Hello all,
I received a hard disk from a DVR which records video and I need to carve the video files from the hdd.
The HDD has 2 partitions, one is ext2 (1GB size) and contains *.nvr files with a filename like ch0120140311.. Some sort of index files I think.
The second parition is an unknown file system and my question is how do I determine which filesystem it uses? FTK Imager and my Linux live CD's says it's Linux based, but nothing is able to detect the filesystem type. I've tried EnCase, winHex, FTK Imager and Ubuntu.
Anyone has an idea how to determine the filesystem of the 2nd partition?
If you have the make and model of the DVR unit, you may be able to find out what format it records the video in. Then you may be able to carve.
…contains *.nvr files with a filename like ch0120140311.. Some sort of index files I think.
Have you looked at the contents of these files? How large are they?
FTK Imager and my Linux live CD's says it's Linux based…
What information did these tools give you? Try running 'parted' from Terminal in your Linux OS against the image of the disk to see what info that gives you on the partitions.
Hi Jaappie,
Indeed what HexDrugsRockNRoll said "What's the make and model of the recorder?"
Any clues if you look at the first part of the partition?
Do you know what file format the recorder uses for export?
It isnt always possible to determine the filesystem. I've seen lots of exotic filesystems. Besides getting access to the filesystem what is the problem? Want to make a copy of the video's, research?
If you have the make and model of the DVR unit, you may be able to find out what format it records the video in. Then you may be able to carve.
Have you looked at the contents of these files? How large are they?
What information did these tools give you? Try running 'parted' from Terminal in your Linux OS against the image of the disk to see what info that gives you on the partitions.
The parted command showed the "Type" field as empty. But the ID of the partition is 83, which means it's linux based I believe.
The *.nvr files are about 20-100 kb each, so probably no video inside these files. The partition of the *.nvr files is also 1 GB. A little bit small for video. The unknown partition is 475GB, probably where the video is store.
It has no real brand but the DVR contains the text "H.264 8CH Digital Video Recorder" and the underside contains "HR D9008V".
Is this the one?
http//
Long discussion here on recovering H.264 compressed videos
If you have the make and model of the DVR unit, you may be able to find out what format it records the video in. Then you may be able to carve.
Have you looked at the contents of these files? How large are they?
What information did these tools give you? Try running 'parted' from Terminal in your Linux OS against the image of the disk to see what info that gives you on the partitions.
The parted command showed the "Type" field as empty. But the ID of the partition is 83, which means it's linux based I believe.
The *.nvr files are about 20-100 kb each, so probably no video inside these files. The partition of the *.nvr files is also 1 GB. A little bit small for video. The unknown partition is 475GB, probably where the video is store.
It has no real brand but the DVR contains the text "H.264 8CH Digital Video Recorder" and the underside contains "HR D9008V".
Hey Jappie,
2 Things you need to consider, if the hard disks are already full in space you should know the retereiving the previously recorded videos are imposibble since they are overwritten
Another thing is, DVR is an integrated system that comes with monitors and an operating system, most DVR's won't display what they've saved unless they are placed on its original OS.