Hi,
Does anyone have any experience in recovering data from a Samsung SVR-950 CCTV Unit? Via the CCTV unit my client has formatted the hard drive, therefore removing the recordings. My colleagues overseas have the unit, they were able to remove the HDD and create an image, viewing this image shows only one partition, 4.5GB (EXT2) partition.
Does anyone have experience of recovering data from this type of device?
What format are the video files stored?
Any suggestions how I can recover the deleted video's?
Thanks in advance
LF
You are going to have some major problems here.
A lot of CCTV units use proprietary codecs and non standard video formats. Some use a series of stills rather than true video. Quite a few will stream multiple camera angles into a single video file, hence playing with normal video viewers is not possible.
They are generally Linux based software but I have seen them running on windows and other Unix builds before.
First thing I would be doing would be to contact the security company that installed the unit and find the details of the software running on the system and what type of codecs they use. Many software vendors will also produce a viewer for their video files which can assist.
Ideally you would like to find the header (and footer if it exists) for the video files that unit uses, then you can carve for those details across the partition. The software producer may be able to give you those details too. At the very least the video extension will be better than nothing.
That's assuming no encryption is at play either.
have a look at
topic 10325
Try to make a sample export with a similar device in the most genuine format (no avi, mpeg) etc, (probably proprietary) and investigate the data.
Maybe it is possible to export some data from unallocated clusters and insert it into the viewer / sample export.
I've been working with several different models from samsung. Depending of the model the path to retrieve the images is different. First thing you would have to check is wether the information remains once formatted the device, the worst case should lead you to use a tool to recover the formatted data.
The information you provided make me believe that it's one of the most common models, as they use a Ext2 partition system. If you format the drive through the DVR itself, it creates the system partition to say it somehow which contains a very valuable information in different files (plain text).
Here is the trick to retrieve the video streams from a samsung DVR (the most spreaded models)
1. Take the huge file and make a byte swap (using dd command in linux or Winhex or whichever the tool you prefer).
2. Once transformation is achieved (it takes time), take the new swapped file and use "ffmpeg" to list the different streams inside the file.
3. Using "ffmpeg" extract the streams into different files (with the coding of your choice) so you can play and review them.
Attention; A mistaken video codec conversion would lead you to get a great loss in the quality of video and as it's critical they would be useless.
Hope that helps.
Never say "It can't be done".