.
So using dd I wrote the disk image (I converted it to a raw image before with ftk imager) to a new hard drive.
The tool however is not detecting the HDD.
Dahua uses its DHFS filesystem that is not recognized by ftk imager, r-studio and other tools.
DVRExaminer is too expensive. Our other idea was to buy the same DVR and put cloned HDDs in there and extract the videos, but I'm not even sure this will work.
What do you suggest me to do?
Your technical problem of Vedio extraction issue can be solved by professional video extraction tools in the market. Salvationdata can solve this issue. http//www.salvationdata.com/products/3/ There product info. Do you know any other brand can deal with video extracting directly from the video surveillance .
What are you mounting it with at the moment?
I have found arsenal image mounter has helped me a lot in cases where the end software does not detect the drive.
We had this kind of task in the past, exactly the same problem, the filesystem used by Dahua was not recognized by other software. You should check the header of the image and see what filesystem it is. We did successful recovery before on WFS4.0 and H.264 video codec format using scalpel and custom scripts. If you need more details, please contact me in pm or drop a mail.
We discovered only one commercial software dealing with Dahua DHFS and different Wonderland File System versions, but it got high price, that is why we ended up scripting
HX-Recovery for DVR USD 680 (http//www.hxdvr.com/buy.html)
DVR Examiner didn't work either in our case and because of the LE contractor's policy and the videos content we couldn't use external inlab services either, like SalvationData and others.
you have original dahua tool for extracting footage by date, time and camera.
link for toolhttp//support.vidimost.com/comment.php?dlid=142&ENGINEsessID=199c19949d49af6cbb245f883b283b4f
press download button
file is DiskManager_Eng_IS_V1.09.T.110926
you must have hdd on sata port with footage, hdd is vissible in win like raw, but tool can parse it.