Make an image of it, analyze with different solutions and report back what gave you the best results.
I need to recover data from a Hik Vision DVR (Model DS-7216HGHI-SH).
Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.
What is the possibility of getting any usable video from the HD from that time frame? We have run a trial copy of DVR Examiner on it. It only shows 5 clips but they say they are 00 minutes long and we can’t see what they are or which camera they are from. The local forensic tech we used to copy the drive said he would not have any ability to go beyond what DVR examiner shows. The drive is 2 TB in size.
Any suggestions for this? I tried downloading HX-Recovery but my anti-vurus software flagged it and wouldn't let me download.
According to DVR Examiner, the rest of the info is
Filesystem Name HIK_264
Filesystem Version 2018.01.22
DVR Examiner Version 2.2.0
Database Version 3/20/2018Type SegmentedRaw
Bytes Per Sector 512
Sector Count 3907029168
Total Size 1863 GB
Maybe specialists from 512Byte Company will help you. Here are their contacts http//
Maybe specialists from 512Byte Company will help you. Here are their contacts http//
soft.512byte.ua/products/hikvrecovery.html
A specialist from 512Byte Company has already posted/intervened before you
Write to your personal mail. We wrote the software, you can check what dates you can reсovery.
jaclaz
Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.
What is the possibility of getting any usable video from the HD from that time frame?
So that's approximately 4 days of overwriting then. I'd say the odds of recovery for that time frame are pretty low. I'm sure my DVR guy could recover video from the HDD, but no one can recover overwritten data…no one!
The overwriting process isn't linear considering the timeline, there are big chances that the needed data or parts of it are still available!
@JaredDM nobody can recover overwritten data, but since here we talk about video content data, if overwriting wasn't 100%, there are chances to recover dirty frames, still having parts of the original data
The overwriting process isn't linear considering the timeline, there are big chances that the needed data or parts of it are still available!
@JaredDM nobody can recover overwritten data, but since here we talk about video content data, if overwriting wasn't 100%, there are chances to recover dirty frames, still having parts of the original data
Define "dirty frame", please.
It is pretty much binary, at disk level a given sector has either been overwritten or it hasn't.
Assuming, only because of the time passed and on the features of the unknown and undocumented overwriting mechanism that something has been overwritten is as arbitrary as assuming that it has not.
As a matter of fact, if the presented data is correct
Data is from April 4th, 2018. Apparently system was set to start overwriting after ten days. We were not able to copy the hard drive until 4/18/18.
Everything is possible. 😯
We don't know WHEN the 10 days overwriting loop starts, nor how much data 10 days of recording use of the disk space, we don't even know if the recording was "motion controlled" or "continuous" and - in the case of the latter - how much compression is affected (or not affected) by a "static" scene.
Let's say that the 10 days was set because - roughly - 10 days of recording equates maximum to 1.5 TB (or 3/4 of the drive capacity), i.e. for each day there is at most 150 GB recorded, while an eventless day is more like 100 GB.
On days 1-10 the first 1.5 Tb or less are written.
What happens on day 11-20?
1) the recorder continues linearly to record past the 1.5Tb until it gets to 2 Tb, then wraps around.
2) the recorder re-starts from sector 0 (the last 500 GB of the drive are NEVER written)
3) the recorder re-starts from a *random* sector.
if #1 on day 15 (i.e. 18/04 if day 1 is 04/04) anything between 0 and 500 GB from previous recordings may have been NOT overwritten
if #2 the data is overwritten and lost
if #3 who knows?
jaclaz
I ran the HikV Recovery demo software. The demo provided a text file with a long list of dates and times including the following from the time period I am looking for
2018-04-04 11-01-23 - 11-12-35.264
2018-04-04 11-12-35 - 12-08-32.264
2018-04-04 11-15-56 - 11-27-45.264
2018-04-04 11-20-40 - 11-47-50.264
2018-04-04 11-21-53 - 12-09-42.264
2018-04-04 11-27-45 - 11-28-26.264
2018-04-04 11-28-18 - 11-48-26.264
2018-04-04 11-28-26 - 11-36-29.264
2018-04-04 11-36-29 - 12-23-05.264
2018-04-04 11-47-50 - 12-55-00.264
2018-04-04 11-48-26 - 12-35-27.264
2018-04-04 12-08-32 - 12-11-13.264
2018-04-04 12-09-42 - 12-29-02.264
2018-04-04 12-11-13 - 12-23-15.264
2018-04-04 12-23-05 - 13-30-14.264
2018-04-04 12-23-15 - 12-49-12.264
I presume these are the video clips that are recoverable? Can anyone verify that this software works to extract the clips? If so, well worth the cost but trying to do my due diligence before spending $1000 of my bosses money.
I recently had a DVR recovery case infront of me and after a lot of trying using all different tools and softwares I failed, only to find out the files had been corrupted.
I did more research and stumbled across this software which saved the case and the innocent people were saved.
check this out, best thing about it is that you can test it to see if you can recover the files, when you recover it, email the owner and tell him you see some files, he will then send you a temporary reg key so you can see if you can view the files or not, if it works, you can go ahead and purchase the tool to your requirement, this really helped me and I hope it can help you.
http//hxdvr.com/