Notifications
Clear all

DVR recovery WFS0.4

Sansarmaa
(@sansarmaa)
New Member

i have DVR from "HD iDVR". which i cant mount, first sector says WFS0.4. i tried hx-recovery, it shows many files with dates, but i dont have the license… im thinking switch the evidence hdd with clean hdd, record some sample file, and get the signature and carve. is there any other way??

Quote
Topic starter Posted : 09/12/2016 4:13 pm
passcodeunlock
(@passcodeunlock)
Senior Member

I did a manual recovery of WFS0.4 with a simple hex editor under linux, since no software was able doing it.

ReplyQuote
Posted : 10/12/2016 2:12 pm
JaredDM
(@jareddm)
Active Member

Many multi-channel DVR's can't be recovered with simple file carving because they fragment the various channels into a single stream. Even if you knew the signatures, you'd likely be recovering chunks of data from multiple cameras into a single file.

I've got a guy here I work with that specializes in just these cases. He actually has his own software he writes and modifies for each case. Let me know if you need help with it.

ReplyQuote
Posted : 11/12/2016 6:49 pm
forensics86
(@forensics86)
New Member

I am working on a case with this file system. Wondering if you could share that software @jareddm

ReplyQuote
Posted : 18/05/2022 6:27 pm
Share:
Share to...