Investigating DVR HDD - Orion L SC184 - with WFS filesystem?

In the hard drives used in video recorders, MBR has. When you plug the drive Windows initializes it, that writes and deletes MBR disk overhead data recorded video.

Windows does NOT initialize the MBR or the disk at connection.
The only thing that os modifies on connection is the disk signature (four bytes at offset 440) and this ONLY happens if there are the Magic Bytes 55AA AND the 4 bytes are 00000000.

Which does not mean that it is not a good idea ) to use a write blocker, nor that this windows behaviour might not create problems.

jaclaz

You may want to reach out Jimmy at http//dmeforensics.com/

He can talk to you about headers in all sorts of DVRs..

Good Luck