Notifications
Clear all

HikVision DVR  

Page 1 / 2
  RSS
ares99
(@ares99)
New Member

I need to recover data from a Hik Vision DVR (Model DS-7216HGHI-SH).

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

What is the possibility of getting any usable video from the HD from that time frame? We have run a trial copy of DVR Examiner on it. It only shows 5 clips but they say they are 00 minutes long and we can’t see what they are or which camera they are from. The local forensic tech we used to copy the drive said he would not have any ability to go beyond what DVR examiner shows. The drive is 2 TB in size.

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.

According to DVR Examiner, the rest of the info is

Filesystem Name HIK_264
Filesystem Version 2018.01.22
DVR Examiner Version 2.2.0
Database Version 3/20/2018

Type SegmentedRaw
Bytes Per Sector 512
Sector Count 3907029168
Total Size 1863 GB

Quote
Posted : 26/04/2018 4:20 pm
sxtt
 sxtt
(@sxtt)
New Member

Hi,

It depends on the configuration of the HiKVision unit i.e are the cameras only recording when movement is on. Majority of the time there is free space so you would find overwriting hasn't taken place. I've had it go back up to 90 days

Is the unit one or two drives?

ReplyQuote
Posted : 26/04/2018 4:34 pm
ares99
(@ares99)
New Member

It is one drive. It appeared when we looked at it before copying the hard drive that it was recording all the time. There were 5 cameras.

ReplyQuote
Posted : 26/04/2018 5:07 pm
jaclaz
(@jaclaz)
Community Legend

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.

Let me guess … 😯

… you are using BitDefender … roll

1/67 on VirusTotal !

https://www.virustotal.com/#/url/028fb767568d80c586ec2de40c66d557c94dd23e458d99eba7ac9c4cf0a5f05b/detection

jaclaz

ReplyQuote
Posted : 26/04/2018 5:16 pm
ares99
(@ares99)
New Member

No, actually it was both Norton (home) and Vipre (work). I can download the file from the site fine but when I try to unzip it is when its gets blocked.

ReplyQuote
Posted : 26/04/2018 5:35 pm
jaclaz
(@jaclaz)
Community Legend

No, actually it was both Norton (home) and Vipre (work). I can download the file from the site fine but when I try to unzip it is when its gets blocked.

This is "queer" 😯 Antivirus programs do decompress archives checking their contents, so there should be no difference between downloading it and only decompressing/expanding it after download (the moment the actual installer or howerver .exe is executed may of course change the situation).

In any case you should be able to make an exception for the file, decompress the contents, then re-analyze the expanded contents.

All I can tell you (but you shouldn't trust advice from a stranger on the internet) is that the decompressed contents are fine here in ClamWin

Scan Started Thu Apr 26 184218 2018
β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”β€”-

———– SCAN SUMMARY ———–
Known viruses 6482700
Engine version 0.99.4
Scanned directories 1
Scanned files 10
Infected files 0

Data scanned 27.88 MB
Data read 26.70 MB (ratio 1.041)
Time 30.062 sec (0 m 30 s)

————————————–
Completed

and that the same contents on VirusTotal are again 1/67 ot 1/68 flagged by "CrowdStrikeFalcon" (WHO?) and nor by BitDefender

jaclaz

ReplyQuote
Posted : 26/04/2018 5:44 pm
ares99
(@ares99)
New Member

Thanks for the info. Do you think I will be able to get more from HX Recovery than what DVR Examiner found?

ReplyQuote
Posted : 26/04/2018 6:01 pm
Tacobreath
(@tacobreath)
New Member

I have limited experience with recovering video from DVRs. That said, when I used both DVR Examiner (trial) and HX Recovery for one case, only DVR Examiner was able to recognize the file system and show me the video files ready for examination.

If you can afford DVR Examiner, it appears to be money well-spent. The founder of the company that makes DVR Examiner, Jimmy Schroering, is active on the IACIS listserv. He's always willing to answer questions you may have about the product or even DVR forensics in general.

ReplyQuote
Posted : 26/04/2018 6:32 pm
jaclaz
(@jaclaz)
Community Legend

Thanks for the info. Do you think I will be able to get more from HX Recovery than what DVR Examiner found?

Hard to say, in at least another occasion it worked fine where DVR Examiner failed
https://www.forensicfocus.com/Forums/viewtopic/t=16393/

but as you most probably well know each software may work exceptionally well in one case and do nothing of use on another one.

jaclaz

ReplyQuote
Posted : 26/04/2018 6:42 pm
soft512byte
(@soft512byte)
New Member

Write to your personal mail. We wrote the software, you can check what dates you can reсovery.

ReplyQuote
Posted : 26/04/2018 6:44 pm
passcodeunlock
(@passcodeunlock)
Senior Member

Make an image of it, analyze with different solutions and report back what gave you the best results.

ReplyQuote
Posted : 26/04/2018 7:01 pm
tito
 tito
(@tito)
New Member

I need to recover data from a Hik Vision DVR (Model DS-7216HGHI-SH).

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

What is the possibility of getting any usable video from the HD from that time frame? We have run a trial copy of DVR Examiner on it. It only shows 5 clips but they say they are 00 minutes long and we can’t see what they are or which camera they are from. The local forensic tech we used to copy the drive said he would not have any ability to go beyond what DVR examiner shows. The drive is 2 TB in size.

Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.

According to DVR Examiner, the rest of the info is

Filesystem Name HIK_264
Filesystem Version 2018.01.22
DVR Examiner Version 2.2.0
Database Version 3/20/2018

Type SegmentedRaw
Bytes Per Sector 512
Sector Count 3907029168
Total Size 1863 GB

Maybe specialists from 512Byte Company will help you. Here are their contacts http//soft.512byte.ua/products/hikvrecovery.html

ReplyQuote
Posted : 27/04/2018 7:29 am
jaclaz
(@jaclaz)
Community Legend

Maybe specialists from 512Byte Company will help you. Here are their contacts http//soft.512byte.ua/products/hikvrecovery.html

A specialist from 512Byte Company has already posted/intervened before you

Write to your personal mail. We wrote the software, you can check what dates you can reсovery.

jaclaz

ReplyQuote
Posted : 27/04/2018 8:48 am
JaredDM
(@jareddm)
Active Member

Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.

What is the possibility of getting any usable video from the HD from that time frame?

So that's approximately 4 days of overwriting then. I'd say the odds of recovery for that time frame are pretty low. I'm sure my DVR guy could recover video from the HDD, but no one can recover overwritten data…no one!

ReplyQuote
Posted : 27/04/2018 10:02 pm
passcodeunlock
(@passcodeunlock)
Senior Member

The overwriting process isn't linear considering the timeline, there are big chances that the needed data or parts of it are still available!

@JaredDM nobody can recover overwritten data, but since here we talk about video content data, if overwriting wasn't 100%, there are chances to recover dirty frames, still having parts of the original data

ReplyQuote
Posted : 28/04/2018 8:07 am
Page 1 / 2
Share: