Recover data from h...
 
Notifications
Clear all

Recover data from hdd/dvd recorder ?

15 Posts
10 Users
1 Reactions
3,124 Views
ForensicRanger
(@forensicranger)
Estimable Member
Joined: 16 years ago
Posts: 122
Topic starter  

Folks,
Would anyone have insight as to how to view/recover the data on a dvd recorder's hdd? ..though windows initially sees the hdd, it can't mount due to the proprietary software used (in this instance, an LG).

Thanks!


   
Quote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

What information were you able to get from the manufacturer?


   
ReplyQuote
(@a_kuiper)
Trusted Member
Joined: 16 years ago
Posts: 69
 

Many DVD-recorders just use mpeg2. Extracting it can be done in a few easy steps

- dump the contents of the HDD to an uncompressed file on your local HDD
- use a file-carving tool to carve out the segmented mpgs
- copy them to one big file, copy /b *.mpg result.mpg
- use avidemux for cutting (even the time-stamps should be fine)


   
ReplyQuote
ForensicRanger
(@forensicranger)
Estimable Member
Joined: 16 years ago
Posts: 122
Topic starter  

key No reply yet from the Manufacturer

a_kui I hooked it up through a tableau bridge, Win detects the hdd - tells me it was ready to use, but the drive was not visible (explorer didn't show it, nor did win mgr)… any other thoughts?


   
ReplyQuote
(@angrybadger)
Estimable Member
Joined: 18 years ago
Posts: 164
 

a_kui I hooked it up through a tableau bridge, Win detects the hdd - tells me it was ready to use, but the drive was not visible (explorer didn't show it, nor did win mgr)… any other thoughts?

This just means that Windows doesnt recognise the file system.
have you looked at it withe Encase or better still Winhex?


   
ReplyQuote
ForensicRanger
(@forensicranger)
Estimable Member
Joined: 16 years ago
Posts: 122
Topic starter  

hm indeed.. EnCase and FTK - no dice… have not tried Winhex.


   
ReplyQuote
(@rich2005)
Honorable Member
Joined: 19 years ago
Posts: 541
 

When you say it doesn't see it, what do you mean exactly?
Is it seeing data, but just not interpreting the filesystem?
If so what filesystem? One you can manually add in EnCase or other tool? Proprietary FS?


   
ReplyQuote
ForensicRanger
(@forensicranger)
Estimable Member
Joined: 16 years ago
Posts: 122
Topic starter  

Windows recognizes the drive but does not assign it a drive letter; since I don't have a drive letter, I can't 'open' the drive..


   
ReplyQuote
(@angrybadger)
Estimable Member
Joined: 18 years ago
Posts: 164
 

Windows recognizes the drive but does not assign it a drive letter; since I don't have a drive letter, I can't 'open' the drive..

which means that Windows doesnt know what to do with the filesytem. i.e. its not FAT, FAT32 or NTFS.

What did encase say, did it give you (at the very least) a size for the drive?

If its something stupid (e.g. 0 blocks) then you can either give up or go for a DR, something has gone wrong with the firm/hardware.

Are any partitions defined or is it one big block of unallocated ?
If so look at it in hex mode, whats in block zero?


   
ReplyQuote
(@a_kuiper)
Trusted Member
Joined: 16 years ago
Posts: 69
 

@ForensiX In most cases you won't have any filesystem at all. That's why you should dump the whole contents to a file on your local system. Do this with windd, winhex, …


   
IainWhite reacted
ReplyQuote
Page 1 / 2
Share: