Notifications

Clear all

Hikvision DVR data recovery

Lukamo · 2018-03-07T19:20:17Z

Hello everyone.I've tried searching through these forums for information about a solution to my problem, but I haven't found anything conclusive.Here's my situation. (excuse my english as it is not my main language)During a preparation for the analysis of one of our cases, we had many HDD's in multiple DVRs to copy, so that we could replace the original drives with the copies so that the investigators assigned to the case could watch the footage on the DVR's we were sent.To do the copy, we used Solo4 devices to copy 2 hard drives at a time (1 disk of 1TB, 1 of 2TB)During the preparation, a tech mistakenly plugged the empty drives (Destination) into the source slot, and the actual evidence into the destination drives.Once the copy started, a minute or two passed before the tech realized the mistake and immediately stopped the process.The result of this is that a portion of the hard drives (about 35gb on the 2TB) has zeroed out, and the rest is still intact.DVR Examiner fails to recognize anything (i assume it uses the start of the disk to parse out the files).After messing with the hex, we were able to recognize a sort of pattern that started with A.HK (hex 41 12 48 4B) that seemed to include one frame of a video (when carving a full cycle from a.hk to a.hk, it would give me a video with one frame).I am guessing the video is an assembly of frames. i have not yet found out how to isolate a full video and separate camera channels.We have tried taking the full set of data (from the first A.HK to the last on the drive) and carve it as a mp4. It ended up being a very long video with a mix of all the channels and a series of recordings that did not seem to follow a particular order (seemed chronological for the most part though, but it jumped back and forth on the timestamps once in a while).We tried carving with Belkasoft Evidence center, Encase, X-Ways, DVR Examiner, but everything failed.—–So here's what we're looking for Is there a way to carve out the videos in a way to isolate each video sequence (channel/date/time) with the meta data parsed out? We do not have the time to do the R&D to that extent so if anyone has any idea how to do this… It would be very appreciated.Let us know

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by soft512byte 7 years ago

15 Posts

7 Users

0 Reactions

9,567 Views

RSS

Lukamo

(@lukamo)

Active Member

Joined: 7 years ago

Posts: 6

Topic starter 14/03/2018 8:04 pm

Just wanted to update everyone

HX-DVR Solved the issue for us. It recovered every file along with the meta data of every recording.

Thanks to everyone who chimed in!

ReplyQuote

MrMacca

(@mrmacca)

Eminent Member

Joined: 8 years ago

Posts: 20

15/03/2018 10:54 am

When i try to visit their site, I get a Malware Warning from my BitDefender AV.

ReplyQuote

jaclaz

(@jaclaz)

Illustrious Member

Joined: 18 years ago

Posts: 5133

15/03/2018 12:31 pm

When i try to visit their site, I get a Malware Warning from my BitDefender AV.

Only as a single data point, other 66 AV engines seemingly don't

https://www.virustotal.com/it/url/c5e4ecb457d7a21beb2b5ea7efd6983a87d1db787a6ac6ef8bcbe9e1878c6f0f/analysis/1521113431/

Should Bitdefender (and Bitdefender only) be trusted?
Or it may be a "false positive" and thus the "majority" is to be trusted?

decisions, always decisions ….

jaclaz

ReplyQuote

passcodeunlock

(@passcodeunlock)

Prominent Member

Joined: 9 years ago

Posts: 792

15/03/2018 4:01 pm

It is just a false positive, a visit from sandbox was harmless.

ReplyQuote

soft512byte

(@soft512byte)

Active Member

Joined: 7 years ago

Posts: 16

07/04/2018 6:04 pm

I am a software developer for the DVR. I can answer questions within reason.

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
253 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed