Forensic Video Data...
 
Notifications
Clear all

Forensic Video Data Recovery Tools for CCTV DVRS

Page 1 / 2
 Anonymous

Hi

Now we are facing problems in recovering deleted forensic video from CCTV DVRs. Do you know how could we do this and is there any software could be helpful?

Quote
Topic starter Posted : 01/08/2016 3:35 pm
passcodeunlock
(@passcodeunlock)
Senior Member

What is the hex header first 512 bytes of the hard drive of the DVR ? There are many different file systems used by CCTV vendors, the header info is trivial for finding ways for recovery.

Warnings!

- before anything else, create a sector-by-sector copy of the original hard disk, never use the original hard disk for analysis

- attach the work copy only to write protected USB ports of a computer

ReplyQuote
Posted : 01/08/2016 3:50 pm
sgreene2991
(@sgreene2991)
Member

Try DVR Examiner from DME Forensics. I've used it for several cases and found it to be not only user friendly but performs a thorough examination of the device.

ReplyQuote
Posted : 01/08/2016 10:43 pm
Igor_Michailov
(@igor_michailov)
Senior Member

Try DVR Examiner from DME Forensics. I've used it for several cases and found it to be not only user friendly but performs a thorough examination of the device.

DVR Examiner is my the best tool for CCTV forensics.

ReplyQuote
Posted : 02/08/2016 2:33 am
passcodeunlock
(@passcodeunlock)
Senior Member

For WFS and Dahua file systems, which are very common for CCTV recorders, DVR Examiner couldn't do much. Also, if the H.264 codec is used for compression, DVR Examiner can't handle it well either.

DVR Examiner could be good, if the file system is known, or if the user knows what signatures is looking for.

In other cases, the good old hex examination can give hints of what is needed, then scalpel or maybe some scripting could be used to recover the data.

ReplyQuote
Posted : 02/08/2016 1:49 pm
Adam10541
(@adam10541)
Senior Member

I just recently had a look at some CCTV drives from a HIKVision unit, but have examined quite a few over the years in LE and since I've left.

I've had some good success using Xways to simply carve video files out and then often the manufacturer has a video viewing software which you can use to view them.

Where you don't need to carve video files I've also had good success simply mounting the disk image then installing the CCTV software on my analysis machine and pointing it to the mounted image.

There is a lot of trial an error involved depending on the system and what you are trying to achieve.

ReplyQuote
Posted : 03/08/2016 7:24 am
 Anonymous

Take a look at TestDisk, a free and powerful data recovery program.

ReplyQuote
Topic starter Posted : 01/09/2016 2:18 pm
passcodeunlock
(@passcodeunlock)
Senior Member

Take a look at TestDisk, a free and powerful data recovery program.

Indeed, TestDisk is good, in certain situations, but for WFS, Dahua, Hikvision or other branded filesystems it is useless. That is why I suggested before to get the header of the disk, so the OP poster would at least know what he is against )

ReplyQuote
Posted : 04/09/2016 5:53 pm
NeGrusti
(@negrusti)
New Member

There are specialized software that allows you to scan the HDD/image and display all the found video fragments with their timestamp and channel information. You can select the time range you need and export it as a single file per channel, in chronological order. Works with HikVision, Dahua and some others.

ReplyQuote
Posted : 29/12/2016 11:13 pm
jaclaz
(@jaclaz)
Community Legend

There are specialized software that allows you to scan the HDD/image and display all the found video fragments with their timestamp and channel information. You can select the time range you need and export it as a single file per channel, in chronological order. Works with HikVision, Dahua and some others.

…and are you going to list some of them "specialized software" or this is just a generic note? ?

jaclaz

ReplyQuote
Posted : 30/12/2016 12:22 am
NeGrusti
(@negrusti)
New Member

Unfortunately I cannot do that as there is strictly no-advertisement policy…

ReplyQuote
Posted : 30/12/2016 12:50 am
jaclaz
(@jaclaz)
Community Legend

Unfortunately I cannot do that as there is strictly no-advertisement policy, but we can continue via pm if you like.

Thanks ) , but no, thanks.

The idea of a public forum should be that it is public, IMHO.

The no-advertisement policy seems like a strange one, since you can vaguely mention *something* and publicly offer yourself to provide info on it via PM.

It seems to me a form of advertisement as well, only a very selective one.

Thank you anyway.

jaclaz

ReplyQuote
Posted : 30/12/2016 4:51 pm
Jamie
(@jamie)
Community Legend

Perhaps I can clarify at this point - it is certainly not permissible to start a forum topic with the intention of advertising a product, service etc. or to enter an off-topic promotional post into an existing discussion. However, if a recommendation is clearly relevant and sought during an ongoing discussion it is perfectly acceptable to provide such a recommendation publicly as long as any commercial relationship is disclosed (e.g. by stating that you are the developer or a vendor etc.)

In short, don't spam but don't be afraid to recommend something you're associated with if you think it's genuinely likely to be useful and you're up front about who you are.

Cheers,

Jamie

ReplyQuote
Posted : 30/12/2016 6:45 pm
jaclaz
(@jaclaz)
Community Legend

However, if a recommendation is clearly relevant and sought during an ongoing discussion it is perfectly acceptable to provide such a recommendation publicly as long as any commercial relationship is disclosed (e.g. by stating that you are the developer or a vendor etc.)

Yes ).
I would add that a specific recommendation/mention of a given software by an expert user of the software is particularly precious as it represents a report of real life experience, IMHO much more valuable than the often vague advertisement fluff.

jaclaz

ReplyQuote
Posted : 30/12/2016 7:20 pm
passcodeunlock
(@passcodeunlock)
Senior Member

HX-Recovery is made exactly for this, but it is not cheap. We do way cheaper recoveries, if somebody needs it, feel free to pm me.

ReplyQuote
Posted : 30/12/2016 11:29 pm
Page 1 / 2
Share: