Forensic Video Data...
 
Notifications
Clear all

Forensic Video Data Recovery Tools for CCTV DVRS

Page 2 / 2
NeGrusti
(@negrusti)
New Member

Jamie, many thanks for your clarification.
I am a developer of such software. It is not yet ready for public sales. At the moment we test it with the clients we already have the established relationships with. We can do one-off remote recoveries using it, and we will sell licenses in a near future.
i am attaching a screenshot showing HikVision recorder sample analysis.
Comparing to DVR Examiner, our software focuses on raw data recovery and is not using any allocation information or indexes that might be maliciously altered or destroyed.
I also believe that for newer HikVision recorders it might be the only software that extracts timestamps and channel information.

ReplyQuote
Posted : 31/12/2016 1:37 pm
JaredDM
(@jareddm)
Active Member

Jamie, many thanks for your clarification.
I am a developer of such software. It is not yet ready for public sales. At the moment we test it with the clients we already have the established relationships with. We can do one-off remote recoveries using it, and we will sell licenses in a near future.
i am attaching a screenshot showing HikVision recorder sample analysis.
Comparing to DVR Examiner, our software focuses on raw data recovery and is not using any allocation information or indexes that might be maliciously altered or destroyed.
I also believe that for newer HikVision recorders it might be the only software that extracts timestamps and channel information.

Hey, Gregory I didn't realize you were on this forum.

I can confirm that his software does indeed work well. I only wish he'd make it available for sale. D

ReplyQuote
Posted : 02/01/2017 8:07 pm
DiskTuna
(@disktuna)
New Member

You could try out JPEG Recovery LAB depending on the video format.

ReplyQuote
Posted : 07/04/2018 11:06 am
soft512byte
(@soft512byte)
New Member

I am a software developer for the DVR. I can answer questions within reason.

ReplyQuote
Posted : 07/04/2018 6:03 pm
fmpfeifer
(@fmpfeifer)
New Member

I know it is an old thread.. I had to extract footage from an DVR HD that was identified as Hikvision DVR, and was unable to find a tool to help me. So I wrote a script to extract footage from Hikvision DVR HD. Maybe it can be useful for someone:

https://github.com/fmpfeifer/hikextractor

ReplyQuote
Posted : 10/06/2021 1:31 am
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Responding to original poster:

1)  Physical images required to enable analysis

In my experience, one must create true physical forensic image of any DVR's internal hard drive in order to be able to work with the data obtained from the DVR hard drive. 

Unlike other computer systems in which a logical image will typically capture files and folders, logical images of DVR internal hard drives will NOT recover any files nor folders in my experience.  I do not know why logical images of DVR drives will not work in most cases but maybe Jaclaz has insight.

DVR Examiner;s quick start guide (DVR Examiner 3 (DVR-Examiner-Quick-Start-Guide.pdf (dmeforensics.com))) recommends using a hardware write blocker and connecting the original evidence to one's forensic analysis workstation running DVR Examiner.

IMHO it is better to first create a write-protected bit-for-bit physical image of the original evidence DVR hard drive(s) and then analyze the resulting forensic image file or make a true clone of the original evidence using the physical forensic image and then analyze the cloned hard drive.

2)  Purchase the same DVR hardware and related DVR maker's software

Once the original evidence has been cloned, it is possible to buy the same make and model of DVR as the original evidence, insert the cloned drive, and then use the original DVR's software to search and create clips as needed.

3) Option #3 as stated multiple times above is to buy and use specialized software such as DVR Examiner.

ReplyQuote
Posted : 23/07/2021 4:12 pm
Neeru
(@neeru)
New Member

In my experience, data from deleted or formatted DVR drives is not supported. One reason could be that the method of overwriting is not clear. Further most DVRs use proprietary OS and file system. The existing tools support recovery of active data from the disk if the DVR is password protected and the password is not available to the forensic examiner. 

ReplyQuote
Posted : 24/07/2021 8:39 am
Skywalker
(@skywalker)
Active Member
Posted by: @sgreene2991

Try DVR Examiner from DME Forensics. I've used it for several cases and found it to be not only user friendly but performs a thorough examination of the device.

I agree. I think it is the best tool, at least to perform a metadata analysis, I don't know if it can perform a carving. I have used it twice and it is very good. I used it with hard drives recorded by Dahua devices. The good thing is that DVR is accepted by the Courts.

ReplyQuote
Posted : 29/08/2021 10:58 am
Page 2 / 2
Share: