CCTV Hard Drives / ...
 
Notifications
Clear all

CCTV Hard Drives / "Surveillance" Drives

Page 1 / 2
Rich2005
(@rich2005)
Senior Member

Afternoon all,
I've recently had to look at a couple of drives from CCTV systems and both times had issues.
In one instance the drive couldn't be read and sounded audibly weak when using standard SATA power connectors, whether via writeblocker or directly to the machine, however I was able to get an image powering via the CCTV system's internal power connector, and then data cable to my machine.
I've now just had another drive which I don't know the provenance of, but again is sounding slightly audibly weak/unhealthy, and no option to power via the original system to get an image or review/export.

So my question is…..is this common for CCTV hard drives to have some kind of hardware/firmware difference/setting which means they're not easily read like a normal hard drive.

These two have had standard SATA connectors and don't APPEAR to be anything special on the face of it.

Anyone with any/lots of experience with these got an idea/opinion? Even if it's just to confirm I'm unlucky and it's unusual. Or that it's common and they have some sort of difference.

Many thanks in advance for any advice.
Rich

Quote
Topic starter Posted : 17/07/2018 4:41 pm
JaredDM
(@jareddm)
Active Member

No, there's no power or interface differences at all with CCTV drives compared to standard drives. In fact, many models (such as WD Purple) have the same internal architecture and PCB as other budget consumer drives (such as WD Blue).

Typically they are just drives with only one platter and only one or two read/write heads (for power savings and less chance of head failure due to constant writing). Plus they've disabled all features that might incline the drive to go to spin down.

They connect to a computer exactly the same as any other drive. Though they won't usually contain a standard file system (I hope you know that).

I'd guess your issue might just be a weak power supply for your adapter or a lost 12V connection. Many USB docks and adapters are sold with a power supply that is too weak for many drives. Even though the adapter may say 2A, it's not really putting out that much.

The only other thing you might be facing is if the drives are set to PUIS (power up in standby mode) or have an ATA lock set. Certain DVRs do do that for "security reasons". If that's the case, you might need someone with a tool like PC-3000 to override and disable the feature. Depending on the model, it may be possible to accomplish using some Linux Kung-Fu, but that all depends on the specific case.

ReplyQuote
Posted : 17/07/2018 6:29 pm
armresl
(@armresl)
Community Legend

Take this with a grain of salt, but each cctv is different.
I've found that if you can get a copy of the online .pdf file navigating the onboard system is easy for extraction purposes and you will also maintain the file integrity.

A lot of times you can just hook up a SATA or USB drive and pull everything you want without pulling the drive.

Afternoon all,
I've recently had to look at a couple of drives from CCTV systems and both times had issues.
In one instance the drive couldn't be read and sounded audibly weak when using standard SATA power connectors, whether via writeblocker or directly to the machine, however I was able to get an image powering via the CCTV system's internal power connector, and then data cable to my machine.
I've now just had another drive which I don't know the provenance of, but again is sounding slightly audibly weak/unhealthy, and no option to power via the original system to get an image or review/export.

So my question is…..is this common for CCTV hard drives to have some kind of hardware/firmware difference/setting which means they're not easily read like a normal hard drive.

These two have had standard SATA connectors and don't APPEAR to be anything special on the face of it.

Anyone with any/lots of experience with these got an idea/opinion? Even if it's just to confirm I'm unlucky and it's unusual. Or that it's common and they have some sort of difference.

Many thanks in advance for any advice.
Rich

ReplyQuote
Posted : 17/07/2018 6:36 pm
kastajamah
(@kastajamah)
Active Member

I have had success with cloning the DVR's drive using Forensic Falcon or Tableau TD3 and TD2, and then putting in the clone drive into the DVR. That way I do not work with the original. I have only done this with DVR's I brought into the lab.

If I am on scene, I use the DVR's built in backup tools. I make sure and download the original video format. You need to confirm that it downloads a player, or you might have to reach out to the manufacturer and not all of them have tech support. I then will use the player to convert to AVI/WMV/MPG if that is an option. There can be some loss of quality and ratio when exporting as an AVI/WMV/MPG, and a defense attorney worth his/her salt would argue that with you on the stand.

ReplyQuote
Posted : 17/07/2018 8:16 pm
Rich2005
(@rich2005)
Senior Member

Thanks for the replies guys.
Unfortunately I'd already considered (and tried) all of what you describe (where applicable) so my question relates to the drives inside the machine.
So far 2 out of 2 from different systems have not wanted to play ball and power up properly, and sound audibly lethargic, whether via a tableau or directly in the machine using a linux forensics live cd. The first one was only able to be powered when powered from the system board of the original system (and was then imaged fine).
Second one I don't have the original system to see if the same applies (different case).
So I was just curious as to whether this is an unlikely anomaly or there's something specific that crops up with hard drives in CCTV systems (some sort of adapted power configuration that's not letting them be imaged via standard SATA power connectors).

ReplyQuote
Topic starter Posted : 17/07/2018 8:24 pm
JaredDM
(@jareddm)
Active Member

Well, power wise, CCTV drives are exactly the same as any other drive. Perhaps there is more to this story. Was the DVR actually working when the drive was removed? Was it perhaps sabotaged by the thief? I've seen several where a thief had banged the DVR around hard enough to destroy the drive inside.

Do you hear clicking sounds coming from the drive? You say it sounds lethargic….care to expound on what that means?

ReplyQuote
Posted : 17/07/2018 9:11 pm
Rich2005
(@rich2005)
Senior Member

Well, power wise, CCTV drives are exactly the same as any other drive. Perhaps there is more to this story. Was the DVR actually working when the drive was removed? Was it perhaps sabotaged by the thief? I've seen several where a thief had banged the DVR around hard enough to destroy the drive inside.

Do you hear clicking sounds coming from the drive? You say it sounds lethargic….care to expound on what that means?

Without going into case specifics it's not one where there's much doubt about it being deliberately damaged (of course dropped in transit is a consideration - however - as in the case of the first drive - it did actually image correctly once connected via the system's own sata power connector rather than various attempts on different kit in the lab). That was a last-resort attempt and was surprised it worked.

I'm not sure I can describe the sound on either better than lethargic, the first job was a little while ago so recall isn't perfect, but the current one, as I say, has been making no sound particularly bad that would indicate slightly more common hard drive faults, just sounds as if it's underpowered rather than nasty scratching, clicking, or motor problem sounds. Underpowed not being a logical explanation when it's being supplied by a variety of standard SATA power sources.

It's one that's baffled me logically. As I assumed the drives are standard, and don't appear to be hardware faults (as the first one imaged fine once using the system's SATA power source), yet neither imaged using standard kit!

ReplyQuote
Topic starter Posted : 17/07/2018 9:29 pm
JakubR
(@jakubr)
New Member

Some DVRs use hard drives which looks like a normal drive (WD Purple for example) but have modified HDD firmaware to work only with dedicated hardware. I saw few of them in DVRs. I dont know, your drive is this kind of HDD but it may be option. Sometimes you have to send special "secret" commands by SATA port to start this drive and later use standard ATA commands to work with data area. Your PC or Hardware Imager start to do they job with standard ATA commands but they will never work without proper "authorisation" to drive firmware.

But maybe solution is simpler ? Maybe your drive is just damaged ?

ReplyQuote
Posted : 17/07/2018 9:37 pm
Rich2005
(@rich2005)
Senior Member

Some DVRs use hard drives which looks like a normal drive (WD Purple for example) but have modified HDD firmaware to work only with dedicated hardware. I saw few of them in DVRs. I dont know, your drive is this kind of HDD but it may be option. Sometimes you have to send special "secret" commands by SATA port to start this drive and later use standard ATA commands to work with data area. Your PC or Hardware Imager start to do they job with standard ATA commands but they will never work without proper "authorisation" to drive firmware.

But maybe solution is simpler ? Maybe your drive is just damaged ?

I was about to say this sounds like the sort of thing…..but then realised, going back to the fact I could power it and image it via the original system's board and power connector, suggests it might not be be that!
It's definitely a puzzling one )

ReplyQuote
Topic starter Posted : 17/07/2018 10:33 pm
jcoller
(@jcoller)
New Member

Although some CCTV hard drives can be based on a standardized Operating system, many are not. In law enforcement there is an entire subset of digital forensics dedicated to Video Evidence from sources like this. A good resource for training in this area is LEVA International. A great program for reading and extracting data from proprietary DVR drives is DVR Examiner by DME Forensics. They even offer a free trial of their software to verify it can access and read the data on your drive before you buy.

ReplyQuote
Posted : 31/07/2018 1:33 pm
Rich2005
(@rich2005)
Senior Member

Although some CCTV hard drives can be based on a standardized Operating system, many are not. In law enforcement there is an entire subset of digital forensics dedicated to Video Evidence from sources like this. A good resource for training in this area is LEVA International. A great program for reading and extracting data from proprietary DVR drives is DVR Examiner by DME Forensics. They even offer a free trial of their software to verify it can access and read the data on your drive before you buy.

I had tried DVR Examiner, the problem was though, that the drives wouldn't image/read (unless powered by the original system in the first instance), so was curious as to the reason why (if anyone had an idea).
So, whilst DVR Examiner is a useful tool for processing the unusual file-systems, and exporting data from them, that's not an option if the drive can't be read!
Still none the wiser, but I've worked round the problem(s) for now, but would always be interested to hear if someone has had similar experiences with CCTV drives.

ReplyQuote
Topic starter Posted : 31/07/2018 1:39 pm
JaredDM
(@jareddm)
Active Member

Some CCTV systems use an ATA lock on the drives so they can't be read outside the DVR. They could also be using PUIS (power up in standby mode). There's a few reasons.

Depending on the drive model, there's sometimes free utilities to unlock it (for example WD usually has a generic master key for ATA lock). Other times, it requires tools like PC-3000 to override the function and get the drive working normally.

Either way, a reputable data recovery company should have no problem unlocking and imaging such drives.

ReplyQuote
Posted : 31/07/2018 7:14 pm
passcodeunlock
(@passcodeunlock)
Senior Member

I would measure the voltage output of the computer's power supply with a regular drive connected and then the DVR drive connected. If there is a measurable difference, it might be simply a bad connection.

Used (old) power supplies aren't giving the power needed to spin up the drive if oxidation or other corrosion appear on the power pins.

…or just simply connect the DVR drive to another computer.

ReplyQuote
Posted : 31/07/2018 7:37 pm
jaclaz
(@jaclaz)
Community Legend

I would measure the voltage output of the computer's power supply with a regular drive connected and then the DVR drive connected. If there is a measurable difference, it might be simply a bad connection.

Used (old) power supplies aren't giving the power needed to spin up the drive if oxidation or other corrosion appear on the power pins.

You sure it would be a (measurable) voltage issue, and not a power (Amperes) one, as JaredDM previously mentioned?

For sure once upon a time external 2.5" external cases came often with a (needed) USB Y cable as taking the power from a single USB port (500 mA) was not enough for many (old) 2.5" drives.
Voltage was obvioulsy 5 Volts allright, but simplt not enough Amperes could be drawn to spin up and operate the drive.

And it happened to me more than once that a (old) power supply gave the right voltage but not enough "juice".

jaclaz

ReplyQuote
Posted : 31/07/2018 8:46 pm
passcodeunlock
(@passcodeunlock)
Senior Member

@jaclaz no, as I wrote, voltage!

I fully understand what you are trying to say with the power consumption and milli Ampers given / taken, but if the voltage will significantly vary and not stay constant, it means there is a capacitance issue + heating, which usually is caused by bad connection / corrosion / oxidation.

ReplyQuote
Posted : 01/08/2018 12:03 pm
Page 1 / 2
Share:
Share to...