i have DVR from "HD iDVR". which i cant mount, first sector says WFS0.4. i tried hx-recovery, it shows many files with dates, but i dont have the license… im thinking switch the evidence hdd with clean hdd, record some sample file, and get the signature and carve. is there any other way??
I did a manual recovery of WFS0.4 with a simple hex editor under linux, since no software was able doing it.
Many multi-channel DVR's can't be recovered with simple file carving because they fragment the various channels into a single stream. Even if you knew the signatures, you'd likely be recovering chunks of data from multiple cameras into a single file.
I've got a guy here I work with that specializes in just these cases. He actually has his own software he writes and modifies for each case. Let me know if you need help with it.
I am working on a case with this file system. Wondering if you could share that software @jareddm
@forensics86 check out this thread: removed link i.e: removed link
I'd like a open source driver for linux that suppor WFS0.4 filesystem but still not luck. The previous windows app works, but it's slow and it has a uncomfortable interface
well i can't post links 🤣Â
just search "ICSEE FOR PC"
and then "Play video from icsee camera memory card."