Analysis on DVR BTR...
 
Notifications
Clear all

Analysis on DVR BTRFS File System

3 Posts
3 Users
0 Reactions
1,062 Views
ForensicMeteor
(@forensicmeteor)
Trusted Member
Joined: 11 years ago
Posts: 60
Topic starter  

We received a DVR unit with two hard drives inside. Both drives contain 2 partitions an EXT3 and an unrecognized file system. After researching this, it seems this other partition is BTRFS. FTK is unable to read this. We're seeking deleted video.

What would be the best way to go about this? Any suggestions on tools? Should I be working in a linux environment?


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

What would be the best way to go about this? Any suggestions on tools? Should I be working in a linux environment?

Yes, my advice would be to try on a Linux the "standard" commands "btrfs-find-root" and "restore" *like*
https://btrfs.wiki.kernel.org/index.php/Restore
http//ram.kossboss.com/btrfs-undelete-undeleting-recovering-accidentally-deleted-a-subvolume-or-file-in-btrfs-and-dont-have-a-snapshot/

Though seemingly it is not at all easy-peasy.

jaclaz


   
ReplyQuote
(@yunus)
Estimable Member
Joined: 17 years ago
Posts: 178
 

Have you tried DVRexaminer?

It is good for some of the DVRs.


   
ReplyQuote
Share: